RHSA-2017:1201
Vulnerability from csaf_opensuse - Published: 2017-05-08 00:00 - Updated: 2026-09-20 10:58Summary
security update for thunderbird
Severity
Important
Notes
Title of the patch: security update for thunderbird
Description of the patch: This security update provides a functional equivalent of RHSA-2017:1201.
The original Red Hat(R) advisory is available from the Red Hat web site at
https://access.redhat.com/errata/RHSA-2017:1201.
Patchnames: RHSA-2017:1201
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
9.8 (Critical)
Affected products
Recommended
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Liberty Linux 7:thunderbird-0:52.1.0-1.el7_3.x86_64 | — |
Vendor Fix
|
Threats
Impact
moderate
7.5 (High)
Affected products
Recommended
1 product, the same list as for
CVE-2016-10195
Threats
Impact
moderate
7.5 (High)
Affected products
Recommended
1 product, the same list as for
CVE-2016-10195
Threats
Impact
moderate
9.8 (Critical)
Affected products
Recommended
1 product, the same list as for
CVE-2016-10195
Threats
Impact
moderate
9.8 (Critical)
Affected products
Recommended
1 product, the same list as for
CVE-2016-10195
Threats
Impact
moderate
9.8 (Critical)
Affected products
Recommended
1 product, the same list as for
CVE-2016-10195
Threats
Impact
moderate
9.8 (Critical)
Affected products
Recommended
1 product, the same list as for
CVE-2016-10195
Threats
Impact
moderate
9.8 (Critical)
Affected products
Recommended
1 product, the same list as for
CVE-2016-10195
Threats
Impact
moderate
8.8 (High)
Affected products
Recommended
1 product, the same list as for
CVE-2016-10195
Threats
Impact
moderate
9.8 (Critical)
Affected products
Recommended
1 product, the same list as for
CVE-2016-10195
Threats
Impact
moderate
9.8 (Critical)
Affected products
Recommended
1 product, the same list as for
CVE-2016-10195
Threats
Impact
moderate
9.8 (Critical)
Affected products
Recommended
1 product, the same list as for
CVE-2016-10195
Threats
Impact
moderate
9.8 (Critical)
Affected products
Recommended
1 product, the same list as for
CVE-2016-10195
Threats
Impact
moderate
9.8 (Critical)
Affected products
Recommended
1 product, the same list as for
CVE-2016-10195
Threats
Impact
moderate
9.8 (Critical)
Affected products
Recommended
1 product, the same list as for
CVE-2016-10195
Threats
Impact
moderate
7.5 (High)
Affected products
Recommended
1 product, the same list as for
CVE-2016-10195
Threats
Impact
moderate
7.5 (High)
Affected products
Recommended
1 product, the same list as for
CVE-2016-10195
Threats
Impact
moderate
9.8 (Critical)
Affected products
Recommended
1 product, the same list as for
CVE-2016-10195
Threats
Impact
moderate
9.1 (Critical)
Affected products
Recommended
1 product, the same list as for
CVE-2016-10195
Threats
Impact
moderate
7.5 (High)
Affected products
Recommended
1 product, the same list as for
CVE-2016-10195
Threats
Impact
moderate
4.3 (Medium)
Affected products
Recommended
1 product, the same list as for
CVE-2016-10195
Threats
Impact
moderate
7.5 (High)
Affected products
Recommended
1 product, the same list as for
CVE-2016-10195
Threats
Impact
low
9.8 (Critical)
Affected products
Recommended
1 product, the same list as for
CVE-2016-10195
Threats
Impact
moderate
9.8 (Critical)
Affected products
Recommended
1 product, the same list as for
CVE-2016-10195
Threats
Impact
moderate
9.8 (Critical)
Affected products
Recommended
1 product, the same list as for
CVE-2016-10195
Threats
Impact
moderate
9.1 (Critical)
Affected products
Recommended
1 product, the same list as for
CVE-2016-10195
Threats
Impact
moderate
6.1 (Medium)
Affected products
Recommended
1 product, the same list as for
CVE-2016-10195
Threats
Impact
moderate
7.5 (High)
Affected products
Recommended
1 product, the same list as for
CVE-2016-10195
Threats
Impact
moderate
9.8 (Critical)
Affected products
Recommended
1 product, the same list as for
CVE-2016-10195
Threats
Impact
moderate
References
126 references
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "security update for thunderbird",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This security update provides a functional equivalent of RHSA-2017:1201.\nThe original Red Hat(R) advisory is available from the Red Hat web site at\nhttps://access.redhat.com/errata/RHSA-2017:1201.\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "RHSA-2017:1201",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/rhsa-2017_1201.json"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2016-10195 page",
"url": "https://www.suse.com/security/cve/CVE-2016-10195/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2016-10196 page",
"url": "https://www.suse.com/security/cve/CVE-2016-10196/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2016-10197 page",
"url": "https://www.suse.com/security/cve/CVE-2016-10197/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2017-5429 page",
"url": "https://www.suse.com/security/cve/CVE-2017-5429/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2017-5432 page",
"url": "https://www.suse.com/security/cve/CVE-2017-5432/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2017-5433 page",
"url": "https://www.suse.com/security/cve/CVE-2017-5433/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2017-5434 page",
"url": "https://www.suse.com/security/cve/CVE-2017-5434/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2017-5435 page",
"url": "https://www.suse.com/security/cve/CVE-2017-5435/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2017-5436 page",
"url": "https://www.suse.com/security/cve/CVE-2017-5436/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2017-5438 page",
