Mozilla Thunderbird is a standalone mail and newsgroup client.
This update upgrades Thunderbird to version 115.5.0.
Security Fix(es):
* Mozilla: Out-of-bound memory access in WebGL2 blitFramebuffer (CVE-2023-6204)
* Mozilla: Use-after-free in MessagePort::Entangled (CVE-2023-6205)
* Mozilla: Clickjacking permission prompts using the fullscreen transition (CVE-2023-6206)
* Mozilla: Use-after-free in ReadableByteStreamQueueEntry::Buffer (CVE-2023-6207)
* Mozilla: Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5, and Thunderbird 115.5 (CVE-2023-6212)
* Mozilla: Using Selection API would copy contents into X11 primary selection. (CVE
Mozilla Thunderbird is a standalone mail and newsgroup client.
This update upgrades Thunderbird to version 115.4.1.
Security Fix(es):
* Mozilla: Queued up rendering could have allowed websites to clickjack (CVE-2023-5721)
* Mozilla: Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4, and Thunderbird 115.4 (CVE-2023-5730)
* libvpx: crash related to VP9 encoding in libvpx (CVE-2023-44488)
* Mozilla: Large WebGL draw could have led to a crash (CVE-2023-5724)
* Mozilla: WebExtensions could open arbitrary URLs (CVE-2023-5725)
* Mozilla: Improper object tracking during GC in the JavaScript engine could have led to a crash. (CVE-2023-5728
Mozilla Thunderbird is a standalone mail and newsgroup client.
This update upgrades Thunderbird to version 102.15.1.
Security Fix(es):
* libwebp: Heap buffer overflow in WebP Codec (CVE-2023-4863)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Mozilla Thunderbird is a standalone mail and newsgroup client.
This update upgrades Thunderbird to version 102.14.0.
Security Fix(es):
* Mozilla: Offscreen Canvas could have bypassed cross-origin restrictions (CVE-2023-4045)
* Mozilla: Incorrect value used during WASM compilation (CVE-2023-4046)
* Mozilla: Potential permissions request bypass via clickjacking (CVE-2023-4047)
* Mozilla: Crash in DOMParser due to out-of-memory conditions (CVE-2023-4048)
* Mozilla: Fix potential race conditions when releasing platform objects (CVE-2023-4049)
* Mozilla: Stack buffer overflow in StorageManager (CVE-2023-4050)
* Mozilla: Memory safety bugs fixed
Mozilla Thunderbird is a standalone mail and newsgroup client.
This update upgrades Thunderbird to version 102.13.0.
Security Fix(es):
* Mozilla: Use-after-free in WebRTC certificate generation (CVE-2023-37201)
* Mozilla: Potential use-after-free from compartment mismatch in SpiderMonkey (CVE-2023-37202)
* Mozilla: Memory safety bugs fixed in Firefox 115, Firefox ESR 102.13, and Thunderbird 102.13 (CVE-2023-37211)
* Mozilla: Fullscreen notification obscured (CVE-2023-37207)
* Mozilla: Lack of warning when opening Diagcab files (CVE-2023-37208)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgment
Mozilla Thunderbird is a standalone mail and newsgroup client.
This update upgrades Thunderbird to version 102.12.0.
Security Fix(es):
* Mozilla: Click-jacking certificate exceptions through rendering lag (CVE-2023-34414)
* Mozilla: Memory safety bugs fixed in Firefox 114 and Firefox ESR 102.12 (CVE-2023-34416)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Mozilla Thunderbird is a standalone mail and newsgroup client.
This update upgrades Thunderbird to version 102.11.0.
Security Fix(es):
* Mozilla: Browser prompts could have been obscured by popups (CVE-2023-32205)
* Mozilla: Crash in RLBox Expat driver (CVE-2023-32206)
* Mozilla: Potential permissions request bypass via clickjacking (CVE-2023-32207)
* Mozilla: Memory safety bugs fixed in Firefox 113 and Firefox ESR 102.11 (CVE-2023-32215)
* Mozilla: Content process crash due to invalid wasm code (CVE-2023-32211)
* Mozilla: Potential spoof due to obscured address bar (CVE-2023-32212)
* Mozilla: Potential memory corruption in FileReader::DoR
Mozilla Thunderbird is a standalone mail and newsgroup client.
