KLA10970
Multiple vulnerabilities in Mozilla Thunderbird
Обновлено: 17/06/2019
Дата обнаружения
07/03/2017
Уровень угрозы
Critical
Описание

Multiple serious vulnerabilities have been found in Mozilla Thunderbird. Malicious users can exploit these vulnerabilities to obtain sensitive information, run arbitrary code and cause a denial of service.

Below is a complete list of vulnerabilities

  1. Memory curruption vulnerability in asm.js can be exploited remotely to bypass of ASLR and DEP protections leading to a denial of service;
  2. Memory corruption vulnerability in triggerable web content can be exploited remotely to cause a denial of service;
  3. Use-after-free vulnerability, which can occur when events are fired, after their destroying in the FontFace objects can be exploited remotely to cause a denial of service;
  4. Use-after-free vulnerability, which can occur when manipulating ranges in selections can be exploited remotely to cause a denial of service;
  5. Pixel and history stealing vulnerability in the SVG filters can be exploited remotely to obtain sensitive information;
  6. Memory corrpution vulnerability in the JavaScript garbage collection can be exploited remotely to cause a denial of service;
  7. Cross-origin reading vulnerability in the CORS can be exploited remotely to obtain sensitive information;
  8. Usage of uninitialized values for ports in FTP connections can be exploited remotely to cause a denial of service;
  9. Memory corruption vulnerability can be exploited remotely to run arbitrary code.

NB: This vulnerability have no public CVSS rating so rating can be changed by the time.

NB: At this moment Mozilla just reserved CVE numbers for this vulnerabilities. Information can be changed soon.

Пораженные продукты

Mozilla Thunderbird versions earlier than 45.8.0

Решение

Update to latest version
Mozilla Thunderbird

Первичный источник обнаружения
MFSA 2017-07
Оказываемое влияние
?
ACE 
[?]

OSI 
[?]

DoS 
[?]

PE 
[?]

SUI 
[?]

OAF 
[?]
Связанные продукты
Mozilla Thunderbird
CVE-IDS
CVE-2017-54076.5High
CVE-2017-54109.8Critical
CVE-2017-54085.3High
CVE-2017-54055.3High
CVE-2017-53989.8Critical
CVE-2017-54009.8Critical
CVE-2017-54019.8Critical
CVE-2017-54029.8Critical
CVE-2017-54049.8Critical