PublicDateAtUSN: 2019-06-14
Candidate: CVE-2019-11704
PublicDate: 2019-07-23 14:15:00 UTC
References:
 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11704
 https://www.openwall.com/lists/oss-security/2019/06/13/1
 https://bugzilla.mozilla.org/show_bug.cgi?id=1553814
 https://www.mozilla.org/en-US/security/advisories/mfsa2019-17/#CVE-2019-11704
 https://ubuntu.com/security/notices/USN-4028-1
Description:
 A flaw in Thunderbird's implementation of iCal causes a heap buffer
 overflow in icalmemory_strdup_and_dequote when processing certain email
 messages, resulting in a potentially exploitable crash. This vulnerability
 affects Thunderbird < 60.7.1.
Ubuntu-Description:
Notes:
Bugs:
Priority: medium
Discovered-by:
Assigned-to:
CVSS:
 nvd: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H [9.8 CRITICAL]
 nvd: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H [9.8 CRITICAL]


Patches_thunderbird:
upstream_thunderbird: released (60.7.1)
precise/esm_thunderbird: DNE
trusty_thunderbird: ignored (out of standard support)
trusty/esm_thunderbird: DNE
xenial_thunderbird: released (1:60.7.1+build1-0ubuntu0.16.04.1)
esm-infra/xenial_thunderbird: released (1:60.7.1+build1-0ubuntu0.16.04.1)
bionic_thunderbird: released (1:60.7.1+build1-0ubuntu0.18.04.1)
cosmic_thunderbird: released (1:60.7.1+build1-0ubuntu0.18.10.1)
disco_thunderbird: released (1:60.7.1+build1-0ubuntu0.19.04.1)
devel_thunderbird: released (1:60.7.1+build1-0ubuntu1)