Thunderbird 68.7 is available!

Thunderbird version 68.7.0, first offered to channel users on April 8, 2020 is now available to Ubuntu users.

In the release notes we can read what is new, changed and fixed.

Below is the Ubuntu Security Notice USN-4328-1

A security issue affects these releases of Ubuntu and
its derivatives:

- Ubuntu 19.10
- Ubuntu 18.04 LTS

Summary:

Several security issues were fixed in Thunderbird.

Software Description:
- thunderbird: Mozilla Open Source mail and newsgroup
  client

Details:

It was discovered that Message ID calculation was
based on uninitialized data. An attacker could
potentially exploit this to obtain sensitive
information. (CVE-2020-6792)

Mutiple security issues were discovered in
Thunderbird. If a user were tricked in to opening
a specially crafted message, an attacker could
potentially exploit these to cause a denial of
service, obtain sensitive information, or execute
arbitrary code. (CVE-2020-6793, CVE-2020-6795,
CVE-2020-6822)

It was discovered that if a user saved passwords
before Thunderbird 60 and then later set a master
password, an unencrypted copy of these passwords
would still be accessible. A local user could
exploit this to obtain sensitive information.
(CVE-2020-6794)

Multiple security issues were discovered in
Thunderbird. If a user were tricked in to opening a
specially crafted website in a browsing context, an
attacker could potentially exploit these to cause a
denial of service, conduct cross-site scripting (XSS)
attacks, obtain sensitive information, or execute
arbitrary code. (CVE-2019-20503, CVE-2020-6798,
CVE-2020-6800, CVE-2020-6805, CVE-2020-6806,
CVE-2020-6807, CVE-2020-6812, CVE-2020-6814,
CVE-2020-6819, CVE-2020-6820, CVE-2020-6821,
CVE-2020-6825)

It was discovered that the Devtools’ ‘Copy as cURL’
feature did not fully escape website-controlled data.
If a user were tricked in to using the ‘Copy as cURL’
feature to copy and paste a command with specially
crafted data in to a terminal, an attacker could
potentially exploit this to execute arbitrary
commands via command injection. (CVE-2020-6811)

Update instructions:

The problem can be corrected by updating your system
to the followingpackage versions:

Ubuntu 19.10:
  thunderbird        1:68.7.0+build1-0ubuntu0.19.10.1

Ubuntu 18.04 LTS:
  thunderbird        1:68.7.0+build1-0ubuntu0.18.04.1

After a standard system update you need to restart
Thunderbird to make all the necessary changes.

References:
  https://usn.ubuntu.com/4328-1
  CVE-2019-20503, CVE-2020-6792, CVE-2020-6793,
  CVE-2020-6794, CVE-2020-6795, CVE-2020-6798,
  CVE-2020-6800, CVE-2020-6805, CVE-2020-6806,
  CVE-2020-6807, CVE-2020-6811, CVE-2020-6812,
  CVE-2020-6814, CVE-2020-6819, CVE-2020-6820,
  CVE-2020-6821, CVE-2020-6822, CVE-2020-6825

Package Information:

1:68.7.0+build1-0ubuntu0.19.10.1

1:68.7.0+build1-0ubuntu0.18.04.1