USN-3793-1

See a problem?
Please try reporting it to the source first.
Source
https://ubuntu.com/security/notices/USN-3793-1
Import Source
https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-3793-1.json
JSON Data
https://api.test.osv.dev/v1/vulns/USN-3793-1
Upstream
Related
Published
2018-10-15T21:08:12.645203Z
Modified
2025-09-08T16:36:27Z
Summary
thunderbird vulnerabilities
Details

Multiple security issues were discovered in Thunderbird. If a user were tricked in to opening a specially crafted website in a browsing context, an attacker could potentially exploit these to cause a denial of service, or execute arbitrary code. (CVE-2018-12376, CVE-2018-12377, CVE-2018-12378)

It was discovered that if a user saved passwords before Thunderbird 58 and then later set a master password, an unencrypted copy of these passwords would still be accessible. A local user could exploit this to obtain sensitive information. (CVE-2018-12383)

A crash was discovered in TransportSecurityInfo used for SSL, which could be triggered by data stored in the local cache directory. An attacker could potentially exploit this in combination with another vulnerability that allowed them to write data to the cache, to execute arbitrary code. (CVE-2018-12385)

References

Affected packages

Ubuntu:14.04:LTS / thunderbird

Package

Name
thunderbird
Purl
pkg:deb/ubuntu/thunderbird@1:60.2.1+build1-0ubuntu0.14.04.2?arch=source&distro=trusty

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1:60.2.1+build1-0ubuntu0.14.04.2

Affected versions

1:24.*

1:24.0+build1-0ubuntu1
1:24.0+build1-0ubuntu2
1:24.1.1+build1-0ubuntu0.13.10.1
1:24.1.1+build1-0ubuntu1
1:24.2.0+build1-0ubuntu1
1:24.4.0+build1-0ubuntu1
1:24.5.0+build1-0ubuntu0.14.04.1
1:24.6.0+build1-0ubuntu0.14.04.1

1:31.*

1:31.0+build1-0ubuntu0.14.04.1
1:31.1.1+build1-0ubuntu0.14.04.1
1:31.1.2+build1-0ubuntu0.14.04.1
1:31.2.0+build2-0ubuntu0.14.04.1
1:31.3.0+build1-0ubuntu0.14.04.1
1:31.4.0+build1-0ubuntu0.14.04.1
1:31.5.0+build1-0ubuntu0.14.04.1
1:31.6.0+build1-0ubuntu0.14.04.1
1:31.7.0+build1-0ubuntu0.14.04.1
1:31.8.0+build1-0ubuntu0.14.04.1

1:38.*

1:38.2.0+build1-0ubuntu0.14.04.1
1:38.3.0+build1-0ubuntu0.14.04.1
1:38.4.0+build3-0ubuntu0.14.04.1
1:38.5.1+build2-0ubuntu0.14.04.1
1:38.6.0+build1-0ubuntu0.14.04.1
1:38.7.2+build1-0ubuntu0.14.04.1
1:38.8.0+build1-0ubuntu0.14.04.1

1:45.*

1:45.2.0+build1-0ubuntu0.14.04.3
1:45.3.0+build1-0ubuntu0.14.04.4
1:45.4.0+build1-0ubuntu0.14.04.1
1:45.5.1+build1-0ubuntu0.14.04.1
1:45.7.0+build1-0ubuntu0.14.04.1
1:45.8.0+build1-0ubuntu0.14.04.1

1:52.*

1:52.1.1+build1-0ubuntu0.14.04.1
1:52.2.1+build1-0ubuntu0.14.04.1
1:52.3.0+build1-0ubuntu0.14.04.1
1:52.4.0+build1-0ubuntu0.14.04.2
1:52.5.0+build1-0ubuntu0.14.04.1
1:52.6.0+build1-0ubuntu0.14.04.1
1:52.7.0+build1-0ubuntu0.14.04.1
1:52.8.0+build1-0ubuntu0.14.04.1
1:52.9.1+build3-0ubuntu0.14.04.1

Ecosystem specific 

{
    "binaries": [
        {
            "binary_version": "1:60.2.1+build1-0ubuntu0.14.04.2",
            "binary_name": "thunderbird"
        },
        {
            "binary_version": "1:60.2.1+build1-0ubuntu0.14.04.2",
            "binary_name": "thunderbird-dev"
        },
        {
            "binary_version": "1:60.2.1+build1-0ubuntu0.14.04.2",
            "binary_name": "thunderbird-globalmenu"
        },
        {
            "binary_version": "1:60.2.1+build1-0ubuntu0.14.04.2",
            "binary_name": "thunderbird-gnome-support"
        },
        {
            "binary_version": "1:60.2.1+build1-0ubuntu0.14.04.2",
            "binary_name": "thunderbird-mozsymbols"
        },
        {
            "binary_version": "1:60.2.1+build1-0ubuntu0.14.04.2",
            "binary_name": "thunderbird-testsuite"
        },
        {
            "binary_version": "1:60.2.1+build1-0ubuntu0.14.04.2",
            "binary_name": "xul-ext-calendar-timezones"
        },
        {
            "binary_version": "1:60.2.1+build1-0ubuntu0.14.04.2",
            "binary_name": "xul-ext-gdata-provider"
        },
        {
            "binary_version": "1:60.2.1+build1-0ubuntu0.14.04.2",
            "binary_name": "xul-ext-lightning"
        }
    ],
    "availability": "No subscription required"
}

