====================================================================

                             CERT-Renater

                 Note d'Information No. 2020/VULN007
_____________________________________________________________________

DATE                : 14/01/2020

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running Mozilla Thunderbird versions prior
                                       to 68.4.1.

=====================================================================
https://www.mozilla.org/en-US/security/advisories/mfsa2020-04/
_____________________________________________________________________

Mozilla Foundation Security Advisory 2020-04

Security Vulnerabilities fixed in Thunderbird 68.4.1

Announced    January 10, 2020
Impact       critical
Products     Thunderbird
Fixed in
        Thunderbird 68.4.1

In general, these flaws cannot be exploited through email in the
Thunderbird product because scripting is disabled when reading mail,
but are potentially risks in browser or browser-like contexts.
#CVE-2019-17026: IonMonkey type confusion with StoreElementHole and
FallibleStoreElement

Reporter    Qihoo 360 ATA
Impact      critical

Description

Incorrect alias information in IonMonkey JIT compiler for setting array
elements could lead to a type confusion. We are aware of targeted
attacks in the wild abusing this flaw.


References

    Bug 1607443


#CVE-2019-17015: Memory corruption in parent process during new content
process initialization on Windows

Reporter    Thomas Imbert
Impact      high

Description

During the initialization of a new content process, a pointer offset can
be manipulated leading to memory corruption and a potentially
exploitable crash in the parent process.

Note: this issue only occurs on Windows. Other operating systems are
unaffected.

References

    Bug 1599005


#CVE-2019-17016: Bypass of @namespace CSS sanitization during pasting

Reporter    Michał Bentkowski
Impact      high

Description

When pasting a <style> tag from the clipboard into a rich text editor,
the CSS sanitizer incorrectly rewrites a @namespace rule. This could
allow for injection into certain types of websites resulting in data
exfiltration.

References

    Bug 1599181


#CVE-2019-17017: Type Confusion in XPCVariant.cpp

Reporter    bo13oy
Impact      high

Description

Due to a missing case handling object types, a type confusion
vulnerability could occur, resulting in a crash. We presume that with
enough effort that it could be exploited to run arbitrary code.

References

    Bug 1603055


#CVE-2019-17021: Heap address disclosure in parent process during
content process initialization on Windows

Reporter    Thomas Imbert
Impact      moderate

Description

During the initialization of a new content process, a race condition
occurs that can allow a content process to disclose heap addresses
from the parent process.
Note: this issue only occurs on Windows. Other operating systems are
unaffected.

References

    Bug 1599008


#CVE-2019-17022: CSS sanitization does not escape HTML tags

Reporter    Michał Bentkowski
Impact      moderate

Description

When pasting a <style> tag from the clipboard into a rich text editor,
the CSS sanitizer does not escape < and > characters. Because the
resulting string is pasted directly into the text node of the element
this does not result in a direct injection into the webpage; however, if
a webpage subsequently copies the node's innerHTML, assigning it to
another innerHTML, this would result in an XSS vulnerability. Two
WYSIWYG editors were identified with this behavior, more may exist.

References

    Bug 1602843


#CVE-2019-17024: Memory safety bugs fixed in Thunderbird 68.4.1

Reporter    Mozilla developers
Impact      high

Description

Mozilla developers Jason Kratzer, Christian Holler, and Bob Clary
reported memory safety bugs present in Thunderbird 68.3. Some of these
bugs showed evidence of memory corruption and we presume that with
enough effort some of these could have been exploited to run arbitrary
code.

References

    Memory safety bugs fixed in Thunderbird 68.4.1



=========================================================
+ CERT-RENATER        | tel : 01-53-94-20-44            +
+ 23/25 Rue Daviel    | fax : 01-53-94-20-41            +
+ 75013 Paris         | email:cert@support.renater.fr   +
=========================================================