"url": "https://www.suse.com/security/cve/CVE-2017-5438/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2017-5439 page",
"url": "https://www.suse.com/security/cve/CVE-2017-5439/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2017-5440 page",
"url": "https://www.suse.com/security/cve/CVE-2017-5440/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2017-5441 page",
"url": "https://www.suse.com/security/cve/CVE-2017-5441/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2017-5442 page",
"url": "https://www.suse.com/security/cve/CVE-2017-5442/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2017-5443 page",
"url": "https://www.suse.com/security/cve/CVE-2017-5443/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2017-5444 page",
"url": "https://www.suse.com/security/cve/CVE-2017-5444/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2017-5445 page",
"url": "https://www.suse.com/security/cve/CVE-2017-5445/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2017-5446 page",
"url": "https://www.suse.com/security/cve/CVE-2017-5446/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2017-5447 page",
"url": "https://www.suse.com/security/cve/CVE-2017-5447/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2017-5449 page",
"url": "https://www.suse.com/security/cve/CVE-2017-5449/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2017-5451 page",
"url": "https://www.suse.com/security/cve/CVE-2017-5451/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2017-5454 page",
"url": "https://www.suse.com/security/cve/CVE-2017-5454/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2017-5459 page",
"url": "https://www.suse.com/security/cve/CVE-2017-5459/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2017-5460 page",
"url": "https://www.suse.com/security/cve/CVE-2017-5460/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2017-5464 page",
"url": "https://www.suse.com/security/cve/CVE-2017-5464/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2017-5465 page",
"url": "https://www.suse.com/security/cve/CVE-2017-5465/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2017-5466 page",
"url": "https://www.suse.com/security/cve/CVE-2017-5466/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2017-5467 page",
"url": "https://www.suse.com/security/cve/CVE-2017-5467/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2017-5469 page",
"url": "https://www.suse.com/security/cve/CVE-2017-5469/"
}
],
"title": "security update for thunderbird",
"tracking": {
"current_release_date": "2026-09-20T10:58:34Z",
"generator": {
"date": "2017-05-08T00:00:00Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "RHSA-2017:1201",
"initial_release_date": "2017-05-08T00:00:00Z",
"revision_history": [
{
"date": "2017-05-08T00:00:00Z",
"number": "1",
"summary": "Current version"
},
{
"date": "2026-09-20T10:58:34Z",
"number": "2",
"summary": "unknown changes"
}
],
"status": "final",
"version": "2"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "thunderbird-0:52.1.0-1.el7_3.x86_64",
"product": {
"name": "thunderbird-0:52.1.0-1.el7_3.x86_64",
"product_id": "thunderbird-0:52.1.0-1.el7_3.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/suse/thunderbird@52.1.0-1.el7_3?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Liberty Linux 7",
"product": {
"name": "SUSE Liberty Linux 7",
"product_id": "SUSE Liberty Linux 7",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sll:7"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "thunderbird-0:52.1.0-1.el7_3.x86_64 as component of SUSE Liberty Linux 7",
"product_id": "SUSE Liberty Linux 7:thunderbird-0:52.1.0-1.el7_3.x86_64"
},
"product_reference": "thunderbird-0:52.1.0-1.el7_3.x86_64",
"relates_to_product_reference": "SUSE Liberty Linux 7"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2016-10195",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2016-10195"
}
],
"notes": [
{
"category": "general",
"text": "The name_parse function in evdns.c in libevent before 2.1.6-beta allows remote attackers to have unspecified impact via vectors involving the label_len variable, which triggers an out-of-bounds stack read.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 7:thunderbird-0:52.1.0-1.el7_3.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2016-10195",
"url": "https://www.suse.com/security/cve/CVE-2016-10195"
},
{
"category": "external",
"summary": "SUSE Bug 1022917 for CVE-2016-10195",
"url": "https://bugzilla.suse.com/1022917"
},
{
"category": "external",
"summary": "SUSE Bug 1035082 for CVE-2016-10195",
"url": "https://bugzilla.suse.com/1035082"
},
{
"category": "external",
"summary": "SUSE Bug 1035209 for CVE-2016-10195",
"url": "https://bugzilla.suse.com/1035209"
},
{
"category": "external",
"summary": "SUSE Bug 1075618 for CVE-2016-10195",
"url": "https://bugzilla.suse.com/1075618"
},
{
"category": "external",
"summary": "SUSE Bug 1123122 for CVE-2016-10195",
"url": "https://bugzilla.suse.com/1123122"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 7:thunderbird-0:52.1.0-1.el7_3.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Liberty Linux 7:thunderbird-0:52.1.0-1.el7_3.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2017-05-08T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2016-10195"
},
{
"cve": "CVE-2016-10196",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2016-10196"
}
],
"notes": [
{
"category": "general",
"text": "Stack-based buffer overflow in the evutil_parse_sockaddr_port function in evutil.c in libevent before 2.1.6-beta allows attackers to cause a denial of service (segmentation fault) via vectors involving a long string in brackets in the ip_as_string argument.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 7:thunderbird-0:52.1.0-1.el7_3.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2016-10196",
