Synopsis

Important: thunderbird security update

Type/Severity

Security Advisory: Important

Topic

An update for thunderbird is now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Mozilla Thunderbird is a standalone mail and newsgroup client.

This update upgrades Thunderbird to version 60.3.0.

Security Fix(es):

• Mozilla: Memory safety bugs fixed in Firefox 63 and Firefox ESR 60.3 (CVE-2018-12390)
  
• Mozilla: Crash with nested event loops (CVE-2018-12392)
  
• Mozilla: Integer overflow during Unicode conversion while loading JavaScript (CVE-2018-12393)
  
• Mozilla: Memory safety bugs fixed in Firefox ESR 60.3 (CVE-2018-12389)
  

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat would like to thank the Mozilla project for reporting these issues. Upstream acknowledges Christian Holler, Bob Owen, Boris Zbarsky, Calixte Denizet, Jason Kratzer, Jed Davis, Taegeon Lee, Philipp, Ronald Crane, Raul Gurzau, Gary Kwong, Tyson Smith, Raymond Forbes, Bogdan Tara, Nils, r, and Daniel Veditz as the original reporters.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

All running instances of Thunderbird must be restarted for the update to take effect.

Affected Products

• Red Hat Enterprise Linux Server 6 x86_64
• Red Hat Enterprise Linux Server 6 i386
• Red Hat Enterprise Linux Workstation 6 x86_64
• Red Hat Enterprise Linux Workstation 6 i386
• Red Hat Enterprise Linux Desktop 6 x86_64
• Red Hat Enterprise Linux Desktop 6 i386
• Red Hat Enterprise Linux for IBM z Systems 6 s390x
• Red Hat Enterprise Linux for Power, big endian 6 ppc64

Fixes

• BZ - 1642179 - CVE-2018-12389 Mozilla: Memory safety bugs fixed in Firefox ESR 60.3
• BZ - 1642180 - CVE-2018-12390 Mozilla: Memory safety bugs fixed in Firefox 63 and Firefox ESR 60.3
• BZ - 1642182 - CVE-2018-12392 Mozilla: Crash with nested event loops
• BZ - 1642183 - CVE-2018-12393 Mozilla: Integer overflow during Unicode conversion while loading JavaScript

CVEs

• CVE-2018-12389
• CVE-2018-12390
• CVE-2018-12392
• CVE-2018-12393

References

• https://access.redhat.com/security/updates/classification/#important

Red Hat Enterprise Linux Server 6

SRPM
thunderbird-60.3.0-1.el6.src.rpm	SHA-256: c4d6a65718be5b311349abc7d75c3dcac1216f256fcf40b564b5d5bac7642b19
x86_64
thunderbird-60.3.0-1.el6.x86_64.rpm	SHA-256: 46c8e103b52a3afd7123d6163c2fc5fd9d138bfb752ef49f402be53ab84bf8db
thunderbird-debuginfo-60.3.0-1.el6.x86_64.rpm	SHA-256: 8f6bd68fcfde2ac7966c5d9aa3d04db0726dd080e848d0cadb7d7b1965bdcd17
i386
thunderbird-60.3.0-1.el6.i686.rpm	SHA-256: 798b36fdcb864b2ceeb83e4c2b58029939e082620f64f43404718fb2f2c22f8b
thunderbird-debuginfo-60.3.0-1.el6.i686.rpm	SHA-256: d0ddfd423f711f1a68853ebc8398716eda1368af9aa2e9555ce448708c1d4faa

Red Hat Enterprise Linux Workstation 6

SRPM
thunderbird-60.3.0-1.el6.src.rpm	SHA-256: c4d6a65718be5b311349abc7d75c3dcac1216f256fcf40b564b5d5bac7642b19
x86_64
thunderbird-60.3.0-1.el6.x86_64.rpm	SHA-256: 46c8e103b52a3afd7123d6163c2fc5fd9d138bfb752ef49f402be53ab84bf8db
thunderbird-debuginfo-60.3.0-1.el6.x86_64.rpm	SHA-256: 8f6bd68fcfde2ac7966c5d9aa3d04db0726dd080e848d0cadb7d7b1965bdcd17
i386
thunderbird-60.3.0-1.el6.i686.rpm	SHA-256: 798b36fdcb864b2ceeb83e4c2b58029939e082620f64f43404718fb2f2c22f8b
thunderbird-debuginfo-60.3.0-1.el6.i686.rpm	SHA-256: d0ddfd423f711f1a68853ebc8398716eda1368af9aa2e9555ce448708c1d4faa

Red Hat Enterprise Linux Desktop 6

SRPM
thunderbird-60.3.0-1.el6.src.rpm	SHA-256: c4d6a65718be5b311349abc7d75c3dcac1216f256fcf40b564b5d5bac7642b19
x86_64
thunderbird-60.3.0-1.el6.x86_64.rpm	SHA-256: 46c8e103b52a3afd7123d6163c2fc5fd9d138bfb752ef49f402be53ab84bf8db
thunderbird-debuginfo-60.3.0-1.el6.x86_64.rpm	SHA-256: 8f6bd68fcfde2ac7966c5d9aa3d04db0726dd080e848d0cadb7d7b1965bdcd17
i386
thunderbird-60.3.0-1.el6.i686.rpm	SHA-256: 798b36fdcb864b2ceeb83e4c2b58029939e082620f64f43404718fb2f2c22f8b
thunderbird-debuginfo-60.3.0-1.el6.i686.rpm	SHA-256: d0ddfd423f711f1a68853ebc8398716eda1368af9aa2e9555ce448708c1d4faa

Red Hat Enterprise Linux for IBM z Systems 6

SRPM
thunderbird-60.3.0-1.el6.src.rpm	SHA-256: c4d6a65718be5b311349abc7d75c3dcac1216f256fcf40b564b5d5bac7642b19
s390x
thunderbird-60.3.0-1.el6.s390x.rpm	SHA-256: ec2da48fa7c33087e30e85823bd951e14b1293cee228547ea49de4d6bb961613
thunderbird-debuginfo-60.3.0-1.el6.s390x.rpm	SHA-256: c14a4b19a03069b349099a54f0ace93d727e3a56903648defdbd8a651f287def

Red Hat Enterprise Linux for Power, big endian 6

SRPM
thunderbird-60.3.0-1.el6.src.rpm	SHA-256: c4d6a65718be5b311349abc7d75c3dcac1216f256fcf40b564b5d5bac7642b19
ppc64
thunderbird-60.3.0-1.el6.ppc64.rpm	SHA-256: 165543a434985fae5aa0ec2d07e28090704112f7fc3a3ceddd295a8fbb1f4edd
thunderbird-debuginfo-60.3.0-1.el6.ppc64.rpm	SHA-256: b6be512b9c333213f905a39dd5a451bc5df46f0b4cb935dc17409b2b0e284edd