Executive Summary

Title Thunderbird regression
Name USN-4202-2 First vendor Publication 2019-12-10
Vendor Ubuntu Last vendor Modification 2019-12-10
Severity (Vendor) N/A Revision N/A

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:N/C:N/I:N/A:P)
Cvss Base Score 5 Attack Range Network
Cvss Impact Score 2.9 Attack Complexity Low
Cvss Expoit Score 10 Authentication None Required
Calculate full CVSS 2.0 Vectors scores


A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 19.10 - Ubuntu 18.04 LTS


USN-4202-1 caused a regression in Thunderbird.

Software Description: - thunderbird: Mozilla Open Source mail and newsgroup client


USN-4202-1 fixed vulnerabilities in Thunderbird. After upgrading, Thunderbird created a new profile for some users. This update fixes the problem.

We apologize for the inconvenience.

Original advisory details:

It was discovered that a specially crafted S/MIME message with an inner
encryption layer could be displayed as having a valid signature in some
circumstances, even if the signer had no access to the encrypted message.
An attacker could potentially exploit this to spoof the message author.
Multiple security issues were discovered in Thunderbird. If a user were
tricked in to opening a specially crafted website in a browsing context,
an attacker could potentially exploit these to cause a denial of service,
bypass security restrictions, bypass same-origin restrictions, conduct
cross-site scripting (XSS) attacks, or execute arbitrary code.
(CVE-2019-11757, CVE-2019-11758, CVE-2019-11759, CVE-2019-11760,
CVE-2019-11761, CVE-2019-11762, CVE-2019-11763, CVE-2019-11764)
A heap overflow was discovered in the expat library in Thunderbird. If a
user were tricked in to opening a specially crafted message, an attacker
could potentially exploit this to cause a denial of service, or execute
arbitrary code. (CVE-2019-15903)

Update instructions:

The problem can be corrected by updating your system to the following package versions:

Ubuntu 19.10:
thunderbird 1:68.2.2+build1-0ubuntu0.19.10.1

Ubuntu 18.04 LTS:
thunderbird 1:68.2.2+build1-0ubuntu0.18.04.1

After a standard system update you need to restart Thunderbird to make all the necessary changes.


Package Information:



Original Source

Url : http://www.ubuntu.com/usn/USN-4202-2

CWE : Common Weakness Enumeration

% Id Name
33 % CWE-776 Unrestricted Recursive Entity References in DTDs ('XML Bomb')
33 % CWE-347 Improper Verification of Cryptographic Signature
33 % CWE-125 Out-of-bounds Read

CPE : Common Platform Enumeration

Application 12
Application 417

Snort® IPS/IDS

Date Description
2019-12-17 libexpat internal entity heap over-read attempt
RuleID : 52254 - Revision : 1 - Type : FILE-OTHER
2019-12-17 libexpat internal entity heap over-read attempt
RuleID : 52253 - Revision : 1 - Type : FILE-OTHER

Alert History

If you want to see full details history, please login or register.
Date Informations
2019-12-11 00:20:08
  • First insertion