"url": "https://www.suse.com/security/cve/CVE-2016-10196"
},
{
"category": "external",
"summary": "SUSE Bug 1022918 for CVE-2016-10196",
"url": "https://bugzilla.suse.com/1022918"
},
{
"category": "external",
"summary": "SUSE Bug 1035082 for CVE-2016-10196",
"url": "https://bugzilla.suse.com/1035082"
},
{
"category": "external",
"summary": "SUSE Bug 1035209 for CVE-2016-10196",
"url": "https://bugzilla.suse.com/1035209"
},
{
"category": "external",
"summary": "SUSE Bug 1075618 for CVE-2016-10196",
"url": "https://bugzilla.suse.com/1075618"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 7:thunderbird-0:52.1.0-1.el7_3.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Liberty Linux 7:thunderbird-0:52.1.0-1.el7_3.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2017-05-08T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2016-10196"
},
{
"cve": "CVE-2016-10197",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2016-10197"
}
],
"notes": [
{
"category": "general",
"text": "The search_make_new function in evdns.c in libevent before 2.1.6-beta allows attackers to cause a denial of service (out-of-bounds read) via an empty hostname.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 7:thunderbird-0:52.1.0-1.el7_3.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2016-10197",
"url": "https://www.suse.com/security/cve/CVE-2016-10197"
},
{
"category": "external",
"summary": "SUSE Bug 1022919 for CVE-2016-10197",
"url": "https://bugzilla.suse.com/1022919"
},
{
"category": "external",
"summary": "SUSE Bug 1035082 for CVE-2016-10197",
"url": "https://bugzilla.suse.com/1035082"
},
{
"category": "external",
"summary": "SUSE Bug 1035209 for CVE-2016-10197",
"url": "https://bugzilla.suse.com/1035209"
},
{
"category": "external",
"summary": "SUSE Bug 1075618 for CVE-2016-10197",
"url": "https://bugzilla.suse.com/1075618"
},
{
"category": "external",
"summary": "SUSE Bug 1123122 for CVE-2016-10197",
"url": "https://bugzilla.suse.com/1123122"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 7:thunderbird-0:52.1.0-1.el7_3.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Liberty Linux 7:thunderbird-0:52.1.0-1.el7_3.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2017-05-08T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2016-10197"
},
{
"cve": "CVE-2017-5429",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2017-5429"
}
],
"notes": [
{
"category": "general",
"text": "Memory safety bugs were reported in Firefox 52, Firefox ESR 45.8, Firefox ESR 52, and Thunderbird 52. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Thunderbird \u003c 52.1, Firefox ESR \u003c 45.9, Firefox ESR \u003c 52.1, and Firefox \u003c 53.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 7:thunderbird-0:52.1.0-1.el7_3.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2017-5429",
"url": "https://www.suse.com/security/cve/CVE-2017-5429"
},
{
"category": "external",
"summary": "SUSE Bug 1035082 for CVE-2017-5429",
"url": "https://bugzilla.suse.com/1035082"
},
{
"category": "external",
"summary": "SUSE Bug 1035209 for CVE-2017-5429",
"url": "https://bugzilla.suse.com/1035209"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 7:thunderbird-0:52.1.0-1.el7_3.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"SUSE Liberty Linux 7:thunderbird-0:52.1.0-1.el7_3.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2017-05-08T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2017-5429"
},
{
"cve": "CVE-2017-5432",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2017-5432"
}
],
"notes": [
{
"category": "general",
"text": "A use-after-free vulnerability occurs during certain text input selection resulting in a potentially exploitable crash. This vulnerability affects Thunderbird \u003c 52.1, Firefox ESR \u003c 45.9, Firefox ESR \u003c 52.1, and Firefox \u003c 53.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 7:thunderbird-0:52.1.0-1.el7_3.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2017-5432",
"url": "https://www.suse.com/security/cve/CVE-2017-5432"
},
{
"category": "external",
"summary": "SUSE Bug 1035082 for CVE-2017-5432",
"url": "https://bugzilla.suse.com/1035082"
},
{
"category": "external",
"summary": "SUSE Bug 1035209 for CVE-2017-5432",
"url": "https://bugzilla.suse.com/1035209"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 7:thunderbird-0:52.1.0-1.el7_3.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"SUSE Liberty Linux 7:thunderbird-0:52.1.0-1.el7_3.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2017-05-08T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2017-5432"
},
{
"cve": "CVE-2017-5433",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2017-5433"
}
],
"notes": [
{
"category": "general",
"text": "A use-after-free vulnerability in SMIL animation functions occurs when pointers to animation elements in an array are dropped from the animation controller while still in use. This results in a potentially exploitable crash. This vulnerability affects Thunderbird \u003c 52.1, Firefox ESR \u003c 45.9, Firefox ESR \u003c 52.1, and Firefox \u003c 53.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 7:thunderbird-0:52.1.0-1.el7_3.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2017-5433",
"url": "https://www.suse.com/security/cve/CVE-2017-5433"
},
{
"category": "external",
"summary": "SUSE Bug 1035082 for CVE-2017-5433",
"url": "https://bugzilla.suse.com/1035082"
},
{
"category": "external",
"summary": "SUSE Bug 1035209 for CVE-2017-5433",