Ubuntu:16.04:LTS / thunderbird

Package

Name
thunderbird
Purl
pkg:deb/ubuntu/thunderbird@1:60.2.1+build1-0ubuntu0.16.04.4?arch=source&distro=xenial

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1:60.2.1+build1-0ubuntu0.16.04.4

Affected versions

1:38.*

1:38.3.0+build1-0ubuntu2
1:38.5.1+build2-0ubuntu1
1:38.6.0+build1-0ubuntu1
1:38.7.2+build1-0ubuntu0.16.04.1
1:38.8.0+build1-0ubuntu0.16.04.1

1:45.*

1:45.2.0+build1-0ubuntu0.16.04.1
1:45.3.0+build1-0ubuntu0.16.04.2
1:45.4.0+build1-0ubuntu0.16.04.1
1:45.5.1+build1-0ubuntu0.16.04.1
1:45.7.0+build1-0ubuntu0.16.04.1
1:45.8.0+build1-0ubuntu0.16.04.1

1:52.*

1:52.1.1+build1-0ubuntu0.16.04.1
1:52.2.1+build1-0ubuntu0.16.04.1
1:52.3.0+build1-0ubuntu0.16.04.1
1:52.4.0+build1-0ubuntu0.16.04.2
1:52.5.0+build1-0ubuntu0.16.04.1
1:52.6.0+build1-0ubuntu0.16.04.1
1:52.7.0+build1-0ubuntu0.16.04.1
1:52.8.0+build1-0ubuntu0.16.04.1
1:52.9.1+build3-0ubuntu0.16.04.1

Ecosystem specific 

{
    "binaries": [
        {
            "binary_version": "1:60.2.1+build1-0ubuntu0.16.04.4",
            "binary_name": "thunderbird"
        },
        {
            "binary_version": "1:60.2.1+build1-0ubuntu0.16.04.4",
            "binary_name": "thunderbird-dev"
        },
        {
            "binary_version": "1:60.2.1+build1-0ubuntu0.16.04.4",
            "binary_name": "thunderbird-globalmenu"
        },
        {
            "binary_version": "1:60.2.1+build1-0ubuntu0.16.04.4",
            "binary_name": "thunderbird-gnome-support"
        },
        {
            "binary_version": "1:60.2.1+build1-0ubuntu0.16.04.4",
            "binary_name": "thunderbird-mozsymbols"
        },
        {
            "binary_version": "1:60.2.1+build1-0ubuntu0.16.04.4",
            "binary_name": "thunderbird-testsuite"
        },
        {
            "binary_version": "1:60.2.1+build1-0ubuntu0.16.04.4",
            "binary_name": "xul-ext-calendar-timezones"
        },
        {
            "binary_version": "1:60.2.1+build1-0ubuntu0.16.04.4",
            "binary_name": "xul-ext-gdata-provider"
        },
        {
            "binary_version": "1:60.2.1+build1-0ubuntu0.16.04.4",
            "binary_name": "xul-ext-lightning"
        }
    ],
    "availability": "No subscription required"
}

Ubuntu:18.04:LTS / thunderbird

Package

Name
thunderbird
Purl
pkg:deb/ubuntu/thunderbird@1:60.2.1+build1-0ubuntu0.18.04.2?arch=source&distro=bionic

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1:60.2.1+build1-0ubuntu0.18.04.2

Affected versions

1:52.*

1:52.4.0+build1-0ubuntu2
1:52.6.0+build1-0ubuntu1
1:52.7.0+build1-0ubuntu1
1:52.8.0+build1-0ubuntu0.18.04.1
1:52.9.1+build3-0ubuntu0.18.04.1

Ecosystem specific 

{
    "binaries": [
        {
            "binary_version": "1:60.2.1+build1-0ubuntu0.18.04.2",
            "binary_name": "thunderbird"
        },
        {
            "binary_version": "1:60.2.1+build1-0ubuntu0.18.04.2",
            "binary_name": "thunderbird-dev"
        },
        {
            "binary_version": "1:60.2.1+build1-0ubuntu0.18.04.2",
            "binary_name": "thunderbird-globalmenu"
        },
        {
            "binary_version": "1:60.2.1+build1-0ubuntu0.18.04.2",
            "binary_name": "thunderbird-gnome-support"
        },
        {
            "binary_version": "1:60.2.1+build1-0ubuntu0.18.04.2",
            "binary_name": "thunderbird-mozsymbols"
        },
        {
            "binary_version": "1:60.2.1+build1-0ubuntu0.18.04.2",
            "binary_name": "thunderbird-testsuite"
        },
        {
            "binary_version": "1:60.2.1+build1-0ubuntu0.18.04.2",
            "binary_name": "xul-ext-calendar-timezones"
        },
        {
            "binary_version": "1:60.2.1+build1-0ubuntu0.18.04.2",
            "binary_name": "xul-ext-gdata-provider"
        },
        {
            "binary_version": "1:60.2.1+build1-0ubuntu0.18.04.2",
            "binary_name": "xul-ext-lightning"
        }
    ],
    "availability": "No subscription required"
}