RHSA-2018:1725
Vulnerability from csaf_opensuse - Published: 2018-05-24 00:00 - Updated: 2026-09-20 11:01Summary
security update for thunderbird
Severity
Important
Notes
Title of the patch: security update for thunderbird
Description of the patch: This security update provides a functional equivalent of RHSA-2018:1725.
The original Red Hat(R) advisory is available from the Red Hat web site at
https://access.redhat.com/errata/RHSA-2018:1725.
Patchnames: RHSA-2018:1725
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
8.8 (High)
Affected products
Recommended
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Liberty Linux 7:thunderbird-0:52.8.0-1.el7_5.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
9.8 (Critical)
Affected products
Recommended
1 product, the same list as for
CVE-2018-5150
Threats
Impact
important
7.5 (High)
Affected products
Recommended
1 product, the same list as for
CVE-2018-5150
Threats
Impact
important
9.8 (Critical)
Affected products
Recommended
1 product, the same list as for
CVE-2018-5150
Threats
Impact
important
4.3 (Medium)
Affected products
Recommended
1 product, the same list as for
CVE-2018-5150
Threats
Impact
important
7.5 (High)
Affected products
Recommended
1 product, the same list as for
CVE-2018-5150
Threats
Impact
important
5.3 (Medium)
Affected products
Recommended
1 product, the same list as for
CVE-2018-5150
Threats
Impact
important
4.3 (Medium)
Affected products
Recommended
1 product, the same list as for
CVE-2018-5150
Threats
Impact
important
8.1 (High)
Affected products
Recommended
1 product, the same list as for
CVE-2018-5150
Threats
Impact
important
9.8 (Critical)
Affected products
Recommended
1 product, the same list as for
CVE-2018-5150
Threats
Impact
important
7.5 (High)
Affected products
Recommended
1 product, the same list as for
CVE-2018-5150
Threats
Impact
important
6.5 (Medium)
Affected products
Recommended
1 product, the same list as for
CVE-2018-5150
Threats
Impact
important
References
113 references
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "security update for thunderbird",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This security update provides a functional equivalent of RHSA-2018:1725.\nThe original Red Hat(R) advisory is available from the Red Hat web site at\nhttps://access.redhat.com/errata/RHSA-2018:1725.\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "RHSA-2018:1725",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/rhsa-2018_1725.json"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2018-5150 page",
"url": "https://www.suse.com/security/cve/CVE-2018-5150/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2018-5154 page",
"url": "https://www.suse.com/security/cve/CVE-2018-5154/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2018-5155 page",
"url": "https://www.suse.com/security/cve/CVE-2018-5155/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2018-5159 page",
"url": "https://www.suse.com/security/cve/CVE-2018-5159/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2018-5161 page",
"url": "https://www.suse.com/security/cve/CVE-2018-5161/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2018-5162 page",
"url": "https://www.suse.com/security/cve/CVE-2018-5162/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2018-5168 page",
"url": "https://www.suse.com/security/cve/CVE-2018-5168/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2018-5170 page",
"url": "https://www.suse.com/security/cve/CVE-2018-5170/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2018-5178 page",
"url": "https://www.suse.com/security/cve/CVE-2018-5178/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2018-5183 page",
"url": "https://www.suse.com/security/cve/CVE-2018-5183/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2018-5184 page",
"url": "https://www.suse.com/security/cve/CVE-2018-5184/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2018-5185 page",