"url": "https://bugzilla.suse.com/1035209"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 7:thunderbird-0:52.1.0-1.el7_3.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"SUSE Liberty Linux 7:thunderbird-0:52.1.0-1.el7_3.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2017-05-08T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2017-5433"
},
{
"cve": "CVE-2017-5434",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2017-5434"
}
],
"notes": [
{
"category": "general",
"text": "A use-after-free vulnerability occurs when redirecting focus handling which results in a potentially exploitable crash. This vulnerability affects Thunderbird \u003c 52.1, Firefox ESR \u003c 45.9, Firefox ESR \u003c 52.1, and Firefox \u003c 53.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 7:thunderbird-0:52.1.0-1.el7_3.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2017-5434",
"url": "https://www.suse.com/security/cve/CVE-2017-5434"
},
{
"category": "external",
"summary": "SUSE Bug 1035082 for CVE-2017-5434",
"url": "https://bugzilla.suse.com/1035082"
},
{
"category": "external",
"summary": "SUSE Bug 1035209 for CVE-2017-5434",
"url": "https://bugzilla.suse.com/1035209"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 7:thunderbird-0:52.1.0-1.el7_3.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"SUSE Liberty Linux 7:thunderbird-0:52.1.0-1.el7_3.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2017-05-08T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2017-5434"
},
{
"cve": "CVE-2017-5435",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2017-5435"
}
],
"notes": [
{
"category": "general",
"text": "A use-after-free vulnerability occurs during transaction processing in the editor during design mode interactions. This results in a potentially exploitable crash. This vulnerability affects Thunderbird \u003c 52.1, Firefox ESR \u003c 45.9, Firefox ESR \u003c 52.1, and Firefox \u003c 53.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 7:thunderbird-0:52.1.0-1.el7_3.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2017-5435",
"url": "https://www.suse.com/security/cve/CVE-2017-5435"
},
{
"category": "external",
"summary": "SUSE Bug 1035082 for CVE-2017-5435",
"url": "https://bugzilla.suse.com/1035082"
},
{
"category": "external",
"summary": "SUSE Bug 1035209 for CVE-2017-5435",
"url": "https://bugzilla.suse.com/1035209"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 7:thunderbird-0:52.1.0-1.el7_3.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"SUSE Liberty Linux 7:thunderbird-0:52.1.0-1.el7_3.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2017-05-08T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2017-5435"
},
{
"cve": "CVE-2017-5436",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2017-5436"
}
],
"notes": [
{
"category": "general",
"text": "An out-of-bounds write in the Graphite 2 library triggered with a maliciously crafted Graphite font. This results in a potentially exploitable crash. This issue was fixed in the Graphite 2 library as well as Mozilla products. This vulnerability affects Thunderbird \u003c 52.1, Firefox ESR \u003c 45.9, Firefox ESR \u003c 52.1, and Firefox \u003c 53.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 7:thunderbird-0:52.1.0-1.el7_3.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2017-5436",
"url": "https://www.suse.com/security/cve/CVE-2017-5436"
},
{
"category": "external",
"summary": "SUSE Bug 1035082 for CVE-2017-5436",
"url": "https://bugzilla.suse.com/1035082"
},
{
"category": "external",
"summary": "SUSE Bug 1035204 for CVE-2017-5436",
"url": "https://bugzilla.suse.com/1035204"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 7:thunderbird-0:52.1.0-1.el7_3.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"SUSE Liberty Linux 7:thunderbird-0:52.1.0-1.el7_3.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2017-05-08T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2017-5436"
},
{
"cve": "CVE-2017-5438",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2017-5438"
}
],
"notes": [
{
"category": "general",
"text": "A use-after-free vulnerability during XSLT processing due to the result handler being held by a freed handler during handling. This results in a potentially exploitable crash. This vulnerability affects Thunderbird \u003c 52.1, Firefox ESR \u003c 45.9, Firefox ESR \u003c 52.1, and Firefox \u003c 53.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 7:thunderbird-0:52.1.0-1.el7_3.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2017-5438",
"url": "https://www.suse.com/security/cve/CVE-2017-5438"
},
{
"category": "external",
"summary": "SUSE Bug 1035082 for CVE-2017-5438",
"url": "https://bugzilla.suse.com/1035082"
},
{
"category": "external",
"summary": "SUSE Bug 1035209 for CVE-2017-5438",
"url": "https://bugzilla.suse.com/1035209"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 7:thunderbird-0:52.1.0-1.el7_3.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"SUSE Liberty Linux 7:thunderbird-0:52.1.0-1.el7_3.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2017-05-08T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2017-5438"
},
{
"cve": "CVE-2017-5439",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2017-5439"
}
],
"notes": [
{
"category": "general",
"text": "A use-after-free vulnerability during XSLT processing due to poor handling of template parameters. This results in a potentially exploitable crash. This vulnerability affects Thunderbird \u003c 52.1, Firefox ESR \u003c 45.9, Firefox ESR \u003c 52.1, and Firefox \u003c 53.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 7:thunderbird-0:52.1.0-1.el7_3.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2017-5439",
