Lucene search

K
suseSuseSUSE-SU-2022:1176-1
HistoryApr 13, 2022 - 12:00 a.m.

Security update for MozillaThunderbird (important)

2022-04-1300:00:00
lists.opensuse.org
23

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

An update that fixes 9 vulnerabilities is now available.

Description:

This update for MozillaThunderbird fixes the following issues:

  • Updated to version 91.8 (bsc#1197903):
    • CVE-2022-1097: Fixed a memory corruption issue with NSSToken objects.
    • CVE-2022-28281: Fixed a memory corruption issue due to unexpected
      WebAuthN Extensions.
    • CVE-2022-1197: Fixed an issue where OpenPGP revocation information was
      ignored.
    • CVE-2022-1196: Fixed a memory corruption issue after VR process
      destruction.
    • CVE-2022-28282: Fixed a memory corruption issue in document
      translation.
    • CVE-2022-28285: Fixed a memory corruption issue in JIT code generation.
    • CVE-2022-28286: Fixed an iframe layout issue that could have been
      exploited to stage spoofing attacks.
    • CVE-2022-24713: Fixed a potential denial of service via complex
      regular expressions.
    • CVE-2022-28289: Fixed multiple memory corruption issues.

Non-security fixes:

  • Changed Google accounts using password authentication to use OAuth2.
  • Fixed an issue where OpenPGP ECC keys created by Thunderbird could not
    be imported into GnuPG.
  • Fixed an issue where exporting multiple public PGP keys from Thunderbird
    was not possible.
  • Fixed an issue where replying to a newsgroup message erroneously
    displayed a “No-reply” popup warning.
  • Fixed an issue with opening older address books.
  • Fixed an issue where LDAP directories would be lost when switching to
    “Offline” mode.
  • Fixed an issue when importing webcals.

Patch Instructions:

To install this SUSE Security Update use the SUSE recommended installation methods
like YaST online_update or “zypper patch”.

Alternatively you can run the command listed for your product:

  • openSUSE Leap 15.4:

    zypper in -t patch openSUSE-SLE-15.4-2022-1176=1

  • openSUSE Leap 15.3:

    zypper in -t patch openSUSE-SLE-15.3-2022-1176=1

  • SUSE Linux Enterprise Workstation Extension 15-SP4:

    zypper in -t patch SUSE-SLE-Product-WE-15-SP4-2022-1176=1

  • SUSE Linux Enterprise Workstation Extension 15-SP3:

    zypper in -t patch SUSE-SLE-Product-WE-15-SP3-2022-1176=1

  • SUSE Linux Enterprise Module for Packagehub Subpackages 15-SP4:

    zypper in -t patch SUSE-SLE-Module-Packagehub-Subpackages-15-SP4-2022-1176=1

  • SUSE Linux Enterprise Module for Packagehub Subpackages 15-SP3:

    zypper in -t patch SUSE-SLE-Module-Packagehub-Subpackages-15-SP3-2022-1176=1

OSVersionArchitecturePackageVersionFilename
openSUSE Leap15.4aarch64< - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64):- openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64):.aarch64.rpm
openSUSE Leap15.4ppc64le< - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64):- openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64):.ppc64le.rpm
openSUSE Leap15.4s390x< - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64):- openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64):.s390x.rpm
openSUSE Leap15.4x86_64< - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64):- openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64):.x86_64.rpm
openSUSE Leap15.3aarch64< - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64):- openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64):.aarch64.rpm
openSUSE Leap15.3ppc64le< - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64):- openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64):.ppc64le.rpm
openSUSE Leap15.3s390x< - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64):- openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64):.s390x.rpm
openSUSE Leap15.3x86_64< - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64):- openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64):.x86_64.rpm
SUSE Linux Enterprise Workstation Extension 15SP4x86_64<  SUSE Linux Enterprise Workstation Extension 15-SP4 (x86_64):- SUSE Linux Enterprise Workstation Extension 15-SP4 (x86_64):.x86_64.rpm
SUSE Linux Enterprise Workstation Extension 15SP3x86_64<  SUSE Linux Enterprise Workstation Extension 15-SP3 (x86_64):- SUSE Linux Enterprise Workstation Extension 15-SP3 (x86_64):.x86_64.rpm
Rows per page:
1-10 of 161

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P