Mozilla Foundation Security Advisory 2020-26
Security Vulnerabilities fixed in Thunderbird 68.10.0
- Announced
- June 30, 2020
- Impact
- high
- Products
- Thunderbird
- Fixed in
-
- Thunderbird 68.10
In general, these flaws cannot be exploited through email in the Thunderbird product because scripting is disabled when reading mail, but are potentially risks in browser or browser-like contexts.
#CVE-2020-12417: Memory corruption due to missing sign-extension for ValueTags on ARM64
- Reporter
- Deian Stefan
- Impact
- high
Description
Due to confusion about ValueTags on JavaScript Objects, an object may pass through the type barrier, resulting in memory corruption and a potentially exploitable crash.
Note: this issue only affects Firefox on ARM64 platforms.
References
#CVE-2020-12418: Information disclosure due to manipulated URL object
- Reporter
- Marcin 'Icewall' Noga of Cisco Talos
- Impact
- high
Description
Manipulating individual parts of a URL object could have caused an out-of-bounds read, leaking process memory to malicious JavaScript.
References
#CVE-2020-12419: Use-after-free in nsGlobalWindowInner
- Reporter
- worcester12345
- Impact
- high
Description
When processing callbacks that occurred during window flushing in the parent process, the associated window may die; causing a use-after-free condition. This could have led to memory corruption and a potentially exploitable crash.
References
#CVE-2020-12420: Use-After-Free when trying to connect to a STUN server
- Reporter
- Byron Campen
- Impact
- high
Description
When trying to connect to a STUN server, a race condition could have caused a use-after-free of a pointer, leading to memory corruption and a potentially exploitable crash.
References
#CVE-2020-15646: Automatic account setup leaks Microsoft Exchange login credentials
- Reporter
- Magnus Melin
- Impact
- high
Description
If an attacker intercepts Thunderbird's initial attempt to perform automatic account setup using the Microsoft Exchange autodiscovery mechanism, and the attacker sends a crafted response, then Thunderbird sends username and password over https to a server controlled by the attacker.
References
#CVE-2020-12421: Add-On updates did not respect the same certificate trust rules as software updates
- Reporter
- Chuck Harmston, Robert Hardy
- Impact
- moderate
Description
When performing add-on updates, certificate chains terminating in non-built-in-roots were rejected (even if they were legitimately added by an administrator.) This could have caused add-ons to become out-of-date silently without notification to the user.