A thunderbird security update has been released for Arch Linux to address arbitrary code execution and content spoofing vulnerabilities.

Arch Linux Security Advisory ASA-202005-7
=========================================

Severity: Critical
Date : 2020-05-09
CVE-ID : CVE-2020-6831 CVE-2020-12387 CVE-2020-12392 CVE-2020-12395
CVE-2020-12397
Package : thunderbird
Type : multiple issues
Remote : Yes
Link :   https://security.archlinux.org/AVG-1155

Summary
=======

The package thunderbird before version 68.8.0-1 is vulnerable to
multiple issues including arbitrary code execution and content
spoofing.

Resolution
==========

Upgrade to 68.8.0-1.

# pacman -Syu "thunderbird>=68.8.0-1"

The problems have been fixed upstream in version 68.8.0.

Workaround
==========

None.

Description
===========

- CVE-2020-6831 (arbitrary code execution)

A buffer overflow could occur when parsing and validating SCTP chunks
in WebRTC, in Firefox before 76.0, Thunderbird before 68.8.0 and
chromium before 81.0.4044.138. This could have led to memory corruption
and a potentially exploitable crash.

- CVE-2020-12387 (arbitrary code execution)

A race condition has been found in Firefox before 76.0 and Thunderbird
before 68.8.0, when running shutdown code for Web Worker, leading to a
use-after-free vulnerability. This results in a potentially exploitable
crash.

- CVE-2020-12392 (content spoofing)

The 'Copy as cURL' feature of Devtools' network tab did not properly
escape the HTTP POST data of a request in Firefox before 76.0 and
Thunderbird before 68.8.0, which can be controlled by the website. If a
user used the 'Copy as cURL' feature and pasted the command into a
terminal, it could have resulted in the disclosure of local files.

- CVE-2020-12395 (arbitrary code execution)

Several memory safety bugs has been found in Firefox before 76.0,
Firefox ESR before 68.8 and Thunderbird before 68.8.0. Some of these
bugs showed evidence of memory corruption and Mozilla presumes that
with enough effort some of these could have been exploited to run
arbitrary code.

- CVE-2020-12397 (content spoofing)

An spoofing email address issue has been found in Thunderbird before
68.8.0. By encoding Unicode whitespace characters within the From email
header, an attacker can spoof the sender email address that Thunderbird
displays.

Impact
======

A remote attacker can spoof an e-mail address and execute arbitrary
code on the affected host.

References
==========

  https://www.mozilla.org/en-US/security/advisories/mfsa2020-18/
  https://bugzilla.mozilla.org/show_bug.cgi?id=1632241
  https://crbug.com/1073602
  https://www.mozilla.org/en-US/security/advisories/mfsa2020-16/#CVE-2020-6831
  https://www.mozilla.org/en-US/security/advisories/mfsa2020-18/#CVE-2020-6831
  https://www.mozilla.org/en-US/security/advisories/mfsa2020-16/#CVE-2020-12387
  https://www.mozilla.org/en-US/security/advisories/mfsa2020-18/#CVE-2020-12387
  https://bugzilla.mozilla.org/show_bug.cgi?id=1545345
  https://www.mozilla.org/en-US/security/advisories/mfsa2020-16/#CVE-2020-12392
  https://www.mozilla.org/en-US/security/advisories/mfsa2020-18/#CVE-2020-12392
  https://bugzilla.mozilla.org/show_bug.cgi?id=1614468
  https://www.mozilla.org/en-US/security/advisories/mfsa2020-16/#CVE-2020-12395
  https://www.mozilla.org/en-US/security/advisories/mfsa2020-18/#CVE-2020-12395
  https://bugzilla.mozilla.org/buglist.cgi?bug_id=1595886%2C1611482%2C1614704%2C1624098%2C1625749%2C1626382%2C1628076%2C1631508
  https://www.mozilla.org/en-US/security/advisories/mfsa2020-18/#CVE-2020-12397
  https://bugzilla.mozilla.org/show_bug.cgi?id=1617370
  https://security.archlinux.org/CVE-2020-6831
  https://security.archlinux.org/CVE-2020-12387
  https://security.archlinux.org/CVE-2020-12392
  https://security.archlinux.org/CVE-2020-12395
  https://security.archlinux.org/CVE-2020-12397