"url": "https://www.suse.com/security/cve/CVE-2017-5439"
},
{
"category": "external",
"summary": "SUSE Bug 1035082 for CVE-2017-5439",
"url": "https://bugzilla.suse.com/1035082"
},
{
"category": "external",
"summary": "SUSE Bug 1035209 for CVE-2017-5439",
"url": "https://bugzilla.suse.com/1035209"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 7:thunderbird-0:52.1.0-1.el7_3.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"SUSE Liberty Linux 7:thunderbird-0:52.1.0-1.el7_3.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2017-05-08T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2017-5439"
},
{
"cve": "CVE-2017-5440",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2017-5440"
}
],
"notes": [
{
"category": "general",
"text": "A use-after-free vulnerability during XSLT processing due to a failure to propagate error conditions during matching while evaluating context, leading to objects being used when they no longer exist. This results in a potentially exploitable crash. This vulnerability affects Thunderbird \u003c 52.1, Firefox ESR \u003c 45.9, Firefox ESR \u003c 52.1, and Firefox \u003c 53.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 7:thunderbird-0:52.1.0-1.el7_3.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2017-5440",
"url": "https://www.suse.com/security/cve/CVE-2017-5440"
},
{
"category": "external",
"summary": "SUSE Bug 1035082 for CVE-2017-5440",
"url": "https://bugzilla.suse.com/1035082"
},
{
"category": "external",
"summary": "SUSE Bug 1035209 for CVE-2017-5440",
"url": "https://bugzilla.suse.com/1035209"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 7:thunderbird-0:52.1.0-1.el7_3.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"SUSE Liberty Linux 7:thunderbird-0:52.1.0-1.el7_3.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2017-05-08T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2017-5440"
},
{
"cve": "CVE-2017-5441",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2017-5441"
}
],
"notes": [
{
"category": "general",
"text": "A use-after-free vulnerability when holding a selection during scroll events. This results in a potentially exploitable crash. This vulnerability affects Thunderbird \u003c 52.1, Firefox ESR \u003c 45.9, Firefox ESR \u003c 52.1, and Firefox \u003c 53.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 7:thunderbird-0:52.1.0-1.el7_3.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2017-5441",
"url": "https://www.suse.com/security/cve/CVE-2017-5441"
},
{
"category": "external",
"summary": "SUSE Bug 1035082 for CVE-2017-5441",
"url": "https://bugzilla.suse.com/1035082"
},
{
"category": "external",
"summary": "SUSE Bug 1035209 for CVE-2017-5441",
"url": "https://bugzilla.suse.com/1035209"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 7:thunderbird-0:52.1.0-1.el7_3.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"SUSE Liberty Linux 7:thunderbird-0:52.1.0-1.el7_3.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2017-05-08T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2017-5441"
},
{
"cve": "CVE-2017-5442",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2017-5442"
}
],
"notes": [
{
"category": "general",
"text": "A use-after-free vulnerability during changes in style when manipulating DOM elements. This results in a potentially exploitable crash. This vulnerability affects Thunderbird \u003c 52.1, Firefox ESR \u003c 45.9, Firefox ESR \u003c 52.1, and Firefox \u003c 53.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 7:thunderbird-0:52.1.0-1.el7_3.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2017-5442",
"url": "https://www.suse.com/security/cve/CVE-2017-5442"
},
{
"category": "external",
"summary": "SUSE Bug 1035082 for CVE-2017-5442",
"url": "https://bugzilla.suse.com/1035082"
},
{
"category": "external",
"summary": "SUSE Bug 1035209 for CVE-2017-5442",
"url": "https://bugzilla.suse.com/1035209"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 7:thunderbird-0:52.1.0-1.el7_3.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"SUSE Liberty Linux 7:thunderbird-0:52.1.0-1.el7_3.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2017-05-08T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2017-5442"
},
{
"cve": "CVE-2017-5443",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2017-5443"
}
],
"notes": [
{
"category": "general",
"text": "An out-of-bounds write vulnerability while decoding improperly formed BinHex format archives. This vulnerability affects Thunderbird \u003c 52.1, Firefox ESR \u003c 45.9, Firefox ESR \u003c 52.1, and Firefox \u003c 53.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 7:thunderbird-0:52.1.0-1.el7_3.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2017-5443",
"url": "https://www.suse.com/security/cve/CVE-2017-5443"
},
{
"category": "external",
"summary": "SUSE Bug 1035082 for CVE-2017-5443",
"url": "https://bugzilla.suse.com/1035082"
},
{
"category": "external",
"summary": "SUSE Bug 1035209 for CVE-2017-5443",
"url": "https://bugzilla.suse.com/1035209"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 7:thunderbird-0:52.1.0-1.el7_3.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"SUSE Liberty Linux 7:thunderbird-0:52.1.0-1.el7_3.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2017-05-08T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2017-5443"
},
{
"cve": "CVE-2017-5444",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2017-5444"
}
],
"notes": [
{
"category": "general",