"url": "https://www.suse.com/security/cve/CVE-2018-5185/"
}
],
"title": "security update for thunderbird",
"tracking": {
"current_release_date": "2026-09-20T11:01:07Z",
"generator": {
"date": "2018-05-24T00:00:00Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "RHSA-2018:1725",
"initial_release_date": "2018-05-24T00:00:00Z",
"revision_history": [
{
"date": "2018-05-24T00:00:00Z",
"number": "1",
"summary": "Current version"
},
{
"date": "2026-09-20T11:01:07Z",
"number": "2",
"summary": "unknown changes"
}
],
"status": "final",
"version": "2"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "thunderbird-0:52.8.0-1.el7_5.x86_64",
"product": {
"name": "thunderbird-0:52.8.0-1.el7_5.x86_64",
"product_id": "thunderbird-0:52.8.0-1.el7_5.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/suse/thunderbird@52.8.0-1.el7_5?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Liberty Linux 7",
"product": {
"name": "SUSE Liberty Linux 7",
"product_id": "SUSE Liberty Linux 7",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sll:7"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "thunderbird-0:52.8.0-1.el7_5.x86_64 as component of SUSE Liberty Linux 7",
"product_id": "SUSE Liberty Linux 7:thunderbird-0:52.8.0-1.el7_5.x86_64"
},
"product_reference": "thunderbird-0:52.8.0-1.el7_5.x86_64",
"relates_to_product_reference": "SUSE Liberty Linux 7"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2018-5150",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2018-5150"
}
],
"notes": [
{
"category": "general",
"text": "Memory safety bugs were reported in Firefox 59, Firefox ESR 52.7, and Thunderbird 52.7. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Thunderbird \u003c 52.8, Thunderbird ESR \u003c 52.8, Firefox \u003c 60, and Firefox ESR \u003c 52.8.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 7:thunderbird-0:52.8.0-1.el7_5.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2018-5150",
"url": "https://www.suse.com/security/cve/CVE-2018-5150"
},
{
"category": "external",
"summary": "SUSE Bug 1092548 for CVE-2018-5150",
"url": "https://bugzilla.suse.com/1092548"
},
{
"category": "external",
"summary": "SUSE Bug 1092611 for CVE-2018-5150",
"url": "https://bugzilla.suse.com/1092611"
},
{
"category": "external",
"summary": "SUSE Bug 1093969 for CVE-2018-5150",
"url": "https://bugzilla.suse.com/1093969"
},
{
"category": "external",
"summary": "SUSE Bug 1093970 for CVE-2018-5150",
"url": "https://bugzilla.suse.com/1093970"
},
{
"category": "external",
"summary": "SUSE Bug 1093971 for CVE-2018-5150",
"url": "https://bugzilla.suse.com/1093971"
},
{
"category": "external",
"summary": "SUSE Bug 1093972 for CVE-2018-5150",
"url": "https://bugzilla.suse.com/1093972"
},
{
"category": "external",
"summary": "SUSE Bug 1093973 for CVE-2018-5150",
"url": "https://bugzilla.suse.com/1093973"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 7:thunderbird-0:52.8.0-1.el7_5.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Liberty Linux 7:thunderbird-0:52.8.0-1.el7_5.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2018-05-24T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2018-5150"
},
{
"cve": "CVE-2018-5154",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2018-5154"
}
],
"notes": [
{
"category": "general",
"text": "A use-after-free vulnerability can occur while enumerating attributes during SVG animations with clip paths. This results in a potentially exploitable crash. This vulnerability affects Thunderbird \u003c 52.8, Thunderbird ESR \u003c 52.8, Firefox \u003c 60, and Firefox ESR \u003c 52.8.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 7:thunderbird-0:52.8.0-1.el7_5.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2018-5154",
"url": "https://www.suse.com/security/cve/CVE-2018-5154"
},
{
"category": "external",
"summary": "SUSE Bug 1092548 for CVE-2018-5154",
