vulnerability

Amazon Linux AMI 2: CVE-2018-18494: Security patch for thunderbird (Multiple Advisories)

Try Surface Command

Back to search

Severity

CVSS

(AV:N/AC:M/Au:N/C:P/I:N/A:N)

Published

Feb 28, 2019

Added

Apr 27, 2020

Modified

May 20, 2026

Description

A same-origin policy violation allowing the theft of cross-origin URL entries when using the Javascript location property to cause a redirection to another site using performance.getEntries(). This is a same-origin policy violation and could allow for data theft. This vulnerability affects Thunderbird < 60.4, Firefox ESR < 60.4, and Firefox < 64.

Solutions

amazon-linux-ami-2-upgrade-thunderbirdamazon-linux-ami-2-upgrade-thunderbird-debuginfo

References

AMAZON-AL2/ALAS-2019-1168
CVE-2018-18494
https://attackerkb.com/topics/CVE-2018-18494
CWE-346
EUVD-EUVD-2018-10219
https://euvd.enisa.europa.eu/vulnerability/EUVD-2018-10219

Rapid7 Labs

2026 Global Threat Landscape Report

The predictive window has collapsed. Exploitation follows disclosure in days. See how attackers are accelerating and how to stay ahead.

Get report