This update for MozillaThunderbird fixes the following issues:
- Mozilla Thunderbird 115.5.0 MFSA 2023-52 (bsc#1217230)
* CVE-2023-6204: Out-of-bound memory access in WebGL2 blitFramebuffer
* CVE-2023-6205: Use-after-free in MessagePort::Entangled
* CVE-2023-6206: Clickjacking permission prompts using the fullscreen transition
* CVE-2023-6207: Use-after-free in ReadableByteStreamQueueEntry::Buffer
* CVE-2023-6208: Using Selection API would copy contents into X11 primary selection.
* CVE-2023-6209: Incorrect parsing of relative URLs starting with '///'
* CVE-2023-6212: Memory safety bugs
This update for MozillaThunderbird fixes the following issues:
- Updated to version 115.4.1:
- CVE-2023-5721: Fixed a potential clickjack via queued up
rendering.
- CVE-2023-5732: Fixed an address bar spoofing via bidirectional
characters
- CVE-2023-5724: Fixed a crash due to a large WebGL draw.
- CVE-2023-5725: Fixed an issue where WebExtensions could open
arbitrary URLs.
- CVE-2023-5726: Fixed an issue where fullscreen notifications would
be obscured by file the open dialog on macOS.
- CVE-2023-5727: Fixed a download protection bypass on on Windows.
- CVE-2023-5728: Fixed a crash caused by improper object tra
This update for MozillaThunderbird fixes the following issues:
Security fixes:
- CVE-2023-5217: Fixed a heap buffer overflow in libvpx. (bsc#1215814)
- CVE-2023-5168: Out-of-bounds write in FilterNodeD2D1. (bsc#1215575)
- CVE-2023-5169: Out-of-bounds write in PathOps. (bsc#1215575)
- CVE-2023-5171: Use-after-free in Ion Compiler. (bsc#1215575)
- CVE-2023-5174: Double-free in process spawning on Windows. (bsc#1215575)
- CVE-2023-5176: Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3, and Thunderbird 115.3. (bsc#1215575)
Other fixes:
- Mozilla Thunderbird 115.3.1
* fixed: In Unified Folders view, some folders had incorrect
un
This update for MozillaThunderbird fixes the following issues:
Mozilla Thunderbird was updated to version 115.0.1 (bsc#1212438):
- CVE-2023-3600: Fixed use-after-free in workers (bmo#1839703).
- CVE-2023-3417: Fixed File Extension Spoofing using the Text Direction Override Character (bmo#1835582).
Bugfixes:
- changed: Added Thunderbird Supernova branding to about:dialog
(bmo#1842102)
- fixed: Message list was not updated when message was deleted
from server outside of Thunderbird (bmo#1837041)
- fixed: Scrolling behaved unexpectedly when moving to next
message unread message in another folder (bmo#1841711)
- f
This update for MozillaThunderbird fixes the following issues:
Mozilla Thunderbird 102.12 MFSA 2023-21 (bsc#1211922):
- CVE-2023-34414: Click-jacking certificate exceptions through rendering lag
- CVE-2023-34416: Memory safety bugs fixed in Thunderbird 102.12
This update for MozillaThunderbird fixes the following issues:
Update to version 102.11:
- fixed: During Account Setup, the 'Checking password...' message was not removed after a failure (bmo#1826022)
- fixed: Miscellaneous UI fixes (bmo#1827070)
- fixed: Security fixes MFSA 2023-18 (bsc#1211175)
- CVE-2023-32205: Browser prompts could have been obscured by popups
- CVE-2023-32206: Crash in RLBox Expat driver
- CVE-2023-32207: Potential permissions request bypass via clickjacking
- CVE-2023-32211: Content process crash due to invalid wasm code
- CVE-2023-32212: Potential spoof due to obscured address bar
- CVE-2023-32213: Potential memory c
This update for MozillaThunderbird fixes the following issues:
MFSA 2023-12 (bsc#1209953):
- CVE-2023-28427: Matrix SDK bundled with Thunderbird vulnerable to denial-of-service attack (bmo#1822595)
MFSA 2023-11 (bsc#1209173):
- CVE-2023-25751: Incorrect code generation during JIT compilation (bmo#1814899).
- CVE-2023-28164: URL being dragged from a removed cross-origin iframe into the same tab triggered navigation (bmo#1809122).
- CVE-2023-28162: Invalid downcast in Worklets (bmo#1811327).
- CVE-2023-25752: Potential out-of-bounds when accessing throttled streams (bmo#1811627).
- CVE-2023-28163: Windows Save As dialog resolved environment
This update for MozillaThunderbird fixes the following issues:
Updated Mozilla Thunderbird to version 102.8.0 (bsc#1208144):
- CVE-2023-0616: Fixed User Interface lockup via messages combining S/MIME and OpenPGP.
- CVE-2023-25728: Fixed content security policy leak in violation reports using iframes.
- CVE-2023-25730: Fixed screen hijack via browser fullscreen mode.
- CVE-2023-0767: Fixed arbitrary memory write via PKCS 12 in NSS.
- CVE-2023-25735: Fixed potential use-after-free from compartment mismatch in SpiderMonkey.
- CVE-2023-25737: Fixed invalid downcast in SVGUtils::SetupStrokeGeometry.
