This update for MozillaThunderbird fixes the following issues:
- Mozilla Thunderbird was updated to 78.7.0 ESR (MFSA 2021-05, bsc#1181414)
* CVE-2021-23953: Fixed a Cross-origin information leakage via redirected PDF requests
* CVE-2021-23954: Fixed a type confusion when using logical assignment operators in JavaScript switch statements
* CVE-2020-26976: Fixed an issue where HTTPS pages could have been intercepted by a registered service worker when they should not have been
* CVE-2021-23960: Fixed a use-after-poison for incorrectly redeclared JavaScript variables during GC
* CVE-2021-23964: Fixed Memory safety bugs
* CVE-2020-1
This update for MozillaThunderbird fixes the following issues:
- Mozilla Thunderbird 78.6.1
* changed: MailExtensions: browserAction, composeAction, and
messageDisplayAction toolbar buttons now support label and
default_label properties (bmo#1583478)
* fixed: Running a quicksearch that returned no results did not
offer to re-run as a global search (bmo#1663153)
* fixed: Message search toolbar fixes (bmo#1681010)
* fixed: Very long subject lines distorted the message compose
and display windows, making them unusable (bmo#77806)
* fixed: Compose window: Recipient addresses that had not yet
been autocompleted were
This update for MozillaThunderbird fixes the following issues:
- Mozilla Thunderbird 78.6
* new: MailExtensions: Added
browser.windows.openDefaultBrowser() (bmo#1664708)
* changed: Thunderbird now only shows quota exceeded
indications on the main window (bmo#1671748)
* changed: MailExtensions: menus API enabled in messages being
composed (bmo#1670832)
* changed: MailExtensions: Honor allowScriptsToClose argument
in windows.create API function (bmo#1675940)
* changed: MailExtensions: APIs that returned an accountId will
reflect the account the message belongs to, not what is
stored in message headers (bmo#164
This update for MozillaThunderbird fixes the following issues:
- Mozilla Thunderbird was updated to 78.5.1 (MFSA 2020-53, bsc#1179530)
- CVE-2020-26970: Fixed a stack overflow due to incorrect parsing of SMTP server response codes.
- Various bug fixes
This update for MozillaThunderbird fixes the following issues:
TODO
- Mozilla Thunderbird 78.5.0
* new: OpenPGP: Added option to disable attaching the public
key to a signed message (bmo#1654950)
* new: MailExtensions: 'compose_attachments' context added to
Menus API (bmo#1670822)
* new: MailExtensions: Menus API now available on displayed
messages (bmo#1670825)
* changed: MailExtensions: browser.tabs.create will now wait
for 'mail-delayed-startup-finished' event (bmo#1674407)
* fixed: OpenPGP: Support for inline PGP messages improved
(bmo#1672851)
* fixed: OpenPGP: Message security dialog showed unverifie
This update for MozillaThunderbird fixes the following issues:
- Mozilla Thunderbird 78.4.2
MFSA 2020-49 (bsc#1178611)
* CVE-2020-26950 (bmo#1675905)
Write side effects in MCallGetProperty opcode not accounted
for
- Mozilla Thunderbird 78.4.1
* new: Thunderbird prompts for an address to use when starting
an email from an address book entry with multiple addresses
(bmo#84028)
* fixed: Searching global search results did not work
(bmo#1664761)
* fixed: Link location was not focused by default when adding a
hyperlink in message composer (bmo#1670660)
* fixed: Advanced address book search dialog was unusable
Security update for MozillaThunderbird and mozilla-nspr
This update for MozillaThunderbird and mozilla-nspr fixes the following issues:
- Mozilla Thunderbird 78.4
* new: MailExtensions: browser.tabs.sendMessage API added
* new: MailExtensions: messageDisplayScripts API added
* changed: Yahoo and AOL mail users using password authentication will be migrated to OAuth2
* changed: MailExtensions: messageDisplay APIs extended to support multiple selected messages
* changed: MailExtensions: compose.begin functions now support creating a message with attachments
* fixed: Thunderbird could freeze when updating global search index
* fixed: Multiple issues with handling of self-signed SSL cer
This update for MozillaThunderbird fixes the following issues:
- Mozilla Thunderbird was updated to 68.12 (bsc#1175686)
- CVE-2020-15663: Downgrade attack on the Mozilla Maintenance Service could
have resulted in escalation of privilege
- CVE-2020-15664: Attacker-induced prompt for extension installation
- CVE-2020-15669: Use-After-Free when aborting an operation
This update for MozillaThunderbird fixes the following issues:
- Updated to Mozilla Thunderbird 68.11:
* Fixed various security issues (MFSA-2020-35, bsc#1174538).