"url": "https://bugzilla.suse.com/1092548"
},
{
"category": "external",
"summary": "SUSE Bug 1092611 for CVE-2018-5154",
"url": "https://bugzilla.suse.com/1092611"
},
{
"category": "external",
"summary": "SUSE Bug 1093969 for CVE-2018-5154",
"url": "https://bugzilla.suse.com/1093969"
},
{
"category": "external",
"summary": "SUSE Bug 1093970 for CVE-2018-5154",
"url": "https://bugzilla.suse.com/1093970"
},
{
"category": "external",
"summary": "SUSE Bug 1093971 for CVE-2018-5154",
"url": "https://bugzilla.suse.com/1093971"
},
{
"category": "external",
"summary": "SUSE Bug 1093972 for CVE-2018-5154",
"url": "https://bugzilla.suse.com/1093972"
},
{
"category": "external",
"summary": "SUSE Bug 1093973 for CVE-2018-5154",
"url": "https://bugzilla.suse.com/1093973"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 7:thunderbird-0:52.8.0-1.el7_5.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"SUSE Liberty Linux 7:thunderbird-0:52.8.0-1.el7_5.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2018-05-24T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2018-5154"
},
{
"cve": "CVE-2018-5155",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2018-5155"
}
],
"notes": [
{
"category": "general",
"text": "A use-after-free vulnerability can occur while adjusting layout during SVG animations with text paths. This results in a potentially exploitable crash. This vulnerability affects Thunderbird \u003c 52.8, Thunderbird ESR \u003c 52.8, Firefox \u003c 60, and Firefox ESR \u003c 52.8.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 7:thunderbird-0:52.8.0-1.el7_5.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2018-5155",
"url": "https://www.suse.com/security/cve/CVE-2018-5155"
},
{
"category": "external",
"summary": "SUSE Bug 1092548 for CVE-2018-5155",
"url": "https://bugzilla.suse.com/1092548"
},
{
"category": "external",
"summary": "SUSE Bug 1092611 for CVE-2018-5155",
"url": "https://bugzilla.suse.com/1092611"
},
{
"category": "external",
"summary": "SUSE Bug 1093969 for CVE-2018-5155",
"url": "https://bugzilla.suse.com/1093969"
},
{
"category": "external",
"summary": "SUSE Bug 1093970 for CVE-2018-5155",
"url": "https://bugzilla.suse.com/1093970"
},
{
"category": "external",
"summary": "SUSE Bug 1093971 for CVE-2018-5155",
"url": "https://bugzilla.suse.com/1093971"
},
{
"category": "external",
"summary": "SUSE Bug 1093972 for CVE-2018-5155",
"url": "https://bugzilla.suse.com/1093972"
},
{
"category": "external",
"summary": "SUSE Bug 1093973 for CVE-2018-5155",
"url": "https://bugzilla.suse.com/1093973"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 7:thunderbird-0:52.8.0-1.el7_5.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Liberty Linux 7:thunderbird-0:52.8.0-1.el7_5.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2018-05-24T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2018-5155"
},
{
"cve": "CVE-2018-5159",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2018-5159"
}
],
"notes": [
{
"category": "general",
"text": "An integer overflow can occur in the Skia library due to 32-bit integer use in an array without integer overflow checks, resulting in possible out-of-bounds writes. This could lead to a potentially exploitable crash triggerable by web content. This vulnerability affects Thunderbird \u003c 52.8, Thunderbird ESR \u003c 52.8, Firefox \u003c 60, and Firefox ESR \u003c 52.8.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 7:thunderbird-0:52.8.0-1.el7_5.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2018-5159",
"url": "https://www.suse.com/security/cve/CVE-2018-5159"
},
{
"category": "external",
"summary": "SUSE Bug 1092548 for CVE-2018-5159",
"url": "https://bugzilla.suse.com/1092548"
},
{
"category": "external",
"summary": "SUSE Bug 1092611 for CVE-2018-5159",
"url": "https://bugzilla.suse.com/1092611"
},
{
"category": "external",
