Mozilla Foundation Security Advisory 2020-35
Security Vulnerabilities fixed in Thunderbird 68.11
- Announced
- July 30, 2020
- Impact
- high
- Products
- Thunderbird
- Fixed in
-
- Thunderbird 68.11
In general, these flaws cannot be exploited through email in the Thunderbird product because scripting is disabled when reading mail, but are potentially risks in browser or browser-like contexts.
#CVE-2020-15652: Potential leak of redirect targets when loading scripts in a worker
- Reporter
- Mikhail Oblozhikhin
- Impact
- high
Description
By observing the stack trace for JavaScript errors in web workers, it was possible to leak the result of a cross-origin redirect. This applied only to content that can be parsed as script.
References
#CVE-2020-6514: WebRTC data channel leaks internal address to peer
- Reporter
- Natalie Silvanovich of Google Project Zero
- Impact
- high
Description
WebRTC used the memory address of a class instance as a connection identifier. Unfortunately, this value is often transmitted to the peer, which allows bypassing ASLR.
References
#CVE-2020-6463: Use-after-free in ANGLE gl::Texture::onUnbindAsSamplerTexture
- Reporter
- Reported by Pawel Wylecial of REDTEAM.PL
- Impact
- moderate
Description
Crafted media files could lead to a race in texture caches, resulting in a use-after-free, memory corruption, and a potentially exploitable crash.
References
#CVE-2020-15659: Memory safety bugs fixed in Thunderbird 68.11
- Reporter
- Mozilla developers
- Impact
- high
Description
Mozilla developers Jason Kratzer and Luke Wagner reported memory safety bugs present in Thunderbird 68.10. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.