Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 712518 (MFSA-2020-10) - <mail-client/thunderbird{,-bin}-68.6.0: multiple vulnerabilities (MFSA-2020-10)
Summary: <mail-client/thunderbird{,-bin}-68.6.0: multiple vulnerabilities (MFSA-2020-10)
Status: RESOLVED FIXED
Alias: MFSA-2020-10
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal major (vote)
Assignee: Gentoo Security
URL: https://www.mozilla.org/en-US/securit...
Whiteboard: A2 [glsa+ cve]
Keywords:
Depends on:
Blocks:
 
Reported: 2020-03-14 15:44 UTC by GLSAMaker/CVETool Bot
Modified: 2020-03-14 16:04 UTC (History)
1 user (show)

See Also:
Package list:
mail-client/thunderbird-68.6.0
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description GLSAMaker/CVETool Bot gentoo-dev 2020-03-14 15:44:19 UTC
Incoming details.
Comment 1 Thomas Deutschmann (RETIRED) gentoo-dev 2020-03-14 15:48:04 UTC
CVE-2020-6805: Use-after-free when removing data about origins

Impact
    high

Description

When removing data about an origin whose tab was recently closed, a use-after-free could occur in the Quota manager, resulting in a potentially exploitable crash.


CVE-2020-6806: BodyStream::OnInputStreamReady was missing protections against state confusion

Impact
    high

Description

By carefully crafting promise resolutions, it was possible to cause an out-of-bounds read off the end of an array resized during script execution. This could have led to memory corruption and a potentially exploitable crash.


CVE-2020-6807: Use-after-free in cubeb during stream destruction

Impact
    high

Description

When a device was changed while a stream was about to be destroyed, the stream-reinit task may have been executed after the stream was destroyed, causing a use-after-free and a potentially exploitable crash.


CVE-2020-6811: Devtools' 'Copy as cURL' feature did not fully escape website-controlled data, potentially leading to command injection

Impact
    moderate

Description

The 'Copy as cURL' feature of Devtools' network tab did not properly escape the HTTP method of a request, which can be controlled by the website. If a user used the 'Copy as Curl' feature and pasted the command into a terminal, it could have resulted in command injection and arbitrary command execution.


CVE-2019-20503: Out of bounds reads in sctp_load_addresses_from_init

Impact
    moderate

Description

The inputs to sctp_load_addresses_from_init are verified by sctp_arethere_unrecognized_parameters; however, the two functions handled parameter bounds differently, resulting in out of bounds reads when parameters are partially outside a chunk.


CVE-2020-6812: The names of AirPods with personally identifiable information were exposed to websites with camera or microphone permission

Impact
    moderate

Description

The first time AirPods are connected to an iPhone, they become named after the user's name by default (e.g. Jane Doe's AirPods.) Websites with camera or microphone permission are able to enumerate device names, disclosing the user's name. To resolve this issue, Firefox added a special case that renames devices containing the substring 'AirPods' to simply 'AirPods'.


CVE-2020-6814: Memory safety bugs fixed in Thunderbird 68.6

Impact
    high

Description

Mozilla developers Byron Campen, Jason Kratzer, and Christian Holler reported memory safety bugs present in Thunderbird 68.5. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.
Comment 2 Larry the Git Cow gentoo-dev 2020-03-14 16:00:21 UTC
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=727675d5508c3f585969194507cdf7d6f10aff1a

commit 727675d5508c3f585969194507cdf7d6f10aff1a
Author:     Thomas Deutschmann <whissi@gentoo.org>
AuthorDate: 2020-03-14 15:59:57 +0000
Commit:     Thomas Deutschmann <whissi@gentoo.org>
CommitDate: 2020-03-14 15:59:57 +0000

    mail-client/thunderbird-bin: security cleanup
    
    Bug: https://bugs.gentoo.org/712518
    Package-Manager: Portage-2.3.93, Repoman-2.3.20
    Signed-off-by: Thomas Deutschmann <whissi@gentoo.org>

 mail-client/thunderbird-bin/Manifest               |  55 -------
 .../thunderbird-bin/thunderbird-bin-68.5.0.ebuild  | 182 ---------------------
 2 files changed, 237 deletions(-)

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=332f54dbc7afe50397197a21e67a75ca39f5fda4

commit 332f54dbc7afe50397197a21e67a75ca39f5fda4
Author:     Thomas Deutschmann <whissi@gentoo.org>
AuthorDate: 2020-03-14 15:59:18 +0000
Commit:     Thomas Deutschmann <whissi@gentoo.org>
CommitDate: 2020-03-14 15:59:18 +0000

    mail-client/thunderbird: security cleanup
    
    Bug: https://bugs.gentoo.org/712518
    Package-Manager: Portage-2.3.93, Repoman-2.3.20
    Signed-off-by: Thomas Deutschmann <whissi@gentoo.org>

 mail-client/thunderbird/Manifest                  |  54 --
 mail-client/thunderbird/thunderbird-68.5.0.ebuild | 777 ----------------------
 2 files changed, 831 deletions(-)

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=d8307cd87b58fb07c9ac6908aabc770c464c0f06

commit d8307cd87b58fb07c9ac6908aabc770c464c0f06
Author:     Thomas Deutschmann <whissi@gentoo.org>
AuthorDate: 2020-03-14 15:58:18 +0000
Commit:     Thomas Deutschmann <whissi@gentoo.org>
CommitDate: 2020-03-14 15:58:18 +0000

    mail-client/thunderbird: amd64 & x86 stable (bug #712518)
    
    Bug: https://bugs.gentoo.org/712518
    Package-Manager: Portage-2.3.93, Repoman-2.3.20
    Signed-off-by: Thomas Deutschmann <whissi@gentoo.org>

 mail-client/thunderbird/thunderbird-68.6.0.ebuild | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
Comment 3 GLSAMaker/CVETool Bot gentoo-dev 2020-03-14 16:04:24 UTC
This issue was resolved and addressed in
 GLSA 202003-10 at https://security.gentoo.org/glsa/202003-10
by GLSA coordinator Thomas Deutschmann (whissi).