- CVE-2023-25738: Fixed printin
This update for MozillaThunderbird fixes the following issues:
Updated to version 102.7.1 (bsc#1207119):
* CVE-2022-46871: Fixed out of date libusrsctp.
* CVE-2023-23598: Fixed arbitrary file read from GTK drag and drop on Linux.
* CVE-2023-23599: Fixed issue where malicious command that could be hidden in devtools output on Windows.
* CVE-2023-23601: Fixed issue where URL being dragged from cross-origin iframe into same tab triggers navigation.
* CVE-2023-23602: Fixed Content Security Policy not being correctly applied to WebSockets in WebWorkers.
* CVE-2022-46877: Fixed fullscreen notification bypass.
* CVE-2023-23603: Fixe
This update for MozillaThunderbird fixes the following issues:
Update to version 102.6.1
* fixed: Remote content did not load in user-defined signatures
* fixed: Addons that added new action buttons were not shown for addon upgrades, requiring removal and reinstall
* fixed: Various stability improvements
* CVE-2022-46874: Drag and Dropped Filenames could have been truncated to malicious extensions (bsc#1206653)
This update for MozillaThunderbird fixes the following issues:
Update to version 102.6 (bsc#1206242):
- CVE-2022-46880: Use-after-free in WebGL
- CVE-2022-46872: Arbitrary file read from a compromised content process
- CVE-2022-46881: Memory corruption in WebGL
- CVE-2022-46874: Drag and Dropped Filenames could have been truncated to malicious extensions
- CVE-2022-46875: Download Protections were bypassed by .atloc and .ftploc files on Mac OS
- CVE-2022-46882: Use-after-free in WebGL
- CVE-2022-46878: Memory safety bugs fixed in Thunderbird 102.6
This update for MozillaThunderbird fixes the following issues:
Update to version 102.5.1:
- CVE-2022-45414: Quoting from an HTML email with certain tags will trigger network requests and load remote content, regardless of a configuration to block remote content (bsc#1205941).
This update for MozillaThunderbird fixes the following issues:
- Fixed various security issues (MFSA 2022-49, bsc#1205270):
* CVE-2022-45403 (bmo#1762078)
Service Workers might have learned size of cross-origin media
files
* CVE-2022-45404 (bmo#1790815)
Fullscreen notification bypass
* CVE-2022-45405 (bmo#1791314)
Use-after-free in InputStream implementation
* CVE-2022-45406 (bmo#1791975)
Use-after-free of a JavaScript Realm
* CVE-2022-45408 (bmo#1793829)
Fullscreen notification bypass via windowName
* CVE-2022-45409 (bmo#1796901)
Use-after-free in Garbage Collection
* CVE-2022-45410 (bmo#1658869)
This update for MozillaThunderbird fixes the following issues:
- Mozilla Thunderbird 102.4.0 (bsc#1204421)
* changed: Thunderbird will automatically detect and repair OpenPGP key storage corruption caused by using the profile import tool in Thunderbird 102
* fixed: POP message download into a large folder (~13000 messages) caused Thunderbird to temporarily freeze
* fixed: Forwarding messages with special characters in Subject failed on Windows
* fixed: Links for FileLink attachments were not added when attachment filename contained Unicode characters
* fixed: Address Book display pane continued to show contacts after deletion
This update for MozillaThunderbird fixes the following issues:
Updated to Mozilla Thunderbird 102.2.2:
- CVE-2022-3033: Fixed leaking of sensitive information when composing a response to an HTML email with a META refresh tag (bsc#1203007).
- CVE-2022-3032: Fixed missing blocking of remote content specified in an HTML document that was nested inside an iframe's srcdoc attribute (bsc#1203007).
- CVE-2022-3034: Fixed issue where iframe element in an HTML email could trigger a network request (bsc#1203007).
- CVE-2022-36059: Fixed DoS in Matrix SDK bundled with Thunderbird service attack (bsc#1203007).
- CVE-2022-38472: Fixed Address bar spoo
This update for MozillaThunderbird fixes the following issues:
- Mozilla Thunderbird 91.12
* changed: Support for Google Talk chat accounts removed
* fixed: OpenPGP signatures were broken when 'Primary Password'
dialog remained open
* fixed: Various security fixes
- Security fixes (MFSA 2022-31) (bsc#1201758):
- CVE-2022-36319: Fixed mouse Position spoofing with CSS transforms (bmo#1737722)
- CVE-2022-36318: Fixed directory indexes for bundled resources reflected URL parameters (bmo#1771774)
This update for MozillaThunderbird fixes the following issues:
- CVE-2022-2200: Undesired attributes could be set as part of prototype pollution (bmo#1771381)
- CVE-2022-2226: An email with a mismatching OpenPGP signature date was accepted as valid (bmo#1775441)
- CVE-2022-31744: CSP bypass enabling stylesheet injection (bmo#1757604)
- CVE-2022-34468: CSP sandbox header without `allow-scripts` can be bypassed via retargeted javascript: URI (bmo#1768537)
- CVE-2022-34470: Use-after-free in nsSHistory (bmo#1765951)
- CVE-2022-34472: Unavailable PAC file resulted in OCSP requests being blocked (bmo#1770123)
- CVE-2022-34478: Micro