"text": "A buffer overflow vulnerability while parsing \"application/http-index-format\" format content when the header contains improperly formatted data. This allows for an out-of-bounds read of data from memory. This vulnerability affects Thunderbird \u003c 52.1, Firefox ESR \u003c 45.9, Firefox ESR \u003c 52.1, and Firefox \u003c 53.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 7:thunderbird-0:52.1.0-1.el7_3.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2017-5444",
"url": "https://www.suse.com/security/cve/CVE-2017-5444"
},
{
"category": "external",
"summary": "SUSE Bug 1035082 for CVE-2017-5444",
"url": "https://bugzilla.suse.com/1035082"
},
{
"category": "external",
"summary": "SUSE Bug 1035209 for CVE-2017-5444",
"url": "https://bugzilla.suse.com/1035209"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 7:thunderbird-0:52.1.0-1.el7_3.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.0"
},
"products": [
"SUSE Liberty Linux 7:thunderbird-0:52.1.0-1.el7_3.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2017-05-08T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2017-5444"
},
{
"cve": "CVE-2017-5445",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2017-5445"
}
],
"notes": [
{
"category": "general",
"text": "A vulnerability while parsing \"application/http-index-format\" format content where uninitialized values are used to create an array. This could allow the reading of uninitialized memory into the arrays affected. This vulnerability affects Thunderbird \u003c 52.1, Firefox ESR \u003c 45.9, Firefox ESR \u003c 52.1, and Firefox \u003c 53.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 7:thunderbird-0:52.1.0-1.el7_3.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2017-5445",
"url": "https://www.suse.com/security/cve/CVE-2017-5445"
},
{
"category": "external",
"summary": "SUSE Bug 1035082 for CVE-2017-5445",
"url": "https://bugzilla.suse.com/1035082"
},
{
"category": "external",
"summary": "SUSE Bug 1035209 for CVE-2017-5445",
"url": "https://bugzilla.suse.com/1035209"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 7:thunderbird-0:52.1.0-1.el7_3.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.0"
},
"products": [
"SUSE Liberty Linux 7:thunderbird-0:52.1.0-1.el7_3.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2017-05-08T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2017-5445"
},
{
"cve": "CVE-2017-5446",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2017-5446"
}
],
"notes": [
{
"category": "general",
"text": "An out-of-bounds read when an HTTP/2 connection to a servers sends \"DATA\" frames with incorrect data content. This leads to a potentially exploitable crash. This vulnerability affects Thunderbird \u003c 52.1, Firefox ESR \u003c 45.9, Firefox ESR \u003c 52.1, and Firefox \u003c 53.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 7:thunderbird-0:52.1.0-1.el7_3.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2017-5446",
"url": "https://www.suse.com/security/cve/CVE-2017-5446"
},
{
"category": "external",
"summary": "SUSE Bug 1035082 for CVE-2017-5446",
"url": "https://bugzilla.suse.com/1035082"
},
{
"category": "external",
"summary": "SUSE Bug 1035209 for CVE-2017-5446",
"url": "https://bugzilla.suse.com/1035209"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 7:thunderbird-0:52.1.0-1.el7_3.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"SUSE Liberty Linux 7:thunderbird-0:52.1.0-1.el7_3.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2017-05-08T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2017-5446"
},
{
"cve": "CVE-2017-5447",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2017-5447"
}
],
"notes": [
{
"category": "general",
"text": "An out-of-bounds read during the processing of glyph widths during text layout. This results in a potentially exploitable crash and could allow an attacker to read otherwise inaccessible memory. This vulnerability affects Thunderbird \u003c 52.1, Firefox ESR \u003c 45.9, Firefox ESR \u003c 52.1, and Firefox \u003c 53.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 7:thunderbird-0:52.1.0-1.el7_3.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2017-5447",
"url": "https://www.suse.com/security/cve/CVE-2017-5447"
},
{
"category": "external",
"summary": "SUSE Bug 1035082 for CVE-2017-5447",
"url": "https://bugzilla.suse.com/1035082"
},
{
"category": "external",
"summary": "SUSE Bug 1035209 for CVE-2017-5447",
"url": "https://bugzilla.suse.com/1035209"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 7:thunderbird-0:52.1.0-1.el7_3.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"version": "3.0"
},
"products": [
"SUSE Liberty Linux 7:thunderbird-0:52.1.0-1.el7_3.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2017-05-08T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2017-5447"
},
{
"cve": "CVE-2017-5449",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2017-5449"
}
],
"notes": [
{
"category": "general",
"text": "A possibly exploitable crash triggered during layout and manipulation of bidirectional unicode text in concert with CSS animations. This vulnerability affects Thunderbird \u003c 52.1, Firefox ESR \u003c 52.1, and Firefox \u003c 53.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 7:thunderbird-0:52.1.0-1.el7_3.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2017-5449",
"url": "https://www.suse.com/security/cve/CVE-2017-5449"
},
{
"category": "external",
"summary": "SUSE Bug 1035082 for CVE-2017-5449",
"url": "https://bugzilla.suse.com/1035082"
},
{
"category": "external",
"summary": "SUSE Bug 1035209 for CVE-2017-5449",
"url": "https://bugzilla.suse.com/1035209"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 7:thunderbird-0:52.1.0-1.el7_3.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
