CVE-2017-17689
The S/MIME specification allows a Cipher Block Chaining (CBC) malleability-gadget attack that can indirectly lead to plaintext exfiltration, aka EFAIL.
- Обновитесь до 1:52.8.0+build1-0ubuntu0.14.04.1
Опубликовано Обновлено
PatchFirst · Свежие уязвимости
Уязвимости thunderbird · Страница 10
За последние 30 дней в thunderbird опубликовано уязвимостей: 0; в каталоге KEV: 0.
Уязвимостей: 341
UBUNTU-CVE-2017-7775
Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none
- Обновитесь до 1:52.2.1+build1-0ubuntu0.14.04.1
Опубликовано ОбновленоCVE-2017-5461
Mozilla Network Security Services (NSS) before 3.21.4, 3.22.x through 3.28.x before 3.28.4, 3.29.x before 3.29.5, and 3.30.x before 3.30.1 allows remote attackers to cause a denial of service (out-of-bounds write) or possibly have unspecified other impact by leveraging incorrect base64 operations.
- Обновитесь до 1:52.1.1+build1-0ubuntu0.14.04.1
Опубликовано ОбновленоUBUNTU-CVE-2017-5437
Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2016-10195, CVE-2016-10196, CVE-2016-10197. Reason: This candidate is a duplicate of CVE-2016-10195, CVE-2016-10196, and CVE-2016-10197. Notes: All CVE users should reference CVE-2016-10195, CVE-2016-10196, and/or CVE-2016-10197 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage
- Обновитесь до 1:52.1.1+build1-0ubuntu0.14.04.1
Опубликовано ОбновленоCVE-2016-10197
The search_make_new function in evdns.c in libevent before 2.1.6-beta allows attackers to cause a denial of service (out-of-bounds read) via an empty hostname.
- Обновитесь до 1:52.1.1+build1-0ubuntu0.14.04.1
Опубликовано ОбновленоCVE-2016-10196
Stack-based buffer overflow in the evutil_parse_sockaddr_port function in evutil.c in libevent before 2.1.6-beta allows attackers to cause a denial of service (segmentation fault) via vectors involving a long string in brackets in the ip_as_string argument.
- Обновитесь до 1:52.1.1+build1-0ubuntu0.14.04.1
Опубликовано ОбновленоCVE-2016-10195
The name_parse function in evdns.c in libevent before 2.1.6-beta allows remote attackers to have unspecified impact via vectors involving the label_len variable, which triggers an out-of-bounds stack read.
- Обновитесь до 1:52.1.1+build1-0ubuntu0.14.04.1
Опубликовано ОбновленоCVE-2016-5824
libical 1.0 allows remote attackers to cause a denial of service (use-after-free) via a crafted ics file.
- Обновитесь до 1:60.5.1+build2-0ubuntu0.14.04.1
Опубликовано ОбновленоCVE-2016-5284
Mozilla Firefox before 49.0, Firefox ESR 45.x before 45.4, and Thunderbird < 45.4 rely on unintended expiration dates for Preloaded Public Key Pinning, which allows man-in-the-middle attackers to spoof add-on updates by leveraging possession of an X.509 server certificate for addons.mozilla.org signed by an arbitrary built-in Certification Authority.
- Обновитесь до 1:45.4.0+build1-0ubuntu0.14.04.1
Опубликовано ОбновленоCVE-2016-5281
Use-after-free vulnerability in the DOMSVGLength class in Mozilla Firefox before 49.0, Firefox ESR 45.x before 45.4, and Thunderbird < 45.4 allows remote attackers to execute arbitrary code by leveraging improper interaction between JavaScript code and an SVG document.
- Обновитесь до 1:45.4.0+build1-0ubuntu0.14.04.1
Опубликовано ОбновленоCVE-2016-5280
Use-after-free vulnerability in the mozilla::nsTextNodeDirectionalityMap::RemoveElementFromMap function in Mozilla Firefox before 49.0, Firefox ESR 45.x before 45.4, and Thunderbird < 45.4 allows remote attackers to execute arbitrary code via bidirectional text.