"summary": "SUSE Bug 1093969 for CVE-2018-5159",
"url": "https://bugzilla.suse.com/1093969"
},
{
"category": "external",
"summary": "SUSE Bug 1093970 for CVE-2018-5159",
"url": "https://bugzilla.suse.com/1093970"
},
{
"category": "external",
"summary": "SUSE Bug 1093971 for CVE-2018-5159",
"url": "https://bugzilla.suse.com/1093971"
},
{
"category": "external",
"summary": "SUSE Bug 1093972 for CVE-2018-5159",
"url": "https://bugzilla.suse.com/1093972"
},
{
"category": "external",
"summary": "SUSE Bug 1093973 for CVE-2018-5159",
"url": "https://bugzilla.suse.com/1093973"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 7:thunderbird-0:52.8.0-1.el7_5.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"SUSE Liberty Linux 7:thunderbird-0:52.8.0-1.el7_5.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2018-05-24T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2018-5159"
},
{
"cve": "CVE-2018-5161",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2018-5161"
}
],
"notes": [
{
"category": "general",
"text": "Crafted message headers can cause a Thunderbird process to hang on receiving the message. This vulnerability affects Thunderbird ESR \u003c 52.8 and Thunderbird \u003c 52.8.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 7:thunderbird-0:52.8.0-1.el7_5.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2018-5161",
"url": "https://www.suse.com/security/cve/CVE-2018-5161"
},
{
"category": "external",
"summary": "SUSE Bug 1092548 for CVE-2018-5161",
"url": "https://bugzilla.suse.com/1092548"
},
{
"category": "external",
"summary": "SUSE Bug 1092611 for CVE-2018-5161",
"url": "https://bugzilla.suse.com/1092611"
},
{
"category": "external",
"summary": "SUSE Bug 1093969 for CVE-2018-5161",
"url": "https://bugzilla.suse.com/1093969"
},
{
"category": "external",
"summary": "SUSE Bug 1093970 for CVE-2018-5161",
"url": "https://bugzilla.suse.com/1093970"
},
{
"category": "external",
"summary": "SUSE Bug 1093971 for CVE-2018-5161",
"url": "https://bugzilla.suse.com/1093971"
},
{
"category": "external",
"summary": "SUSE Bug 1093972 for CVE-2018-5161",
"url": "https://bugzilla.suse.com/1093972"
},
{
"category": "external",
"summary": "SUSE Bug 1093973 for CVE-2018-5161",
"url": "https://bugzilla.suse.com/1093973"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 7:thunderbird-0:52.8.0-1.el7_5.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
"version": "3.0"
},
"products": [
"SUSE Liberty Linux 7:thunderbird-0:52.8.0-1.el7_5.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2018-05-24T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2018-5161"
},
{
"cve": "CVE-2018-5162",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2018-5162"
}
],
"notes": [
{
"category": "general",
"text": "Plaintext of decrypted emails can leak through the src attribute of remote images, or links. This vulnerability affects Thunderbird ESR \u003c 52.8 and Thunderbird \u003c 52.8.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 7:thunderbird-0:52.8.0-1.el7_5.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2018-5162",
"url": "https://www.suse.com/security/cve/CVE-2018-5162"
},
{
"category": "external",
"summary": "SUSE Bug 1092548 for CVE-2018-5162",
"url": "https://bugzilla.suse.com/1092548"
},
{
"category": "external",
"summary": "SUSE Bug 1092611 for CVE-2018-5162",
"url": "https://bugzilla.suse.com/1092611"
},
{
"category": "external",
"summary": "SUSE Bug 1093151 for CVE-2018-5162",
"url": "https://bugzilla.suse.com/1093151"
},
{
"category": "external",
"summary": "SUSE Bug 1093969 for CVE-2018-5162",
"url": "https://bugzilla.suse.com/1093969"
},
{
"category": "external",
"summary": "SUSE Bug 1093970 for CVE-2018-5162",
"url": "https://bugzilla.suse.com/1093970"
},
{
"category": "external",
"summary": "SUSE Bug 1093971 for CVE-2018-5162",
"url": "https://bugzilla.suse.com/1093971"
},
{
"category": "external",