* Fixed CVE-2020-15652: Potential leak of redirect targets when loading scripts in a worker (bsc#1174538).
* Fixed CVE-2020-6514: WebRTC data channel leaks internal address to peer (bsc#1174538).
* Fixed CVE-2020-6463: Use-after-free in ANGLE gl::Texture::onUnbindAsSamplerTexture (bsc#1174538).
* Fixed CVE-2020-15659: Memory safety bugs fixed in Thunderbird 68.11 (bsc#1174538).
* Fixed a bug with FileLink attachments included as a link and file when added from a networ
This update for MozillaThunderbird to version 68.10.0 ESR fixes the following issues:
- CVE-2020-12417: Memory corruption due to missing sign-extension for ValueTags on ARM64 (bsc#1173576).
- CVE-2020-12418: Information disclosure due to manipulated URL object (bsc#1173576).
- CVE-2020-12419: Use-after-free in nsGlobalWindowInner (bsc#1173576).
- CVE-2020-12420: Use-After-Free when trying to connect to a STUN server (bsc#1173576).
- CVE-2020-12421: Add-On updates did not respect the same certificate trust rules as software updates (bsc#1173576).
This update for MozillaThunderbird fixes the following issues:
Mozilla Thunderbird 68.9.0 (bsc#1172402)
- CVE-2020-12405: Fixed a use-after-free in SharedWorkerService.
- CVE-2020-12406: Fixed a JavaScript Type confusion with NativeTypes.
- CVE-2020-12410: Fixed multiple memory safety issues
- CVE-2020-12398: Fixed a potential information leak due to security downgrade
with IMAP STARTTLS
- Use a symbolic icon from branding internals
This update for MozillaThunderbird fixes the following issues:
- Update to 68.8.0 ESR
MFSA 2020-18 (bsc#1171186)
* CVE-2020-12397 (bmo#1617370)
Sender Email Address Spoofing using encoded Unicode
characters
* CVE-2020-12387 (bmo#1545345)
Use-after-free during worker shutdown
* CVE-2020-6831 (bmo#1632241)
Buffer overflow in SCTP chunk input validation
* CVE-2020-12392 (bmo#1614468)
Arbitrary local file access with 'Copy as cURL'
* CVE-2020-12393 (bmo#1615471)
Devtools' 'Copy as cURL' feature did not fully escape
website-controlled data, potentially leading to command
injection
* CVE-2020-12395 (bmo
This update for MozillaThunderbird to version 68.7.0 fixes the following issues:
- CVE-2020-6819: Use-after-free while running the nsDocShell destructor (boo#1168630)
- CVE-2020-6820: Use-after-free when handling a ReadableStream (boo#1168630)
- CVE-2020-6821: Uninitialized memory could be read when using the WebGL copyTexSubImage() (boo#1168874)
- CVE-2020-6822: Out of bounds write in GMPDecodeData when processing large images (boo#1168874)
- CVE-2020-6825: Memory safety bugs fixed (boo#1168874)
This update for MozillaThunderbird fixes the following issues:
MozillaThunderbird was updated to 68.6.0 ESR (MFSA 2020-10 bsc#1166238)
- CVE-2020-6805: Fixed a use-after-free when removing data about origins
- CVE-2020-6806: Fixed improper protections against state confusion
- CVE-2020-6807: Fixed a use-after-free in cubeb during stream destruction
- CVE-2020-6811: Fixed an issue where copy as cURL' feature did not fully
escape website-controlled data potentially leading to command injection
- CVE-2019-20503: Fixed out of bounds reads in sctp_load_addresses_from_init
- CVE-2020-6812: Fixed an issue where the names of AirPods with perso
This update for MozillaThunderbird fixes the following issues:
- Mozilla Thunderbird 68.5 (bsc#1162777)
MFSA 2020-07 (bsc#1163368)
* CVE-2020-6793 (bmo#1608539)
Out-of-bounds read when processing certain email messages
* CVE-2020-6794 (bmo#1606619)