},
"products": [
"SUSE Liberty Linux 7:thunderbird-0:52.1.0-1.el7_3.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2017-05-08T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2017-5449"
},
{
"cve": "CVE-2017-5451",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2017-5451"
}
],
"notes": [
{
"category": "general",
"text": "A mechanism to spoof the addressbar through the user interaction on the addressbar and the \"onblur\" event. The event could be used by script to affect text display to make the loaded site appear to be different from the one actually loaded within the addressbar. This vulnerability affects Thunderbird \u003c 52.1, Firefox ESR \u003c 52.1, and Firefox \u003c 53.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 7:thunderbird-0:52.1.0-1.el7_3.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2017-5451",
"url": "https://www.suse.com/security/cve/CVE-2017-5451"
},
{
"category": "external",
"summary": "SUSE Bug 1035082 for CVE-2017-5451",
"url": "https://bugzilla.suse.com/1035082"
},
{
"category": "external",
"summary": "SUSE Bug 1035209 for CVE-2017-5451",
"url": "https://bugzilla.suse.com/1035209"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 7:thunderbird-0:52.1.0-1.el7_3.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
"version": "3.0"
},
"products": [
"SUSE Liberty Linux 7:thunderbird-0:52.1.0-1.el7_3.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2017-05-08T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2017-5451"
},
{
"cve": "CVE-2017-5454",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2017-5454"
}
],
"notes": [
{
"category": "general",
"text": "A mechanism to bypass file system access protections in the sandbox to use the file picker to access different files than those selected in the file picker through the use of relative paths. This allows for read only access to the local file system. This vulnerability affects Thunderbird \u003c 52.1, Firefox ESR \u003c 52.1, and Firefox \u003c 53.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 7:thunderbird-0:52.1.0-1.el7_3.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2017-5454",
"url": "https://www.suse.com/security/cve/CVE-2017-5454"
},
{
"category": "external",
"summary": "SUSE Bug 1035082 for CVE-2017-5454",
"url": "https://bugzilla.suse.com/1035082"
},
{
"category": "external",
"summary": "SUSE Bug 1035209 for CVE-2017-5454",
"url": "https://bugzilla.suse.com/1035209"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 7:thunderbird-0:52.1.0-1.el7_3.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.0"
},
"products": [
"SUSE Liberty Linux 7:thunderbird-0:52.1.0-1.el7_3.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2017-05-08T00:00:00Z",
"details": "low"
}
],
"title": "CVE-2017-5454"
},
{
"cve": "CVE-2017-5459",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2017-5459"
}
],
"notes": [
{
"category": "general",
"text": "A buffer overflow in WebGL triggerable by web content, resulting in a potentially exploitable crash. This vulnerability affects Thunderbird \u003c 52.1, Firefox ESR \u003c 45.9, Firefox ESR \u003c 52.1, and Firefox \u003c 53.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 7:thunderbird-0:52.1.0-1.el7_3.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2017-5459",
"url": "https://www.suse.com/security/cve/CVE-2017-5459"
},
{
"category": "external",
"summary": "SUSE Bug 1035082 for CVE-2017-5459",
"url": "https://bugzilla.suse.com/1035082"
},
{
"category": "external",
"summary": "SUSE Bug 1035209 for CVE-2017-5459",
"url": "https://bugzilla.suse.com/1035209"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 7:thunderbird-0:52.1.0-1.el7_3.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"SUSE Liberty Linux 7:thunderbird-0:52.1.0-1.el7_3.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2017-05-08T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2017-5459"
},
{
"cve": "CVE-2017-5460",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2017-5460"
}
],
"notes": [
{
"category": "general",
"text": "A use-after-free vulnerability in frame selection triggered by a combination of malicious script content and key presses by a user. This results in a potentially exploitable crash. This vulnerability affects Thunderbird \u003c 52.1, Firefox ESR \u003c 45.9, Firefox ESR \u003c 52.1, and Firefox \u003c 53.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 7:thunderbird-0:52.1.0-1.el7_3.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2017-5460",
"url": "https://www.suse.com/security/cve/CVE-2017-5460"
},
{
"category": "external",
"summary": "SUSE Bug 1035082 for CVE-2017-5460",
"url": "https://bugzilla.suse.com/1035082"
},
{
"category": "external",
"summary": "SUSE Bug 1035209 for CVE-2017-5460",
"url": "https://bugzilla.suse.com/1035209"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 7:thunderbird-0:52.1.0-1.el7_3.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"SUSE Liberty Linux 7:thunderbird-0:52.1.0-1.el7_3.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2017-05-08T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2017-5460"
},
{
"cve": "CVE-2017-5464",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2017-5464"
}
],
"notes": [
{
"category": "general",
"text": "During DOM manipulations of the accessibility tree through script, the DOM tree can become out of sync with the accessibility tree, leading to memory corruption and a potentially exploitable crash. This vulnerability affects Thunderbird \u003c 52.1, Firefox ESR \u003c 45.9, Firefox ESR \u003c 52.1, and Firefox \u003c 53.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 7:thunderbird-0:52.1.0-1.el7_3.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2017-5464",
