7.5 - RHSA-2019:1144

Problem Description:

An update for thunderbird is now available for Red Hat Enterprise Linux 8.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat Enterprise Linux AppStream (v. 8) - ppc64le, x86_64

3. Description:

Mozilla Thunderbird is a standalone mail and newsgroup client.

This update upgrades Thunderbird to version 60.6.1. (BZ#1692449)

Security Fix(es):

* Mozilla: Memory safety bugs fixed in Firefox 66 and Firefox ESR 60.6 (CVE-2019-9788)

* Mozilla: Use-after-free when removing in-use DOM elements (CVE-2019-9790)

* Mozilla: Type inference is incorrect for constructors entered through on-stack replacement with IonMonkey (CVE-2019-9791)

* Mozilla: IonMonkey leaks JS_OPTIMIZED_OUT magic value to script (CVE-2019-9792)

* Mozilla: IonMonkey MArraySlice has incorrect alias information (CVE-2019-9810)

* Mozilla: Ionmonkey type confusion with __proto__ mutations (CVE-2019-9813)

* Mozilla: Improper bounds checks when Spectre mitigations are disabled (CVE-2019-9793)

* Mozilla: Type-confusion in IonMonkey JIT compiler (CVE-2019-9795)

* Mozilla: Use-after-free with SMIL animation controller (CVE-2019-9796)

* Mozilla: Proxy Auto-Configuration file can define localhost access to be proxied (CVE-2018-18506)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

4. Solution:

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

All running instances of Thunderbird must be restarted for the update to take effect.

5. Bugs fixed (https://bugzilla.redhat.com/):

1690673 - CVE-2018-18506 Mozilla: Proxy Auto-Configuration file can define localhost access to be proxied 1690674 - CVE-2019-9788 Mozilla: Memory safety bugs fixed in Firefox 66 and Firefox ESR 60.6 1690675 - CVE-2019-9790 Mozilla: Use-after-free when removing in-use DOM elements 1690676 - CVE-2019-9791 Mozilla: Type inference is incorrect for constructors entered through on-stack replacement with IonMonkey 1690677 - CVE-2019-9792 Mozilla: IonMonkey leaks JS_OPTIMIZED_OUT magic value to script 1690678 - CVE-2019-9793 Mozilla: Improper bounds checks when Spectre mitigations are disabled 1690680 - CVE-2019-9795 Mozilla: Type-confusion in IonMonkey JIT compiler 1690681 - CVE-2019-9796 Mozilla: Use-after-free with SMIL animation controller 1692181 - CVE-2019-9810 Mozilla: IonMonkey MArraySlice has incorrect alias information 1692182 - CVE-2019-9813 Mozilla: Ionmonkey type confusion with __proto__ mutations 1692449 - update tb to ESR 60.6