A thunderbird security update has been released for Arch Linux to address multiple issues.

ASA-202006-4: thunderbird: multiple issues

Arch Linux Security Advisory ASA-202006-4
========================================
Severity: High
Date : 2020-06-06
CVE-ID : CVE-2020-12398 CVE-2020-12399 CVE-2020-12405 CVE-2020-12406
CVE-2020-12410
Package : thunderbird
Type : multiple issues
Remote : Yes
Link :   https://security.archlinux.org/AVG-1179

Summary
======
The package thunderbird before version 68.9.0-1 is vulnerable to
multiple issues including arbitrary code execution, denial of service,
man-in-the-middle and private key recovery.

Resolution
=========
Upgrade to 68.9.0-1.

# pacman -Syu "thunderbird>h.9.0-1"

The problems have been fixed upstream in version 68.9.0.

Workaround
=========
None.

Description
==========
- CVE-2020-12398 (man-in-the-middle)

A security downgrade issue has been found in Thunderbird before 68.9.0.
If Thunderbird is configured to use STARTTLS for an IMAP server, and
the server sends a PREAUTH response, then Thunderbird will continue
with an unencrypted connection, causing email data to be sent without
protection.

- CVE-2020-12399 (private key recovery)

NSS before 3.52.1, as used in Firefox before 77.0 and Thunderbird
before 68.9.0, has shown timing differences when performing DSA
signatures, which was exploitable and could eventually leak private
keys.

- CVE-2020-12405 (denial of service)

When browsing a malicious page in Firefox before 77.0 and Thunderbird
before 68.9.0, a race condition in our SharedWorkerService could occur
and lead to a potentially exploitable crash.

- CVE-2020-12406 (arbitrary code execution)

Mozilla Developer Iain Ireland discovered a missing type check in
Firefox before 77.0 and Thunderbird before 68.9.0 during unboxed
objects removal, resulting in a crash. We presume that with enough
effort that it could be exploited to run arbitrary code.

- CVE-2020-12410 (arbitrary code execution)

Mozilla developers Tom Tung and Karl Tomlinson reported memory safety
bugs present in Firefox 76, Firefox ESR 68.8 and Thunderbird before
68.9.0. Some of these bugs showed evidence of memory corruption and
Mozilla presumes that with enough effort some of these could have been
exploited to run arbitrary code.

Impact
=====
A remote attacker might be able to recover private keys, downgrade an
encrypted connection, execute arbitrary code or crash the application.

References
=========
  https://www.mozilla.org/en-US/security/advisories/mfsa2020-22/
  https://www.mozilla.org/en-US/security/advisories/mfsa2020-22/#CVE-2020-12398
  https://bugzilla.mozilla.org/show_bug.cgi?id13623
  https://www.mozilla.org/en-US/security/advisories/mfsa2020-20/
  https://bugzilla.mozilla.org/show_bug.cgi?id31576
  https://hg.mozilla.org/projects/nss/rev/daa823a4a29bcef0fec33a379ec83857429aea2e
  https://bugzilla.mozilla.org/show_bug.cgi?id31618
  https://bugzilla.mozilla.org/show_bug.cgi?id39590
  https://bugzilla.mozilla.org/buglist.cgi?bug_id19305%2C1632717
  https://security.archlinux.org/CVE-2020-12398
  https://security.archlinux.org/CVE-2020-12399
  https://security.archlinux.org/CVE-2020-12405
  https://security.archlinux.org/CVE-2020-12406
  https://security.archlinux.org/CVE-2020-12410