"summary": "SUSE Bug 1093972 for CVE-2018-5162",
"url": "https://bugzilla.suse.com/1093972"
},
{
"category": "external",
"summary": "SUSE Bug 1093973 for CVE-2018-5162",
"url": "https://bugzilla.suse.com/1093973"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 7:thunderbird-0:52.8.0-1.el7_5.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.0"
},
"products": [
"SUSE Liberty Linux 7:thunderbird-0:52.8.0-1.el7_5.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2018-05-24T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2018-5162"
},
{
"cve": "CVE-2018-5168",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2018-5168"
}
],
"notes": [
{
"category": "general",
"text": "Sites can bypass security checks on permissions to install lightweight themes by manipulating the \"baseURI\" property of the theme element. This could allow a malicious site to install a theme without user interaction which could contain offensive or embarrassing images. This vulnerability affects Thunderbird \u003c 52.8, Thunderbird ESR \u003c 52.8, Firefox \u003c 60, and Firefox ESR \u003c 52.8.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 7:thunderbird-0:52.8.0-1.el7_5.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2018-5168",
"url": "https://www.suse.com/security/cve/CVE-2018-5168"
},
{
"category": "external",
"summary": "SUSE Bug 1092548 for CVE-2018-5168",
"url": "https://bugzilla.suse.com/1092548"
},
{
"category": "external",
"summary": "SUSE Bug 1092611 for CVE-2018-5168",
"url": "https://bugzilla.suse.com/1092611"
},
{
"category": "external",
"summary": "SUSE Bug 1093969 for CVE-2018-5168",
"url": "https://bugzilla.suse.com/1093969"
},
{
"category": "external",
"summary": "SUSE Bug 1093970 for CVE-2018-5168",
"url": "https://bugzilla.suse.com/1093970"
},
{
"category": "external",
"summary": "SUSE Bug 1093971 for CVE-2018-5168",
"url": "https://bugzilla.suse.com/1093971"
},
{
"category": "external",
"summary": "SUSE Bug 1093972 for CVE-2018-5168",
"url": "https://bugzilla.suse.com/1093972"
},
{
"category": "external",
"summary": "SUSE Bug 1093973 for CVE-2018-5168",
"url": "https://bugzilla.suse.com/1093973"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 7:thunderbird-0:52.8.0-1.el7_5.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.0"
},
"products": [
"SUSE Liberty Linux 7:thunderbird-0:52.8.0-1.el7_5.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2018-05-24T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2018-5168"
},
{
"cve": "CVE-2018-5170",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2018-5170"
}
],
"notes": [
{
"category": "general",
"text": "It is possible to spoof the filename of an attachment and display an arbitrary attachment name. This could lead to a user opening a remote attachment which is a different file type than expected. This vulnerability affects Thunderbird ESR \u003c 52.8 and Thunderbird \u003c 52.8.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 7:thunderbird-0:52.8.0-1.el7_5.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2018-5170",
"url": "https://www.suse.com/security/cve/CVE-2018-5170"
},
{
"category": "external",
"summary": "SUSE Bug 1092548 for CVE-2018-5170",
"url": "https://bugzilla.suse.com/1092548"
},
{
"category": "external",
"summary": "SUSE Bug 1092611 for CVE-2018-5170",
"url": "https://bugzilla.suse.com/1092611"
},
{
"category": "external",
"summary": "SUSE Bug 1093969 for CVE-2018-5170",
"url": "https://bugzilla.suse.com/1093969"
},
{
"category": "external",
"summary": "SUSE Bug 1093970 for CVE-2018-5170",
"url": "https://bugzilla.suse.com/1093970"
},
{
"category": "external",
"summary": "SUSE Bug 1093971 for CVE-2018-5170",
"url": "https://bugzilla.suse.com/1093971"
},
{
"category": "external",
"summary": "SUSE Bug 1093972 for CVE-2018-5170",
"url": "https://bugzilla.suse.com/1093972"
},
{
"category": "external",
