Linux · Security advisory · October 29, 2019

RHSA-2019:3237: thunderbird security update

RHSA-2019:3237, released October 29, 2019, fixes 9 CVEs in thunderbird (version 0:68.2.0-1.el8_0). None of them is reported as exploited. Patch Radar priority: Urgent.

Urgent
CVEs closed
9
8 rated Critical
Exploited
0
None reported
Exploitation more likely
0
Vendor assessment
Highest EPSS
0.0664
93rd percentile

Priority of the 9 CVEs

Patch now 0 Urgent 8 High 1 Routine 0

Fixed package versions

ProductReleaseFixed in
thunderbirdRHEL 80:68.2.0-1.el8_0

CVEs this fix closes

PriorityCVETitleImpactCVSSEPSSExploitation
Urgent CVE-2019-11759 Firefox ESR: An attacker could have caused 4 bytes of HMAC output to be written past the end of a buffer stored on… 8.8 0.0165 None reported
Urgent CVE-2019-11764 Firefox ESR: Mozilla developers and community members reported memory safety bugs present in Firefox 69 and Firefox… 8.8 0.0147 None reported
Urgent CVE-2019-11760 Firefox ESR: A fixed-size stack buffer could overflow in nrappkit when doing WebRTC signaling. 8.8 0.0137 None reported
Urgent CVE-2019-11757 Firefox ESR: When following the value's prototype chain, it was possible to retain a reference to a locale, delete… 8.8 0.0133 None reported
Urgent CVE-2019-11758 Firefox ESR: Mozilla community member Philipp reported a memory safety bug present in Firefox 68 when 360 Total Security… 8.8 0.0133 None reported
Urgent CVE-2019-11763 Firefox ESR: Failure to correctly handle null bytes when processing HTML entities resulted in Firefox incorrectly… 6.1 0.0115 None reported
Urgent CVE-2019-11761 Firefox ESR: By using a form with a data URI it was possible to gain access to the privileged JSONView object that… 5.4 0.0079 None reported
Urgent CVE-2019-11762 Firefox ESR: If two same-origin documents set document.domain differently to become cross-origin, it was possible… 6.1 0.0061 None reported
High CVE-2019-15903 Python 3.6 and 2 others: Out-of-bounds Read 7.5 0.0664 None reported
Showing 1 to 9 of 9 1