CVE-2018-12385

Source
Severity Medium
Remote No
Type Arbitrary code execution
Description
A security issue has been found in Thunderbird versions prior to 60.2.1. A potentially exploitable crash in TransportSecurityInfo used for SSL can be triggered by data stored in the local cache in the user profile directory. This issue is only exploitable in combination with another vulnerability allowing an attacker to write data into the local cache or from locally installed malware.
Group Package Affected Fixed Severity Status Ticket
AVG-782 thunderbird 60.0-4 60.2.1-1 Critical Fixed FS#60424
Date Advisory Group Package Severity Description
18 Oct 2018 ASA-201810-13 AVG-782 thunderbird Critical multiple issues
References
https://www.mozilla.org/en-US/security/advisories/mfsa2018-25/#CVE-2018-12385
https://bugzilla.mozilla.org/show_bug.cgi?id=1490585