thunderbird-52.7.0-1.AXS4
エラータID: AXSA:2018-2734:03
Mozilla Thunderbird is a standalone mail and newsgroup client.
This update upgrades Thunderbird to version 52.7.0.
Security Fix(es):
* Mozilla: Memory safety bugs fixed in Firefox 59 and Firefox ESR 52.7 (MFSA 2018-07) (CVE-2018-5125)
* Mozilla: Memory safety bugs fixed in Firefox ESR 52.7 (MFSA 2018-07) (CVE-2018-5145)
* Mozilla: Vorbis audio processing out of bounds write (MFSA 2018-08) (CVE-2018-5146)
* Mozilla: Buffer overflow manipulating SVG animatedPathSegList (MFSA 2018-07) (CVE-2018-5127)
* Mozilla: Out-of-bounds write with malformed IPC messages (MFSA 2018-07) (CVE-2018-5129)
* Mozilla: Integer overflow during Unicode conversion (MFSA 2018-07) (CVE-2018-5144)
For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.
Asianux would like to thank the Mozilla project for reporting these issues. Upstream acknowledges Bob Clary, Olli Pettay, Christian Holler, Nils Ohlmeier, Randell Jesup, Tyson Smith, Ralph Giles, Philipp, Jet Villegas, Richard Zhu via Trend Micro's Zero Day Initiative, Nils, James Grant, and Root Object as the original reporters.
CVE-2018-5125
** RESERVED **
This candidate has been reserved by an organization or individual that
will use it when announcing a new security problem. When the
candidate has been publicized, the details for this candidate will be provided.
CVE-2018-5127
** RESERVED **
This candidate has been reserved by an organization or individual that
will use it when announcing a new security problem. When the
candidate has been publicized, the details for this candidate will be provided.
CVE-2018-5129
** RESERVED **
This candidate has been reserved by an organization or individual that
will use it when announcing a new security problem. When the
candidate has been publicized, the details for this candidate will be provided.
CVE-2018-5144
** RESERVED **
This candidate has been reserved by an organization or individual that
will use it when announcing a new security problem. When the
candidate has been publicized, the details for this candidate will be provided.
CVE-2018-5145
** RESERVED **
This candidate has been reserved by an organization or individual that
will use it when announcing a new security problem. When the
candidate has been publicized, the details for this candidate will be provided.
CVE-2018-5146
** RESERVED **
This candidate has been reserved by an organization or individual that
will use it when announcing a new security problem. When the
candidate has been publicized, the details for this candidate will be provided.
Update packages.
Memory safety bugs were reported in Firefox 58 and Firefox ESR 52.6. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Thunderbird < 52.7, Firefox ESR < 52.7, and Firefox < 59.
A buffer overflow can occur when manipulating the SVG "animatedPathSegList" through script. This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 52.7, Firefox ESR < 52.7, and Firefox < 59.
A lack of parameter validation on IPC messages results in a potential out-of-bounds write through malformed IPC messages. This can potentially allow for sandbox escape through memory corruption in the parent process. This vulnerability affects Thunderbird < 52.7, Firefox ESR < 52.7, and Firefox < 59.
An integer overflow can occur during conversion of text to some Unicode character sets due to an unchecked length parameter. This vulnerability affects Firefox ESR < 52.7 and Thunderbird < 52.7.
Memory safety bugs were reported in Firefox ESR 52.6. These bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox ESR < 52.7 and Thunderbird < 52.7.
An out of bounds memory write while processing Vorbis audio data was reported through the Pwn2Own contest. This vulnerability affects Firefox < 59.0.1, Firefox ESR < 52.7.2, and Thunderbird < 52.7.
N/A
SRPMS
- thunderbird-52.7.0-1.AXS4.src.rpm
MD5: 3a99798f248e008fbb5de13dfbe0933a
SHA-256: 8125b9d6633782315a8ac2e1bb9893314ef46915e5b6ada82ad6061bdaf581c7
Size: 400.49 MB
Asianux Server 4 for x86
- thunderbird-52.7.0-1.AXS4.i686.rpm
MD5: a15c8d83ea435c7266d3baf66976e216
SHA-256: ea52a2c1aba7cf46e503cc74002a42de0118e26c8bb7b5f651c44b61dcfb005a
Size: 72.89 MB
Asianux Server 4 for x86_64
- thunderbird-52.7.0-1.AXS4.x86_64.rpm
MD5: 5159d76be1ba2a1f9896f0c397663774
SHA-256: 9683ce3452f44c9c76f8be7cc9d7384c07a08080d77431b2a42baba0a9cc8ac9
Size: 72.33 MB
日本語