A potential vulnerability leading to an integer overflow can occur during buffer size calculations for images when a raw value is used instead of the checked value. This leads to a possible out-of-bounds write. This vulnerability affects Thunderbird < 60.4, Firefox ESR < 60.4, and Firefox < 64.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | alpine-linux-upgrade-firefox-esr | Apr 16, 2019 | Feb 28, 2019 |
| Amazon Linux Ami 2 | amazon-linux-ami-2-upgrade-thunderbirdamazon-linux-ami-2-upgrade-thunderbird-debuginfo | Apr 27, 2020 | Feb 28, 2019 | |
| Centos_linux | — | centos-upgrade-firefoxcentos-upgrade-firefox-debuginfocentos-upgrade-thunderbirdcentos-upgrade-thunderbird-debuginfo | Dec 25, 2018 | Dec 11, 2018 |
| Debian | debian-upgrade-firefox-esrdebian-upgrade-thunderbird | Dec 13, 2018 | Dec 11, 2018 | |
| Freebsd | freebsd-upgrade-package-firefoxfreebsd-upgrade-package-waterfoxfreebsd-upgrade-package-seamonkeyfreebsd-upgrade-package-linux-seamonkeyfreebsd-upgrade-package-firefox-esrfreebsd-upgrade-package-linux-firefoxfreebsd-upgrade-package-libxulfreebsd-upgrade-package-thunderbirdfreebsd-upgrade-package-linux-thunderbird | Dec 12, 2018 | Dec 11, 2018 | |
| Gentoo Linux | gentoo-linux-upgrade-www-client-firefoxgentoo-linux-upgrade-www-client-firefox-bin | Mar 11, 2019 | Feb 28, 2019 | |
| Huawei Euleros 2_0_sp2 | huawei-euleros-2_0_sp2-upgrade-firefox | May 1, 2019 | Feb 28, 2019 | |
| Huawei Euleros 2_0_sp3 | huawei-euleros-2_0_sp3-upgrade-firefox | May 30, 2019 | Feb 28, 2019 | |
| Mfsa2018 29 | mozilla-firefox-upgrade-64_0 | Dec 12, 2018 | Dec 11, 2018 | |
| Mfsa2018 30 | mozilla-firefox-esr-upgrade-60_4 | Dec 12, 2018 | Dec 11, 2018 | |
| Mozilla Thunderbird | mozilla-thunderbird-upgrade-60_4 | Jan 18, 2019 | Dec 21, 2018 | |
| Oracle Solaris | oracle-solaris-11-4-upgrade-mail-thunderbird-60-6-1-11-4-9-0-1-2-0oracle-solaris-11-4-upgrade-mail-thunderbird-plugin-thunderbird-lightning-60-6-1-11-4-9-0-1-2-0oracle-solaris-11-4-upgrade-web-browser-firefox-60-5-0-11-4-6-0-1-4-0oracle-solaris-11-4-upgrade-web-data-firefox-bookmarks-60-5-0-11-4-6-0-1-4-0 | Feb 20, 2019 | Feb 20, 2019 | |
| Oracle_linux | — | oracle-linux-upgrade-firefoxoracle-linux-upgrade-thunderbird | Dec 18, 2018 | Dec 11, 2018 |
| Redhat_linux | — | redhat-upgrade-firefoxredhat-upgrade-firefox-debuginforedhat-upgrade-thunderbirdredhat-upgrade-thunderbird-debuginfo | Dec 18, 2018 | Dec 17, 2018 |
| Suse | — | suse-upgrade-libfreebl3suse-upgrade-libfreebl3-32bitsuse-upgrade-libsoftokn3suse-upgrade-libsoftokn3-32bitsuse-upgrade-mozilla-nsprsuse-upgrade-mozilla-nspr-32bitsuse-upgrade-mozilla-nspr-develsuse-upgrade-mozilla-nsssuse-upgrade-mozilla-nss-32bitsuse-upgrade-mozilla-nss-certssuse-upgrade-mozilla-nss-certs-32bitsuse-upgrade-mozilla-nss-develsuse-upgrade-mozilla-nss-sysinitsuse-upgrade-mozilla-nss-sysinit-32bitsuse-upgrade-mozilla-nss-toolssuse-upgrade-mozillafirefoxsuse-upgrade-mozillafirefox-branding-upstreamsuse-upgrade-mozillafirefox-buildsymbolssuse-upgrade-mozillafirefox-develsuse-upgrade-mozillafirefox-translations-commonsuse-upgrade-mozillafirefox-translations-othersuse-upgrade-mozillathunderbirdsuse-upgrade-mozillathunderbird-buildsymbolssuse-upgrade-mozillathunderbird-translations-commonsuse-upgrade-mozillathunderbird-translations-other | Dec 14, 2018 | Dec 11, 2018 |
| Ubuntu | ubuntu-upgrade-firefoxubuntu-upgrade-thunderbird | Jan 10, 2019 | Dec 11, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub