Advisories ยป MGASA-2019-0088

Updated thunderbird packages fix security vulnerability

Publication date: 17 Feb 2019
Modification date: 17 Feb 2019
Type: security
Affected Mageia releases : 6
CVE: CVE-2018-18335 , CVE-2018-18356 , CVE-2018-18509 , CVE-2019-5785

Description

A use-after-free vulnerability in the Skia library can occur when creating
a path, leading to a potentially exploitable crash. (CVE-2018-18356)

An integer overflow vulnerability in the Skia library can occur after
specific transform operations, leading to a potentially exploitable crash.
(CVE-2019-5785)

A buffer overflow vulnerability in the Skia library can occur with Canvas
2D acceleration on macOS. This issue was addressed by disabling Canvas 2D
acceleration in Firefox ESR. (CVE-2018-18335)

A flaw during verification of certain S/MIME signatures causes emails to
be shown in Thunderbird as having a valid digital signature, even if the
shown message contents aren't covered by the signature. The flaw allows an
attacker to reuse a valid S/MIME signature to craft an email message with
arbitrary content. (CVE-2018-18509)

References

SRPMS

6/core