RHSA-2019:1309HighCVSS 9.8

Red Hat Security Advisory: thunderbird security update

Published
June 3, 2019
Last Modified
November 12, 2026

🔗 CVE IDs covered (12)

CVE-2019-9819 →CVE-2019-9820 →CVE-2019-11691 →CVE-2018-18511 →CVE-2019-9797 →CVE-2019-9800 →CVE-2019-9817 →CVE-2019-11692 →CVE-2019-11693 →CVE-2019-11698 →CVE-2019-5798 →CVE-2019-7317 →

📋 Description

CVE-2018-18511 — mozilla: Cross-origin theft of images with ImageBitmapRenderingContext CVE-2019-5798 — chromium-browser: Out of bounds read in Skia CVE-2019-7317 — libpng: use-after-free in png_image_free in png.c CVE-2019-9797 — Mozilla: Cross-origin theft of images with createImageBitmap CVE-2019-9800 — Mozilla: Memory safety bugs fixed in Firefox 67 and Firefox ESR 60.7 CVE-2019-9817 — Mozilla: Stealing of cross-domain images using canvas CVE-2019-9819 — Mozilla: Compartment mismatch with fetch API CVE-2019-9820 — Mozilla: Use-after-free of ChromeEventHandler by DocShell CVE-2019-11691 — Mozilla: Use-after-free in XMLHttpRequest CVE-2019-11692 — Mozilla: Use-after-free removing listeners in the event listener manager CVE-2019-11693 — Mozilla: Buffer overflow in WebGL bufferdata on Linux CVE-2019-11698 — Mozilla: Theft of user history data through drag and drop of hyperlinks to and from bookmarks

🎯 Affected products20

  • Red Hat Enterprise Linux Client (v. 7)
  • Red Hat Enterprise Linux Server Optional (v. 7)
  • Red Hat Enterprise Linux Workstation (v. 7)
  • Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7)
  • thunderbird-0:60.7.0-1.el7_6.aarch64 as a component of Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7)
  • thunderbird-0:60.7.0-1.el7_6.ppc64le as a component of Red Hat Enterprise Linux Server Optional (v. 7)
  • thunderbird-0:60.7.0-1.el7_6.ppc64le as a component of Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7)
  • thunderbird-0:60.7.0-1.el7_6.src as a component of Red Hat Enterprise Linux Client (v. 7)
  • thunderbird-0:60.7.0-1.el7_6.src as a component of Red Hat Enterprise Linux Server Optional (v. 7)
  • thunderbird-0:60.7.0-1.el7_6.src as a component of Red Hat Enterprise Linux Workstation (v. 7)
  • thunderbird-0:60.7.0-1.el7_6.src as a component of Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7)
  • thunderbird-0:60.7.0-1.el7_6.x86_64 as a component of Red Hat Enterprise Linux Client (v. 7)
  • thunderbird-0:60.7.0-1.el7_6.x86_64 as a component of Red Hat Enterprise Linux Server Optional (v. 7)
  • thunderbird-0:60.7.0-1.el7_6.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 7)
  • thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64 as a component of Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7)
  • thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le as a component of Red Hat Enterprise Linux Server Optional (v. 7)
  • thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le as a component of Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7)
  • thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64 as a component of Red Hat Enterprise Linux Client (v. 7)
  • thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64 as a component of Red Hat Enterprise Linux Server Optional (v. 7)
  • thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 7)

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 All running instances of Thunderbird must be restarted for the update to take effect.

🔗 References (16)