MGASA-2020-0142

See a problem?
Please try reporting it to the source first.

Source

https://advisories.mageia.org/MGASA-2020-0142.html

Import Source

https://advisories.mageia.org/MGASA-2020-0142.json

JSON Data

https://api.test.osv.dev/v1/vulns/MGASA-2020-0142

Related

Published

2020-03-14T08:35:35Z

Modified

2020-03-14T08:11:05Z

Summary

Updated thunderbird packages fix security vulnerabilities

Details

The updated packages fix a security vulnerabilities:

Out of bounds reads in sctploadaddressesfrominit. (CVE-2019-20503)

Use-after-free when removing data about origins. (CVE-2020-6805)

BodyStream::OnInputStreamReady was missing protections against state confusion. (CVE-2020-6806)

Use-after-free in cubeb during stream destruction. (CVE-2020-6807)

Devtools' 'Copy as cURL' feature did not fully escape website-controlled data, potentially leading to command injection. (CVE-2020-6811)

The names of AirPods with personally identifiable information were exposed to websites with camera or microphone permission. (CVE-2020-6812)

Memory safety bugs fixed in Thunderbird 68.6. (CVE-2020-6814)

References

Credits

Affected packages

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

68.6.0-1.mga7

{
    "section": "core"
}

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

68.6.0-1.mga7

{
    "section": "core"
}