"summary": "SUSE Bug 1093973 for CVE-2018-5170",
"url": "https://bugzilla.suse.com/1093973"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 7:thunderbird-0:52.8.0-1.el7_5.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
"version": "3.0"
},
"products": [
"SUSE Liberty Linux 7:thunderbird-0:52.8.0-1.el7_5.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2018-05-24T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2018-5170"
},
{
"cve": "CVE-2018-5178",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2018-5178"
}
],
"notes": [
{
"category": "general",
"text": "A buffer overflow was found during UTF8 to Unicode string conversion within JavaScript with extremely large amounts of data. This vulnerability requires the use of a malicious or vulnerable legacy extension in order to occur. This vulnerability affects Thunderbird ESR \u003c 52.8, Thunderbird \u003c 52.8, and Firefox ESR \u003c 52.8.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 7:thunderbird-0:52.8.0-1.el7_5.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2018-5178",
"url": "https://www.suse.com/security/cve/CVE-2018-5178"
},
{
"category": "external",
"summary": "SUSE Bug 1092548 for CVE-2018-5178",
"url": "https://bugzilla.suse.com/1092548"
},
{
"category": "external",
"summary": "SUSE Bug 1092611 for CVE-2018-5178",
"url": "https://bugzilla.suse.com/1092611"
},
{
"category": "external",
"summary": "SUSE Bug 1093969 for CVE-2018-5178",
"url": "https://bugzilla.suse.com/1093969"
},
{
"category": "external",
"summary": "SUSE Bug 1093970 for CVE-2018-5178",
"url": "https://bugzilla.suse.com/1093970"
},
{
"category": "external",
"summary": "SUSE Bug 1093971 for CVE-2018-5178",
"url": "https://bugzilla.suse.com/1093971"
},
{
"category": "external",
"summary": "SUSE Bug 1093972 for CVE-2018-5178",
"url": "https://bugzilla.suse.com/1093972"
},
{
"category": "external",
"summary": "SUSE Bug 1093973 for CVE-2018-5178",
"url": "https://bugzilla.suse.com/1093973"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 7:thunderbird-0:52.8.0-1.el7_5.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"SUSE Liberty Linux 7:thunderbird-0:52.8.0-1.el7_5.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2018-05-24T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2018-5178"
},
{
"cve": "CVE-2018-5183",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2018-5183"
}
],
"notes": [
{
"category": "general",
"text": "Mozilla developers backported selected changes in the Skia library. These changes correct memory corruption issues including invalid buffer reads and writes during graphic operations. This vulnerability affects Thunderbird ESR \u003c 52.8, Thunderbird \u003c 52.8, and Firefox ESR \u003c 52.8.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 7:thunderbird-0:52.8.0-1.el7_5.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2018-5183",
"url": "https://www.suse.com/security/cve/CVE-2018-5183"
},
{
"category": "external",
"summary": "SUSE Bug 1092548 for CVE-2018-5183",
"url": "https://bugzilla.suse.com/1092548"
},
{
"category": "external",
"summary": "SUSE Bug 1092611 for CVE-2018-5183",
"url": "https://bugzilla.suse.com/1092611"
},
{
"category": "external",
"summary": "SUSE Bug 1093969 for CVE-2018-5183",
"url": "https://bugzilla.suse.com/1093969"
},
{
"category": "external",
"summary": "SUSE Bug 1093970 for CVE-2018-5183",
"url": "https://bugzilla.suse.com/1093970"
},
{
"category": "external",
"summary": "SUSE Bug 1093971 for CVE-2018-5183",
"url": "https://bugzilla.suse.com/1093971"
},
{
"category": "external",
"summary": "SUSE Bug 1093972 for CVE-2018-5183",
"url": "https://bugzilla.suse.com/1093972"
},
{
"category": "external",
"summary": "SUSE Bug 1093973 for CVE-2018-5183",
