Arch Linux Security Advisory ASA-202006-4
========================================
Severity: High
Date    : 2020-06-06
CVE-ID  : CVE-2020-12398 CVE-2020-12399 CVE-2020-12405 CVE-2020-12406
          CVE-2020-12410
Package : thunderbird
Type    : multiple issues
Remote  : Yes
Link    : https://security.archlinux.org/AVG-1179

Summary
======
The package thunderbird before version 68.9.0-1 is vulnerable to
multiple issues including arbitrary code execution, denial of service,
man-in-the-middle and private key recovery.

Resolution
=========
Upgrade to 68.9.0-1.

# pacman -Syu "thunderbird>=68.9.0-1"

The problems have been fixed upstream in version 68.9.0.

Workaround
=========
None.

Description
==========
- CVE-2020-12398 (man-in-the-middle)

A security downgrade issue has been found in Thunderbird before 68.9.0.
If Thunderbird is configured to use STARTTLS for an IMAP server, and
the server sends a PREAUTH response, then Thunderbird will continue
with an unencrypted connection, causing email data to be sent without
protection.

- CVE-2020-12399 (private key recovery)

NSS before 3.52.1, as used in Firefox before 77.0 and Thunderbird
before 68.9.0, has shown timing differences when performing DSA
signatures, which was exploitable and could eventually leak private
keys.

- CVE-2020-12405 (denial of service)

When browsing a malicious page in Firefox before 77.0 and Thunderbird
before 68.9.0, a race condition in our SharedWorkerService could occur
and lead to a potentially exploitable crash.

- CVE-2020-12406 (arbitrary code execution)

Mozilla Developer Iain Ireland discovered a missing type check in
Firefox before 77.0 and Thunderbird before 68.9.0 during unboxed
objects removal, resulting in a crash. We presume that with enough
effort that it could be exploited to run arbitrary code.

- CVE-2020-12410 (arbitrary code execution)

Mozilla developers Tom Tung and Karl Tomlinson reported memory safety
bugs present in Firefox 76, Firefox ESR 68.8 and Thunderbird before
68.9.0. Some of these bugs showed evidence of memory corruption and
Mozilla presumes that with enough effort some of these could have been
exploited to run arbitrary code.

Impact
=====
A remote attacker might be able to recover private keys, downgrade an
encrypted connection, execute arbitrary code or crash the application.

References
=========
https://www.mozilla.org/en-US/security/advisories/mfsa2020-22/
https://www.mozilla.org/en-US/security/advisories/mfsa2020-22/#CVE-2020-12398
https://bugzilla.mozilla.org/show_bug.cgi?id=1613623
https://www.mozilla.org/en-US/security/advisories/mfsa2020-20/
https://bugzilla.mozilla.org/show_bug.cgi?id=1631576
https://hg.mozilla.org/projects/nss/rev/daa823a4a29bcef0fec33a379ec83857429aea2e
https://bugzilla.mozilla.org/show_bug.cgi?id=1631618
https://bugzilla.mozilla.org/show_bug.cgi?id=1639590
https://bugzilla.mozilla.org/buglist.cgi?bug_id=1619305%2C1632717
https://security.archlinux.org/CVE-2020-12398
https://security.archlinux.org/CVE-2020-12399
https://security.archlinux.org/CVE-2020-12405
https://security.archlinux.org/CVE-2020-12406
https://security.archlinux.org/CVE-2020-12410

