SB2020070815 - Ubuntu update for thunderbird
Published: July 8, 2020 Updated: April 23, 2025
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 10 secuirty vulnerabilities.
1) Use-after-free (CVE-ID: CVE-2020-12405)
The vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to a use-after-free error when in SharedWorkerService due to a race condition. A remote attacker can create a specially crafted web page, trick the victim into opening it, trigger a use-after-free error and execute arbitrary code on the target system.
Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.
2) Type Confusion (CVE-ID: CVE-2020-12406)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a type confusion error during unboxed JavaScript objects removal. A remote attacker can create a specially crafted web page, trick the victim into opening it, trigger a type confusion error and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
3) Buffer overflow (CVE-ID: CVE-2020-12410)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error when processing HTML content. A remote attacker can create a specially crafted web page, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
4) Input validation error (CVE-ID: CVE-2020-12417)
The vulnerability allows a remote attacker to perform cache poisoning attack.
The vulnerability exists due to an error when processing the %2F character in a manifest URL, which results in Firefox's AppCache behavior to become confused and allowe a manifest to be served from a subdirectory. This could cause the appcache to be used to service requests for the top level directory.
5) Out-of-bounds read (CVE-ID: CVE-2020-12418)
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to a boundary condition while processing individual parts of a URL object. A remote attacker can create a specially crafted web page, trick the victim into opening it, trigger out-of-bounds read error and read contents of memory on the system.
6) Use-after-free (CVE-ID: CVE-2020-12419)
The vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to a use-after-free error when processing callbacks that occurred during window flushing in the parent process in nsGlobalWindowInner. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger a use-after-free error and execute arbitrary code on the target system.
Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.
7) Use-after-free (CVE-ID: CVE-2020-12420)
The vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to a use-after-free error when trying to connect to a STUN server. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger a race condition that causes the use-after-free of a pointer and execute arbitrary code on the system.
Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.
8) Cleartext transmission of sensitive information (CVE-ID: CVE-2020-12398)
The vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists in STARTTLS implementation for an IMAP, when the server sends a PREAUTH response. In this case Thunderbird will continue with an unencrypted connection, causing email data to be sent without protection.
9) Race condition (CVE-ID: CVE-2020-12399)
The vulnerability allows a local user to gain access to sensitive information.
The vulnerability exists due to time differences in Mozilla NSS library during the process of generating a DSA signature, the nonce value 'k' is not padded, exposing the bit length. Combined with other techniques, this can result in the recovery of the DSA private key.
10) Improper Certificate Validation (CVE-ID: CVE-2020-12421)
The vulnerability allows a remote attacker to disable installed Add-Ons.
The vulnerability exists due to Add-On updates do not respect the same certificate trust rules as software updates. When performing add-on updates, certificate chains terminating in non-built-in-roots were rejected (even if they were legitimately added by an administrator.) This could have caused add-ons to become out-of-date silently without notification to the user.
Remediation
Install update from vendor's website.