Setting a master password post-Thunderbird 52 does not delete
unencrypted previously stored passwords
* CVE-2020-6795 (bmo#1611105)
Crash processing S/MIME messages with multiple signatures
* CVE-2020-6797 (bmo#1596668)
Extensions granted downloads.open permission could open
arbitrary applications on Mac OSX
* CVE-2020-6798 (bmo#1602944)
Incorrect parsing of
This update for MozillaThunderbird to version 68.4.1 fixes the following issues:
Security issues fixed:
- CVE-2019-17026: IonMonkey type confusion with StoreElementHole and FallibleStoreElement
- CVE-2019-17016: Bypass of @namespace CSS sanitization during pasting
- CVE-2019-17017: Type Confusion in XPCVariant.cpp
- CVE-2019-17022: CSS sanitization does not escape HTML tags
- CVE-2019-17024: multiple Memory safety bugs fixed
Non-security issues fixed:
- Various improvements when setting up an account for a Microsoft Exchange
server. For example better detection for Office 365 accounts.
This update for MozillaThunderbird fixes the following issues:
Mozilla Thunderbird was updated to 68.3esr (MFSA 2019-38 bsc#1158328)
Security issues fixed:
- CVE-2019-17008: Fixed a use-after-free in worker destruction (bmo#1546331)
- CVE-2019-13722: Fixed a stack corruption due to incorrect number of arguments
in WebRTC code (bmo#1580156)
- CVE-2019-11745: Fixed an out of bounds write in NSS when encrypting with a
block cipher (bmo#1586176)
- CVE-2019-17009: Fixed an issue where updater temporary files accessible to
unprivileged processes (bmo#1510494)
- CVE-2019-17010: Fixed a use-after-free when performing device orientati
This update for MozillaThunderbird to version 68.2.1 provides the following fixes:
- Security issues fixed (bsc#1154738):
* CVE-2019-15903: Fixed a heap overflow in the expat library (bsc#1149429).
* CVE-2019-11757: Fixed a use-after-free when creating index updates in IndexedDB (bsc#1154738).
* CVE-2019-11758: Fixed a potentially exploitable crash due to 360 Total Security (bsc#1154738).
* CVE-2019-11759: Fixed a stack buffer overflow in HKDF output (bsc#1154738).
* CVE-2019-11760: Fixed a stack buffer overflow in WebRTC networking (bsc#1154738).
* CVE-2019-11761: Fixed an unintended access to a privileged JSONView object (bsc#1
This update for MozillaThunderbird to version 68.1.1 fixes the following issues:
- CVE-2019-11709: Fixed several memory safety bugs. (bsc#1140868)
- CVE-2019-11710: Fixed several memory safety bugs. (bsc#1140868)
- CVE-2019-11711: Fixed a script injection within domain through inner window reuse. (bsc#1140868)
- CVE-2019-11712: Fixed an insufficient validation of cross-origin POST requests within NPAPI plugins. (bsc#1140868)
- CVE-2019-11713: Fixed a use-after-free with HTTP/2 cached stream. (bsc#1140868)
- CVE-2019-11714: Fixed a crash in NeckoChild. (bsc#1140868)
- CVE-2019-11715: Fixed an HTML parsing error that can contribute to conten
This update for MozillaThunderbird version 60.8 fixes the following issues:
Security issues fixed:
- CVE-2019-9811: Sandbox escape via installation of malicious language pack (bsc#1140868).
- CVE-2019-11711: Script injection within domain through inner window reuse (bsc#1140868).
- CVE-2019-11712: Cross-origin POST requests can be made with NPAPI plugins by following 308 redirects (bsc#1140868).
- CVE-2019-11713: Use-after-free with HTTP/2 cached stream (bsc#1140868).
- CVE-2019-11729: Empty or malformed p256-ECDH public keys may trigger a segmentation fault (bsc#1140868).
- CVE-2019-11715: HTML parsing error can contribute to content XSS (