ArchLinux: 202006-4: thunderbird: multiple issues

June 9, 2020

Summary

- CVE-2020-12398 (man-in-the-middle) A security downgrade issue has been found in Thunderbird before 68.9.0. If Thunderbird is configured to use STARTTLS for an IMAP server, and the server sends a PREAUTH response, then Thunderbird will continue with an unencrypted connection, causing email data to be sent without protection.
- CVE-2020-12399 (private key recovery)
NSS before 3.52.1, as used in Firefox before 77.0 and Thunderbird before 68.9.0, has shown timing differences when performing DSA signatures, which was exploitable and could eventually leak private keys.
- CVE-2020-12405 (denial of service)
When browsing a malicious page in Firefox before 77.0 and Thunderbird before 68.9.0, a race condition in our SharedWorkerService could occur and lead to a potentially exploitable crash.
- CVE-2020-12406 (arbitrary code execution)
Mozilla Developer Iain Ireland discovered a missing type check in Firefox before 77.0 and Thunderbird before 68.9.0 during unboxed objects removal, resulting in a crash. We presume that with enough effort that it could be exploited to run arbitrary code.
- CVE-2020-12410 (arbitrary code execution)
Mozilla developers Tom Tung and Karl Tomlinson reported memory safety bugs present in Firefox 76, Firefox ESR 68.8 and Thunderbird before 68.9.0. Some of these bugs showed evidence of memory corruption and Mozilla presumes that with enough effort some of these could have been exploited to run arbitrary code.

Resolution

Upgrade to 68.9.0-1. # pacman -Syu "thunderbird>=68.9.0-1"
The problems have been fixed upstream in version 68.9.0.

References

https://www.mozilla.org/en-US/security/advisories/mfsa2020-22/ https://www.mozilla.org/en-US/security/advisories/mfsa2020-22/#CVE-2020-12398 https://bugzilla.mozilla.org/show_bug.cgi?id=1613623 https://www.mozilla.org/en-US/security/advisories/mfsa2020-20/ https://bugzilla.mozilla.org/show_bug.cgi?id=1631576 https://hg.mozilla.org/projects/nss/rev/daa823a4a29bcef0fec33a379ec83857429aea2e https://bugzilla.mozilla.org/show_bug.cgi?id=1631618 https://bugzilla.mozilla.org/show_bug.cgi?id=1639590 https://bugzilla.mozilla.org/buglist.cgi?bug_id=1619305%2C1632717 https://security.archlinux.org/CVE-2020-12398 https://security.archlinux.org/CVE-2020-12399 https://security.archlinux.org/CVE-2020-12405 https://security.archlinux.org/CVE-2020-12406 https://security.archlinux.org/CVE-2020-12410

Severity
CVE-2020-12410
Package : thunderbird
Type : multiple issues
Remote : Yes
Link : https://security.archlinux.org/AVG-1179

Workaround

None.

Related News

The End of the Road for Linux 6.11: A Call to Upgrade to Kernel 6.12
3 - 5 min read
The Linux kernel community recently issued an EOL announcement regarding the 6.11 kernel series, urging sysadmins to upgrade quickly to 6.12 . This
A Linux Admin
3 - 6 min read
As 2025 approaches, we Linux admins are facing new and often unseen cloud-native security obstacles. While skilled at mitigating known risks,
Leveraging Insights from the Linux Foundation
3 - 5 min read
The Linux Foundation's recent Census III report provides critical insights for Linux administrators, information security professionals, and anyone
Chrome 131 Released: Emergency Security Update Fixes Over a Dozen Significant Vulns
3 - 6 min read
Google recently unveiled a critical security update to their popular web browser, Google Chrome, addressing over a dozen significant security
From Wayland Fixes to Security Boosts: Examining Qt 6.8.1
3 - 6 min read
The recent Qt 6.8.1 release brings significant updates and improvements, strengthening its reputation as a secure and reliable application
Exploring Arch Linux 2024.12.01: Security Implications & Notable Enhancements for Linux Admins
3 - 6 min read
The Arch Linux 2024.12.01 ISO release marks an impressive milestone, offering cutting-edge updates that enhance functionality, streamline
Deck the Halls with Enhanced Security: Linux Kernel 6.13
3 - 5 min read
As Linux admins and infosec professionals prepare for the holiday season, there's much cause for celebration this year! Linus Torvalds recently made
Lessons from Bootkitty: Securing Linux Systems Against UEFI Intrusions
3 - 5 min read
New Linux security threats mark critical junctures that challenge existing policies and test security protocols to their limit. One such milestone

Get the Latest News & Insights

Sign up to get the latest security news affecting Linux and open source delivered straight to your inbox.

© 2024 Guardian Digital, Inc All Rights Reserved