CVE-2019-11703

A flaw in Thunderbird's implementation of iCal causes a heap buffer overflow in parser_get_next_char when processing certain email messages, resulting in a potentially exploitable crash. This vulnerability affects Thunderbird < 60.7.1.

The updated thunderbird packages fix some bugs and security vulnerabilities:

Heap buffer overflow in icalparser.c. (CVE-2019-11703)

Heap buffer overflow in icalvalue.c. (CVE-2019-11704)

Stack buffer overflow in icalrecur.c. (CVE-2019-11705)

Type confusion in icalproperty.c. (CVE-2019-11706)

This update for MozillaThunderbird fixes the following security issues:

• CVE-2019-11703: Fixed a heap-based buffer overflow in icalmemorystrdupanddequote() (bsc#1137595).
• CVE-2019-11704: Fixed a heap-based buffer overflow in parser_get_next_char() (bsc#1137595).
• CVE-2019-11705: Fixed a stack-based buffer overflow in icalrecur_add_bydayrules() (bsc#1137595).
• CVE-2019-11706: Fixed a type confusion in icaltimezone_get_vtimezone_properties() (bsc#1137595).

This update was imported from the SUSE:SLE-15:Update update project.

This update for MozillaThunderbird fixes the following issues:

Security issues fixed:

• CVE-2019-11703: Fixed a heap-based buffer overflow in icalmemorystrdupanddequote() (bsc#1137595).
• CVE-2019-11704: Fixed a heap-based buffer overflow in parser_get_next_char() (bsc#1137595).
• CVE-2019-11705: Fixed a stack-based buffer overflow in icalrecur_add_bydayrules() (bsc#1137595).
• CVE-2019-11706: Fixed a type confusion in icaltimezone_get_vtimezone_properties() (bsc#1137595).
• CVE-2019-11707: Fixed a type confusion in Array.pop (bsc#1138872).
• CVE-2019-11708: Fixed a sandbox escape using Prompt:Open (bsc#1138872).

This update was imported from the SUSE:SLE-15:Update update project.

This update for MozillaThunderbird fixes the following issues:

Mozilla Thunderbird was updated to 60.7.2 / MFSA 2019-20 (boo#1138872):

• CVE-2019-11707: Type confusion in Array.pop
• CVE-2019-11708: sandbox escape using Prompt:Open

Mozilla Thunderbird was updated to 60.7.1 / MFSA 2019-17 (boo#1137595):

• CVE-2019-11703: Heap buffer overflow in icalparser.c
• CVE-2019-11704: Heap buffer overflow in icalvalue.c
• CVE-2019-11705: Stack buffer overflow in icalrecur.c
• CVE-2019-11706: Type confusion in icalproperty.c

Also fixed: No prompt for smartcard PIN when S/MIME signing is used

Mozilla Thunderbird was updated to 60.7.0 / MFSA 2019-15 (boo#1135824):

• Attachment pane of Write window no longer focussed when attaching files using a keyboard shortcut

• CVE-2019-9815: Disable hyperthreading on content JavaScript threads on macOS

• CVE-2019-9816: Type confusion with object groups and UnboxedObjects

• CVE-2019-9817: Stealing of cross-domain images using canvas

• CVE-2019-9818 (Windows only): Use-after-free in crash generation server

• CVE-2019-9819: Compartment mismatch with fetch API

• CVE-2019-9820: Use-after-free of ChromeEventHandler by DocShell

• CVE-2019-11691: Use-after-free in XMLHttpRequest

• CVE-2019-11692: Use-after-free removing listeners in the event listener manager

• CVE-2019-11693: Buffer overflow in WebGL bufferdata on Linux

• CVE-2019-7317: Use-after-free in png_image_free of libpng library

• CVE-2019-9797: Cross-origin theft of images with createImageBitmap

• CVE-2018-18511: Cross-origin theft of images with ImageBitmapRenderingContext

• CVE-2019-11694: Uninitialized memory memory leakage in Windows sandbox

• CVE-2019-11698: Theft of user history data through drag and drop of hyperlinks to and from bookmarks

• CVE-2019-5798: Out-of-bounds read in Skia

• CVE-2019-9800: Memory safety bugs fixed in Firefox 67 and Firefox ESR 60.7

• Disable building with LTO (boo#1133267).

These are all security issues fixed in the MozillaThunderbird-91.1.1-1.1 package on the GA media of openSUSE Tumbleweed.

This update for MozillaThunderbird fixes the following security issues:

• CVE-2019-11703: Fixed a heap-based buffer overflow in icalmemorystrdupanddequote() (bsc#1137595).
• CVE-2019-11704: Fixed a heap-based buffer overflow in parser_get_next_char() (bsc#1137595).
• CVE-2019-11705: Fixed a stack-based buffer overflow in icalrecur_add_bydayrules() (bsc#1137595).
• CVE-2019-11706: Fixed a type confusion in icaltimezone_get_vtimezone_properties() (bsc#1137595).

This update for MozillaThunderbird fixes the following issues:

Security issues fixed:

• CVE-2019-11703: Fixed a heap-based buffer overflow in icalmemorystrdupanddequote() (bsc#1137595).
• CVE-2019-11704: Fixed a heap-based buffer overflow in parser_get_next_char() (bsc#1137595).
• CVE-2019-11705: Fixed a stack-based buffer overflow in icalrecur_add_bydayrules() (bsc#1137595).
• CVE-2019-11706: Fixed a type confusion in icaltimezone_get_vtimezone_properties() (bsc#1137595).
• CVE-2019-11707: Fixed a type confusion in Array.pop (bsc#1138872).
• CVE-2019-11708: Fixed a sandbox escape using Prompt:Open (bsc#1138872).

Multiple memory safety issues were discovered in Thunderbird. If a user were tricked in to opening a specially crafted message, an attacker could potentially exploit these to cause a denial of service, or execute arbitrary code.