"url": "https://www.suse.com/security/cve/CVE-2017-5464"
},
{
"category": "external",
"summary": "SUSE Bug 1035082 for CVE-2017-5464",
"url": "https://bugzilla.suse.com/1035082"
},
{
"category": "external",
"summary": "SUSE Bug 1035209 for CVE-2017-5464",
"url": "https://bugzilla.suse.com/1035209"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 7:thunderbird-0:52.1.0-1.el7_3.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"SUSE Liberty Linux 7:thunderbird-0:52.1.0-1.el7_3.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2017-05-08T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2017-5464"
},
{
"cve": "CVE-2017-5465",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2017-5465"
}
],
"notes": [
{
"category": "general",
"text": "An out-of-bounds read while processing SVG content in \"ConvolvePixel\". This results in a crash and also allows for otherwise inaccessible memory being copied into SVG graphic content, which could then displayed. This vulnerability affects Thunderbird \u003c 52.1, Firefox ESR \u003c 45.9, Firefox ESR \u003c 52.1, and Firefox \u003c 53.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 7:thunderbird-0:52.1.0-1.el7_3.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2017-5465",
"url": "https://www.suse.com/security/cve/CVE-2017-5465"
},
{
"category": "external",
"summary": "SUSE Bug 1035082 for CVE-2017-5465",
"url": "https://bugzilla.suse.com/1035082"
},
{
"category": "external",
"summary": "SUSE Bug 1035209 for CVE-2017-5465",
"url": "https://bugzilla.suse.com/1035209"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 7:thunderbird-0:52.1.0-1.el7_3.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"version": "3.0"
},
"products": [
"SUSE Liberty Linux 7:thunderbird-0:52.1.0-1.el7_3.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2017-05-08T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2017-5465"
},
{
"cve": "CVE-2017-5466",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2017-5466"
}
],
"notes": [
{
"category": "general",
"text": "If a page is loaded from an original site through a hyperlink and contains a redirect to a \"data:text/html\" URL, triggering a reload will run the reloaded \"data:text/html\" page with its origin set incorrectly. This allows for a cross-site scripting (XSS) attack. This vulnerability affects Thunderbird \u003c 52.1, Firefox ESR \u003c 52.1, and Firefox \u003c 53.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 7:thunderbird-0:52.1.0-1.el7_3.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2017-5466",
"url": "https://www.suse.com/security/cve/CVE-2017-5466"
},
{
"category": "external",
"summary": "SUSE Bug 1035082 for CVE-2017-5466",
"url": "https://bugzilla.suse.com/1035082"
},
{
"category": "external",
"summary": "SUSE Bug 1035209 for CVE-2017-5466",
"url": "https://bugzilla.suse.com/1035209"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 7:thunderbird-0:52.1.0-1.el7_3.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"products": [
"SUSE Liberty Linux 7:thunderbird-0:52.1.0-1.el7_3.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2017-05-08T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2017-5466"
},
{
"cve": "CVE-2017-5467",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2017-5467"
}
],
"notes": [
{
"category": "general",
"text": "A potential memory corruption and crash when using Skia content when drawing content outside of the bounds of a clipping region. This vulnerability affects Thunderbird \u003c 52.1, Firefox ESR \u003c 52.1, and Firefox \u003c 53.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 7:thunderbird-0:52.1.0-1.el7_3.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2017-5467",
"url": "https://www.suse.com/security/cve/CVE-2017-5467"
},
{
"category": "external",
"summary": "SUSE Bug 1035082 for CVE-2017-5467",
"url": "https://bugzilla.suse.com/1035082"
},
{
"category": "external",
"summary": "SUSE Bug 1035209 for CVE-2017-5467",
"url": "https://bugzilla.suse.com/1035209"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 7:thunderbird-0:52.1.0-1.el7_3.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
},
"products": [
"SUSE Liberty Linux 7:thunderbird-0:52.1.0-1.el7_3.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2017-05-08T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2017-5467"
},
{
"cve": "CVE-2017-5469",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2017-5469"
}
],
"notes": [
{
"category": "general",
"text": "Fixed potential buffer overflows in generated Firefox code due to CVE-2016-6354 issue in Flex. This vulnerability affects Thunderbird \u003c 52.1, Firefox ESR \u003c 45.9, Firefox ESR \u003c 52.1, and Firefox \u003c 53.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 7:thunderbird-0:52.1.0-1.el7_3.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2017-5469",
"url": "https://www.suse.com/security/cve/CVE-2017-5469"
},
{
"category": "external",
"summary": "SUSE Bug 1035082 for CVE-2017-5469",
"url": "https://bugzilla.suse.com/1035082"
},
{
"category": "external",
"summary": "SUSE Bug 1035209 for CVE-2017-5469",
"url": "https://bugzilla.suse.com/1035209"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 7:thunderbird-0:52.1.0-1.el7_3.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"SUSE Liberty Linux 7:thunderbird-0:52.1.0-1.el7_3.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2017-05-08T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2017-5469"
}
]
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…