{
  "fix": "thunderbird 1:52.8.0\u002Bbuild1-0ubuntu0.18.04.1",
  "url": "https://patchblox.com/security/fix/linux/ubuntu-bionic-thunderbird-1-52.8.0-build1-0ubuntu0.18.04.1",
  "summary": "thunderbird 1:52.8.0\u002Bbuild1-0ubuntu0.18.04.1, released May 22, 2018, fixes 13 CVEs in thunderbird. None of them is reported as exploited. Patch Radar priority: Routine. The product is no longer supported.",
  "platform": "linux",
  "type": "package",
  "title": "thunderbird 1:52.8.0\u002Bbuild1-0ubuntu0.18.04.1 for Ubuntu 18.04.6 LTS (bionic)",
  "released": "2018-05-22T17:00:00Z",
  "priority": "Routine",
  "priorityTier": 4,
  "priorityReason": "Closes 13 CVEs, none high severity",
  "supported": false,
  "cveCount": 13,
  "exploitedCveCount": 0,
  "kevCveCount": 0,
  "ransomwareCveCount": 0,
  "maxEpss": 0.20641,
  "appliesTo": [
    {
      "product": "thunderbird",
      "productUrl": "https://patchblox.com/security/product/linux/thunderbird",
      "release": "Ubuntu 18.04.6 LTS (bionic)",
      "fixedVersion": "1:52.8.0\u002Bbuild1-0ubuntu0.18.04.1",
      "supported": true
    }
  ],
  "cves": [
    {
      "cveId": "CVE-2018-5159",
      "url": "https://patchblox.com/security/cve/CVE-2018-5159",
      "title": "firefox: An integer overflow can occur in the Skia library due to 32-bit integer use in an array without integer overflow chec...",
      "priority": "Routine",
      "severity": "Medium",
      "epss": 0.20641,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2018-5178",
      "url": "https://patchblox.com/security/cve/CVE-2018-5178",
      "title": "thunderbird: A buffer overflow was found during UTF8 to Unicode string conversion within JavaScript with extremely large amounts o...",
      "priority": "Routine",
      "severity": "Low",
      "epss": 0.04893,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2017-17689",
      "url": "https://patchblox.com/security/cve/CVE-2017-17689",
      "title": "thunderbird: The S/MIME specification allows a Cipher Block Chaining (CBC)malleability-gadget attack that can indirectly lead to p...",
      "priority": "Routine",
      "severity": "Medium",
      "epss": 0.04144,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2018-5155",
      "url": "https://patchblox.com/security/cve/CVE-2018-5155",
      "title": "firefox: A use-after-free vulnerability can occur while adjusting layout during SVG animations with text paths",
      "priority": "Routine",
      "severity": "Medium",
      "epss": 0.03379,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2018-5154",
      "url": "https://patchblox.com/security/cve/CVE-2018-5154",
      "title": "thunderbird-mozsymbols: A use-after-free vulnerability can occur while enumerating attributes during SVG animations with clip paths",
      "priority": "Routine",
      "severity": "Medium",
      "epss": 0.03194,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2018-5183",
      "url": "https://patchblox.com/security/cve/CVE-2018-5183",
      "title": "thunderbird: Mozilla developers backported selected changes in the Skia library",
      "priority": "Routine",
      "severity": "Medium",
      "epss": 0.03172,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2018-5150",
      "url": "https://patchblox.com/security/cve/CVE-2018-5150",
      "title": "firefox: Memory safety bugs were reported in Firefox 59, Firefox ESR 52.7, and Thunderbird 52.7",
      "priority": "Routine",
      "severity": "Medium",
      "epss": 0.03086,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2018-5168",
      "url": "https://patchblox.com/security/cve/CVE-2018-5168",
      "title": "firefox: Sites can bypass security checks on permissions to install lightweight themes by manipulating the \u0022baseURI\u0022 property...",
      "priority": "Routine",
      "severity": "Medium",
      "epss": 0.02332,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2018-5161",
      "url": "https://patchblox.com/security/cve/CVE-2018-5161",
      "title": "thunderbird: Crafted message headers can cause a Thunderbird process to hang on receiving the message",
      "priority": "Routine",
      "severity": "Medium",
      "epss": 0.01979,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2018-5162",
      "url": "https://patchblox.com/security/cve/CVE-2018-5162",
      "title": "thunderbird: Plaintext of decrypted emails can leak through the src attribute of remote images, or links",
      "priority": "Routine",
      "severity": "Medium",
      "epss": 0.01915,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2018-5184",
      "url": "https://patchblox.com/security/cve/CVE-2018-5184",
      "title": "thunderbird: Using remote content in encrypted messages can lead to the disclosure of plaintext",
      "priority": "Routine",
      "severity": "Medium",
      "epss": 0.01739,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2018-5170",
      "url": "https://patchblox.com/security/cve/CVE-2018-5170",
      "title": "thunderbird: It is possible to spoof the filename of an attachment and display an arbitrary attachment name",
      "priority": "Routine",
      "severity": "Medium",
      "epss": 0.01697,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2018-5185",
      "url": "https://patchblox.com/security/cve/CVE-2018-5185",
      "title": "thunderbird-mozsymbols: Plaintext of decrypted emails can leak through by user submitting an embedded form",
      "priority": "Routine",
      "severity": "Medium",
      "epss": 0.01506,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    }
  ],
  "dataAsOf": "2026-11-13T20:04:13Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}