Mozilla, Google patch security issues in Thunderbird and Chrome

News by Doug Olenick

The move follows the security update of Chrome and Firexox in January

The Mozilla Foundation and Google released "high" rated security updates for Thunderbird and Chrome, respectively.

The high-rated Thunderbird vulnerabilities patched in version 60.7.1 are CVE-2019-11703 and CVE-2017-11704 concern a heep buffer overflow in icalparser.c and another in Icalfvalue.c. The former flaw can cause a flaw in Thunderbird’s implementation of iCal causes a heap buffer overflow in parser_get_next_char, while the second has the same problem but in icalmemory_strdup_and_dequote. In each case processing certain email messages can in a potentially exploitable crash.

The low-rated CVE-2019-11705 is for a type confusion in icalproperty.c due to Thunderbird’s implementation of iCal can cause a type confusion in icaltimezone_get_vtimezone_properties when processing certain email messages, resulting in a crash.

The Chrome stable channel has been updated to 75.0.3770.90 that covers CVE-2019-5842, a Use-after-free in Blink, for Windows, Mac, and Linux. As per Google’s normal policy it has not released any further details on the bug.

Both companies did a major patch-fixing move in January. Chrome version 72 fixed 58 flaws with the software, while Mozilla's 65th update to Firefox fixed seven flaws.

This article was originally published on SC Media US.

Find this article useful?

Get more great articles like this in your inbox every lunchtime

Video and interviews

Interview - Everyone has an Achilles heel: The new security paradigm

How can we defend networks now that the perimeter has all but disappeared?
Brought to you in partnership with ExtraHop