Lucene search

K
almalinuxAlmaLinuxALSA-2023:1809
HistoryApr 17, 2023 - 12:00 a.m.

Important: thunderbird security update

2023-04-1700:00:00
errata.almalinux.org
9
thunderbird
mail client
newsgroup client
security update
cve
s/mime
denial-of-service
memory corruption
openpgp
reflected file download
linux
arm64
double-free
libwebp

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

0.003 Low

EPSS

Percentile

70.4%

Mozilla Thunderbird is a standalone mail and newsgroup client.

This update upgrades Thunderbird to version 102.10.0.

Security Fix(es):

  • Thunderbird: Revocation status of S/Mime recipient certificates was not checked (CVE-2023-0547)
  • Mozilla: Matrix SDK bundled with Thunderbird vulnerable to denial-of-service attack (CVE-2023-28427)
  • Mozilla: Fullscreen notification obscured (CVE-2023-29533)
  • Mozilla: Potential Memory Corruption following Garbage Collector compaction (CVE-2023-29535)
  • Mozilla: Invalid free from JavaScript code (CVE-2023-29536)
  • Mozilla: Memory safety bugs fixed in Firefox 112 and Firefox ESR 102.10 (CVE-2023-29550)
  • Mozilla: Memory Corruption in Safe Browsing Code (CVE-2023-1945)
  • Thunderbird: Hang when processing certain OpenPGP messages (CVE-2023-29479)
  • Mozilla: Content-Disposition filename truncation leads to Reflected File Download (CVE-2023-29539)
  • Mozilla: Files with malicious extensions could have been downloaded unsafely on Linux (CVE-2023-29541)
  • Mozilla: Incorrect optimization result on ARM64 (CVE-2023-29548)
  • MFSA-TMP-2023-0001 Mozilla: Double-free in libwebp (BZ#2186102)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

References

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

0.003 Low

EPSS

Percentile

70.4%