"url": "https://bugzilla.suse.com/1093973"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 7:thunderbird-0:52.8.0-1.el7_5.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"SUSE Liberty Linux 7:thunderbird-0:52.8.0-1.el7_5.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2018-05-24T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2018-5183"
},
{
"cve": "CVE-2018-5184",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2018-5184"
}
],
"notes": [
{
"category": "general",
"text": "Using remote content in encrypted messages can lead to the disclosure of plaintext. This vulnerability affects Thunderbird ESR \u003c 52.8 and Thunderbird \u003c 52.8.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 7:thunderbird-0:52.8.0-1.el7_5.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2018-5184",
"url": "https://www.suse.com/security/cve/CVE-2018-5184"
},
{
"category": "external",
"summary": "SUSE Bug 1092548 for CVE-2018-5184",
"url": "https://bugzilla.suse.com/1092548"
},
{
"category": "external",
"summary": "SUSE Bug 1092611 for CVE-2018-5184",
"url": "https://bugzilla.suse.com/1092611"
},
{
"category": "external",
"summary": "SUSE Bug 1093152 for CVE-2018-5184",
"url": "https://bugzilla.suse.com/1093152"
},
{
"category": "external",
"summary": "SUSE Bug 1093969 for CVE-2018-5184",
"url": "https://bugzilla.suse.com/1093969"
},
{
"category": "external",
"summary": "SUSE Bug 1093970 for CVE-2018-5184",
"url": "https://bugzilla.suse.com/1093970"
},
{
"category": "external",
"summary": "SUSE Bug 1093971 for CVE-2018-5184",
"url": "https://bugzilla.suse.com/1093971"
},
{
"category": "external",
"summary": "SUSE Bug 1093972 for CVE-2018-5184",
"url": "https://bugzilla.suse.com/1093972"
},
{
"category": "external",
"summary": "SUSE Bug 1093973 for CVE-2018-5184",
"url": "https://bugzilla.suse.com/1093973"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 7:thunderbird-0:52.8.0-1.el7_5.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.0"
},
"products": [
"SUSE Liberty Linux 7:thunderbird-0:52.8.0-1.el7_5.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2018-05-24T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2018-5184"
},
{
"cve": "CVE-2018-5185",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2018-5185"
}
],
"notes": [
{
"category": "general",
"text": "Plaintext of decrypted emails can leak through by user submitting an embedded form. This vulnerability affects Thunderbird ESR \u003c 52.8 and Thunderbird \u003c 52.8.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 7:thunderbird-0:52.8.0-1.el7_5.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2018-5185",
"url": "https://www.suse.com/security/cve/CVE-2018-5185"
},
{
"category": "external",
"summary": "SUSE Bug 1092548 for CVE-2018-5185",
"url": "https://bugzilla.suse.com/1092548"
},
{
"category": "external",
"summary": "SUSE Bug 1092611 for CVE-2018-5185",
"url": "https://bugzilla.suse.com/1092611"
},
{
"category": "external",
"summary": "SUSE Bug 1093151 for CVE-2018-5185",
"url": "https://bugzilla.suse.com/1093151"
},
{
"category": "external",
"summary": "SUSE Bug 1093969 for CVE-2018-5185",
"url": "https://bugzilla.suse.com/1093969"
},
{
"category": "external",
"summary": "SUSE Bug 1093970 for CVE-2018-5185",
"url": "https://bugzilla.suse.com/1093970"
},
{
"category": "external",
"summary": "SUSE Bug 1093971 for CVE-2018-5185",
"url": "https://bugzilla.suse.com/1093971"
},
{
"category": "external",
"summary": "SUSE Bug 1093972 for CVE-2018-5185",
"url": "https://bugzilla.suse.com/1093972"
},
{
"category": "external",
"summary": "SUSE Bug 1093973 for CVE-2018-5185",
"url": "https://bugzilla.suse.com/1093973"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 7:thunderbird-0:52.8.0-1.el7_5.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.0"
},
"products": [
"SUSE Liberty Linux 7:thunderbird-0:52.8.0-1.el7_5.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2018-05-24T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2018-5185"
}
]
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…