USN-4045-1: Thunderbird vulnerabilities

Packages

thunderbird - Mozilla Open Source mail and newsgroup client

Details

A type confusion bug was discovered in Thunderbird. If a user were
tricked in to opening a specially crafted website in a browsing context,
an attacker could exploit this by causing a denial of service, or
executing arbirary code. (CVE-2019-11707)

It was discovered that a sandboxed child process could open arbitrary web
content in the parent process via the Prompt:Open IPC message. When
combined with another vulnerability, an attacker could potentially exploit
this to execute arbitrary code. (CVE-2019-11708)

A type confusion bug was discovered in Thunderbird. If a user were
tricked in to opening a specially crafted website in a browsing context,
an attacker could exploit this by causing a denial of service, or
executing arbirary code. (CVE-2019-11707)

It was discovered that a sandboxed child process could open arbitrary web
content in the parent process via the Prompt:Open IPC message. When
combined with another vulnerability, an attacker could potentially exploit
this to execute arbitrary code. (CVE-2019-11708)

Update instructions

After a standard system update you need to restart Thunderbird to make all the necessary changes.

Learn more about how to get the fixes.

Ubuntu Release	Package Version
19.04 disco	thunderbird – 1:60.7.2+build2-0ubuntu0.19.04.1
18.10 cosmic	thunderbird – 1:60.7.2+build2-0ubuntu0.18.10.1
18.04 bionic	thunderbird – 1:60.7.2+build2-0ubuntu0.18.04.1
16.04 xenial	thunderbird – 1:60.7.2+build2-0ubuntu0.16.04.1

Reduce your security exposure

Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.

Get Ubuntu Pro

Packages

Details

Update instructions

Reduce your security exposure

References

Related notices