- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 202003-10 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: High Title: Mozilla Thunderbird: Multiple vulnerabilities Date: March 14, 2020 Bugs: #698516, #702638, #709350, #712518 ID: 202003-10 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======== Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could result in the arbitrary execution of code. Background ========== Mozilla Thunderbird is a popular open-source email client from the Mozilla project. Affected packages ================= ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 mail-client/thunderbird < 68.6.0 >= 68.6.0 2 mail-client/thunderbird-bin < 68.6.0 >= 68.6.0 ------------------------------------------------------------------- 2 affected packages Description =========== Multiple vulnerabilities have been discovered in Mozilla Thunderbird. Please review the CVE identifiers referenced below for details. Impact ====== A remote attacker may be able to execute arbitrary code, cause a Denial of Service condition, obtain sensitive information, or conduct Cross-Site Request Forgery (CSRF). Workaround ========== There is no known workaround at this time. Resolution ========== All Mozilla Thunderbird users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose ">=mail-client/thunderbird-68.6.0" All Mozilla Thunderbird binary users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot -v ">=mail-client/thunderbird-bin-68.6.0" References ========== [ 1 ] MFSA-2019-35 https://www.mozilla.org/en-US/security/advisories/mfsa2019-35/ [ 2 ] MFSA-2019-37 https://www.mozilla.org/en-US/security/advisories/mfsa2019-37/ [ 3 ] MFSA-2020-07 https://www.mozilla.org/en-US/security/advisories/mfsa2020-07/ [ 4 ] MFSA-2020-10 https://www.mozilla.org/en-US/security/advisories/mfsa2020-10/ [ 5 ] CVE-2019-11745 https://nvd.nist.gov/vuln/detail/CVE-2019-11745 [ 6 ] CVE-2019-11757 https://nvd.nist.gov/vuln/detail/CVE-2019-11757 [ 7 ] CVE-2019-11759 https://nvd.nist.gov/vuln/detail/CVE-2019-11759 [ 8 ] CVE-2019-11760 https://nvd.nist.gov/vuln/detail/CVE-2019-11760 [ 9 ] CVE-2019-11761 https://nvd.nist.gov/vuln/detail/CVE-2019-11761 [ 10 ] CVE-2019-11762 https://nvd.nist.gov/vuln/detail/CVE-2019-11762 [ 11 ] CVE-2019-11763 https://nvd.nist.gov/vuln/detail/CVE-2019-11763 [ 12 ] CVE-2019-11764 https://nvd.nist.gov/vuln/detail/CVE-2019-11764 [ 13 ] CVE-2019-17005 https://nvd.nist.gov/vuln/detail/CVE-2019-17005 [ 14 ] CVE-2019-17008 https://nvd.nist.gov/vuln/detail/CVE-2019-17008 [ 15 ] CVE-2019-17010 https://nvd.nist.gov/vuln/detail/CVE-2019-17010 [ 16 ] CVE-2019-17011 https://nvd.nist.gov/vuln/detail/CVE-2019-17011 [ 17 ] CVE-2019-17012 https://nvd.nist.gov/vuln/detail/CVE-2019-17012 [ 18 ] CVE-2019-20503 https://nvd.nist.gov/vuln/detail/CVE-2019-20503 [ 19 ] CVE-2020-6792 https://nvd.nist.gov/vuln/detail/CVE-2020-6792 [ 20 ] CVE-2020-6793 https://nvd.nist.gov/vuln/detail/CVE-2020-6793 [ 21 ] CVE-2020-6794 https://nvd.nist.gov/vuln/detail/CVE-2020-6794 [ 22 ] CVE-2020-6795 https://nvd.nist.gov/vuln/detail/CVE-2020-6795 [ 23 ] CVE-2020-6798 https://nvd.nist.gov/vuln/detail/CVE-2020-6798 [ 24 ] CVE-2020-6800 https://nvd.nist.gov/vuln/detail/CVE-2020-6800 [ 25 ] CVE-2020-6805 https://nvd.nist.gov/vuln/detail/CVE-2020-6805 [ 26 ] CVE-2020-6806 https://nvd.nist.gov/vuln/detail/CVE-2020-6806 [ 27 ] CVE-2020-6807 https://nvd.nist.gov/vuln/detail/CVE-2020-6807 [ 28 ] CVE-2020-6811 https://nvd.nist.gov/vuln/detail/CVE-2020-6811 [ 29 ] CVE-2020-6812 https://nvd.nist.gov/vuln/detail/CVE-2020-6812 [ 30 ] CVE-2020-6814 https://nvd.nist.gov/vuln/detail/CVE-2020-6814 Availability ============ This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/202003-10 Concerns? ========= Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org. License ======= Copyright 2020 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. https://creativecommons.org/licenses/by-sa/2.5