This update upgrades Thunderbird to version 102.10.0.
Security Fix(es):
* Thunderbird: Revocation status of S/Mime recipient certificates was not checked (CVE-2023-0547)
* Mozilla: Matrix SDK bundled with Thunderbird vulnerable to denial-of-service attack (CVE-2023-28427)
* Mozilla: Fullscreen notification obscured (CVE-2023-29533)
* Mozilla: Potential Memory Corruption following Garbage Collector compaction (CVE-2023-29535)
* Mozilla: Invalid free from JavaScript code (CVE-2023-29536)
* Mozilla: Memory safety bugs fixed in Firefox 112 and Firefox ESR 102.10 (CVE-2023-29550)
*
Mozilla Thunderbird is a standalone mail and newsgroup client.
This update upgrades Thunderbird to version 102.9.0.
Security Fix(es):
* Mozilla: Incorrect code generation during JIT compilation (CVE-2023-25751)
* Mozilla: Memory safety bugs fixed in Firefox 111 and Firefox ESR 102.9 (CVE-2023-28176)
* Mozilla: Potential out-of-bounds when accessing throttled streams (CVE-2023-25752)
* Mozilla: Invalid downcast in Worklets (CVE-2023-28162)
* Mozilla: URL being dragged from a removed cross-origin iframe into the same tab triggered navigation (CVE-2023-28164)
For more details about the security issue(s), including the impact, a CVSS score, a
Mozilla Thunderbird is a standalone mail and newsgroup client.
This update upgrades Thunderbird to version 102.8.0.
Security Fix(es):
* Mozilla: Arbitrary memory write via PKCS 12 in NSS (CVE-2023-0767)
* Mozilla: Content security policy leak in violation reports using iframes (CVE-2023-25728)
* Mozilla: Screen hijack via browser fullscreen mode (CVE-2023-25730)
* Mozilla: Potential use-after-free from compartment mismatch in SpiderMonkey (CVE-2023-25735)
* Mozilla: Invalid downcast in SVGUtils::SetupStrokeGeometry (CVE-2023-25737)
* Mozilla: Use-after-free in mozilla::dom::ScriptLoadContext::~ScriptLoadContext (CVE-2023-25739)
* Mozilla:
Mozilla Thunderbird is a standalone mail and newsgroup client.
This update upgrades Thunderbird to version 102.7.1.
Security Fix(es):
* Mozilla: Revocation status of S/Mime signature certificates was not checked (CVE-2023-0430)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Mozilla Thunderbird is a standalone mail and newsgroup client.
This update upgrades Thunderbird to version 102.7.1.
Security Fix(es):
* Mozilla: libusrsctp library out of date (CVE-2022-46871)
* Mozilla: Arbitrary file read from GTK drag and drop on Linux (CVE-2023-23598)
* Mozilla: Memory safety bugs fixed in Firefox 109 and Firefox ESR 102.7 (CVE-2023-23605)
* Mozilla: Malicious command could be hidden in devtools output (CVE-2023-23599)
* Mozilla: URL being dragged from cross-origin iframe into same tab triggers navigation (CVE-2023-23601)
* Mozilla: Content Security Policy wasn't being correctly applied to WebSockets in WebWorkers (CVE
Mozilla Thunderbird is a standalone mail and newsgroup client.
This update upgrades Thunderbird to version 102.6.0.