- Обновитесь до 1:45.4.0+build1-0ubuntu0.14.04.1
Опубликовано ОбновленоCVE-2016-5278
Heap-based buffer overflow in the nsBMPEncoder::AddImageFrame function in Mozilla Firefox before 49.0, Firefox ESR 45.x before 45.4, and Thunderbird < 45.4 allows remote attackers to execute arbitrary code via a crafted image data that is mishandled during the encoding of an image frame to an image.
- Обновитесь до 1:45.4.0+build1-0ubuntu0.14.04.1
Опубликовано ОбновленоCVE-2016-5277
Use-after-free vulnerability in the nsRefreshDriver::Tick function in Mozilla Firefox before 49.0, Firefox ESR 45.x before 45.4, and Thunderbird < 45.4 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) by leveraging improper interaction between timeline destruction and the Web Animations model implementation.
- Обновитесь до 1:45.4.0+build1-0ubuntu0.14.04.1
Опубликовано ОбновленоCVE-2016-5276
Use-after-free vulnerability in the mozilla::a11y::DocAccessible::ProcessInvalidationList function in Mozilla Firefox before 49.0, Firefox ESR 45.x before 45.4, and Thunderbird < 45.4 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via an aria-owns attribute.
- Обновитесь до 1:45.4.0+build1-0ubuntu0.14.04.1
Опубликовано ОбновленоCVE-2016-5274
Use-after-free vulnerability in the nsFrameManager::CaptureFrameState function in Mozilla Firefox before 49.0, Firefox ESR 45.x before 45.4, and Thunderbird < 45.4 allows remote attackers to execute arbitrary code by leveraging improper interaction between restyling and the Web Animations model implementation.
- Обновитесь до 1:45.4.0+build1-0ubuntu0.14.04.1
Опубликовано ОбновленоCVE-2016-5272
The nsImageGeometryMixin class in Mozilla Firefox before 49.0, Firefox ESR 45.x before 45.4, and Thunderbird < 45.4 does not properly perform a cast of an unspecified variable during handling of INPUT elements, which allows remote attackers to execute arbitrary code via a crafted web site.
- Обновитесь до 1:45.4.0+build1-0ubuntu0.14.04.1
Опубликовано ОбновленоCVE-2016-5270
Heap-based buffer overflow in the nsCaseTransformTextRunFactory::TransformString function in Mozilla Firefox before 49.0, Firefox ESR 45.x before 45.4, and Thunderbird < 45.4 allows remote attackers to cause a denial of service (boolean out-of-bounds write) or possibly have unspecified other impact via Unicode characters that are mishandled during text conversion.
- Обновитесь до 1:45.4.0+build1-0ubuntu0.14.04.1
Опубликовано ОбновленоCVE-2016-5257
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 49.0, Firefox ESR 45.x before 45.4 and Thunderbird < 45.4 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
- Обновитесь до 1:45.4.0+build1-0ubuntu0.14.04.1
Опубликовано ОбновленоCVE-2016-1951
Multiple integer overflows in io/prprf.c in Mozilla Netscape Portable Runtime (NSPR) before 4.12 allow remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via a long string to a PR_*printf function.
- Обновитесь до 1:45.2.0+build1-0ubuntu0.14.04.3
Опубликовано ОбновленоCVE-2016-5250
Mozilla Firefox before 48.0, Firefox ESR < 45.4 and Thunderbird < 45.4 allow remote attackers to obtain sensitive information about the previously retrieved page via Resource Timing API calls.
- Обновитесь до 1:45.4.0+build1-0ubuntu0.14.04.1
Опубликовано Обновлено
Проверьте свой сервер
Сопоставьте установленный стек и версии со свежими базами уязвимостей.