Security Fix(es):
* Mozilla: Arbitrary file read from a compromised content process (CVE-2022-46872)
* Mozilla: Memory safety bugs fixed in Firefox ESR 102.6 and Thunderbird 102.6 (CVE-2022-46878)
* Mozilla: Use-after-free in WebGL (CVE-2022-46880)
* Mozilla: Memory corruption in WebGL (CVE-2022-46881)
* Mozilla: Quoting from an HTML email with certain tags will trigger network requests and load remote content, regardless of a configuration to block remote content (CVE-2022-45414)
* Mozilla: Drag and Dropped Filenames could h
Mozilla Thunderbird is a standalone mail and newsgroup client.
This update upgrades Thunderbird to version 102.5.0.
Security Fix(es):
* Mozilla: Service Workers might have learned size of cross-origin media files (CVE-2022-45403)
* Mozilla: Fullscreen notification bypass (CVE-2022-45404)
* Mozilla: Use-after-free in InputStream implementation (CVE-2022-45405)
* Mozilla: Use-after-free of a JavaScript Realm (CVE-2022-45406)
* Mozilla: Fullscreen notification bypass via windowName (CVE-2022-45408)
* Mozilla: Use-after-free in Garbage Collection (CVE-2022-45409)
* Mozilla: Memory safety bugs fixed in Firefox 107 and Firefox ESR 102.5 (CVE-202
Mozilla Thunderbird is a standalone mail and newsgroup client.
This update upgrades Thunderbird to version 102.4.0.
Security Fix(es):
* Mozilla: Matrix SDK bundled with Thunderbird vulnerable to an impersonation attack by malicious server administrators (CVE-2022-39249)
* Mozilla: Matrix SDK bundled with Thunderbird vulnerable to a device verification attack (CVE-2022-39250)
* Mozilla: Matrix SDK bundled with Thunderbird vulnerable to an impersonation attack (CVE-2022-39251)
* Mozilla: Same-origin policy violation could have leaked cross-origin URLs (CVE-2022-42927)
* Mozilla: Memory Corruption in JS Engine (CVE-2022-42928)
* Mozilla: Matr
Mozilla Thunderbird is a standalone mail and newsgroup client.
This update upgrades Thunderbird to version 102.3.0.
Security Fix(es):
* expat: a use-after-free in the doContent function in xmlparse.c (CVE-2022-40674)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Mozilla Thunderbird is a standalone mail and newsgroup client.
This update upgrades Thunderbird to version 102.3.0.
Security Fix(es):
* Mozilla: Leaking of sensitive information when composing a response to an HTML email with a META refresh tag (CVE-2022-3033)
* Mozilla: Bypassing FeaturePolicy restrictions on transient pages (CVE-2022-40959)
* Mozilla: Data-race when parsing non-UTF-8 URLs in threads (CVE-2022-40960)
* Mozilla: Memory safety bugs fixed in Firefox 105 and Firefox ESR 102.3 (CVE-2022-40962)
* Mozilla: Remote content specified in an HTML document that was nested inside an iframe's srcdoc attribute was not blocked (CVE-2022-3
Mozilla Thunderbird is a standalone mail and newsgroup client.
This update upgrades Thunderbird to version 91.13.0.
Security Fix(es):
* Mozilla: Address bar spoofing via XSLT error handling (CVE-2022-38472)
* Mozilla: Cross-origin XSLT Documents would have inherited the parent's permissions (CVE-2022-38473)
* Mozilla: Memory safety bugs fixed in Firefox 104 and Firefox ESR 102.2 (CVE-2022-38477)
* Mozilla: Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2, and Firefox ESR 91.13 (CVE-2022-38478)
* Mozilla: Data race and potential use-after-free in PK11_ChangePW (CVE-2022-38476)
For more details about the security issue(s), including t
Mozilla Thunderbird is a standalone mail and newsgroup client.
This update upgrades Thunderbird to version 91.12.0.
Security Fix(es):
* Mozilla: Memory safety bugs fixed in Firefox 103 and 102.1 (CVE-2022-2505)
* Mozilla: Directory indexes for bundled resources reflected URL parameters (CVE-2022-36318)
* Mozilla: Mouse Position spoofing with CSS transforms (CVE-2022-36319)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.