This update for MozillaThunderbird fixes the following issues:
- CVE-2024-50336: Fixed insufficient MXC URI validation which could allow client-side path traversal (bsc#1234413)
Other fixes:
- Updated to Mozilla Thunderbird 128.5.2i (bsc#1234413):
* fixed: Large virtual folders could be very slow
* fixed: Message could disappear after moving from IMAP folder
followed by Undo and Redo
* fixed: XMPP chat did not display messages sent inside a CDATA
element
* fixed: Selected calendar day did not move forward at midnight
* fixed: Today pane agenda sometimes scrolled for no apparent
reason
* fixed: CalDAV calendars w
This update for MozillaThunderbird fixes the following issues:
- Mozilla Thunderbird 128.5
* fixed: IMAP could crash when reading cached messages
* fixed: Enabling 'Show Folder Size' on Maildir profile could
render Thunderbird unusable
* fixed: Messages corrupted by folder compaction were only
fixed by user intervention
* fixed: Reading a message from past the end of an mbox file
did not cause an error
* fixed: View -> Folders had duplicate F access keys
* fixed: Add-ons adding columns to the message list could fail
and cause display issue
* fixed: 'Empty trash on exit' and 'Expunge inbox on exit' did
not al
This update for MozillaThunderbird fixes the following issues:
- Mozilla Thunderbird 128.4.3
* fixed: Folder corruption could cause Thunderbird to freeze
and become unusable
* fixed: Message corruption could be propagated when reading mbox
* fixed: Folder compaction was not abandoned on shutdown
* fixed: Folder compaction did not clean up on failure
* fixed: Collapsed NNTP thread incorrectly indicated there were
unread messages
* fixed: Navigating to next unread message did not wait for all
messages to be loaded
* fixed: Applying column view to folder and children could
break if folder error occurred
* fixed:
This update for MozillaThunderbird fixes the following issues:
Update to Mozilla Thunderbird 128.3.1 (MFSA 2024-52, bsc#1231413):
- CVE-2024-9680: Fixed use-after-free in Animation timeline (bmo#1923344)
This update for MozillaThunderbird fixes the following issues:
Update to Mozilla Thunderbird 128.3.1 (MFSA 2024-51, bsc#1231413):
- CVE-2024-9680: Use-after-free in Animation timeline
Update to Mozilla Thunderbird 128.3 (MFSA 2024-49, bsc#1230979):
- CVE-2024-9392: Compromised content process can bypass site isolation
- CVE-2024-9393: Cross-origin access to PDF contents through multipart responses
- CVE-2024-9394: Cross-origin access to JSON contents through multipart responses
- CVE-2024-8900: Clipboard write permission bypass
- CVE-2024-9396: Potential memory corruption may occur when cloning certain objects
- CVE-2024-9397: Pote
This update for MozillaThunderbird fixes the following issues:
- Mozilla Thunderbird 128.2.3
MFSA 2024-43 (bsc#1229821)
* CVE-2024-8394: Crash when aborting verification of OTR chat.
* CVE-2024-8385: WASM type confusion involving ArrayTypes.
* CVE-2024-8381: Type confusion when looking up a property name in a 'with' block.
* CVE-2024-8382: Internal event interfaces were exposed to web content when browser EventHandler listener callbacks
ran.
* CVE-2024-8384: Garbage collection could mis-color cross-compartment objects in OOM conditions.
* CVE-2024-8386: SelectElements could be shown over another site if popups are allowed.
This update for MozillaThunderbird fixes the following issues:
- Mozilla Thunderbird 115.14
* fixed: When using an external installation of GnuPG,
Thunderbird occassionally sent/received corrupted messages
* fixed: Users of external GnuPG were unable to decrypt
incorrectly encoded messages (bmo#1906903)
* fixed: Flatpak install of 128.0esr was incorrectly downgraded
to 115.13.0esr (bmo#1908299)
* fixed: Security fixes
MFSA 2024-38 (bsc#1228648)
* CVE-2024-7519: Out of bounds memory access in graphics shared memory handling
* CVE-2024-7521: Incomplete WebAssembly exception handing
* CVE-2024-7522: Out of bounds rea
This update for MozillaThunderbird fixes the following issues:
Update to Mozilla Thunderbird 115.13 (MFSA 2024-31, bsc#1226316):
Security fixes:
- CVE-2024-6600: Memory corruption in WebGL API (bmo#1888340)
- CVE-2024-6601: Race condition in permission assignment (bmo#1890748)
- CVE-2024-6602: Memory corruption in NSS (bmo#1895032)
- CVE-2024-6603: Memory corruption in thread creation (bmo#1895081)
- CVE-2024-6604: Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13, Thunderbird 128, and Thunderbird 115.13 (bmo#1748105, bmo#1837550, bmo#1884266)
Other fixes:
- fixed: After starting Thunderbird, the message list position was some
This update for MozillaThunderbird fixes the following issues:
Security fixes:
- CVE-2024-34703: Fixed denial of service due to overly large elliptic curve parameters in Botan (bsc#1227239)
Other fixes:
- Mozilla Thunderbird 115.12.1
* 115.12.0 got pulled because of upstream automation process errors
and Windows installer signing changes.
No code changes, changelog is the same as 115.12.0 (bsc#1226495)
This update for MozillaThunderbird fixes the following issues:
- Update to version 115.12.0 ESR (bsc#1226027)
- CVE-2024-5702: Use-after-free in networking
- CVE-2024-5688: Use-after-free in JavaScript object transplant
- CVE-2024-5690: External protocol handlers leaked by timing attack
- CVE-2024-5691: Sandboxed iframes were able to bypass sandbox restrictions to open a new window
- CVE-2024-5692: Bypass of file name restrictions during saving
- CVE-2024-5693: Cross-Origin Image leak via Offscreen Canvas
- CVE-2024-5696: Memory Corruption in Text Fragments
- CVE-2024-5700: Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12, and Thu
This update for MozillaThunderbird fixes the following issues:
Update to version 115.11 (bsc#1224056):
- CVE-2024-4367: Arbitrary JavaScript execution in PDF.js
- CVE-2024-4767: IndexedDB files retained in private browsing mode
- CVE-2024-4768: Potential permissions request bypass via clickjacking
- CVE-2024-4769: Cross-origin responses could be distinguished between script and non-script content-types
- CVE-2024-4770: Use-after-free could occur when printing to PDF
- CVE-2024-4777: Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11, and Thunderbird 115.11
- fixed: Splitter arrow between task list and task description did not behav
This update for MozillaThunderbird fixes the following issues:
Update to Mozilla Thunderbird 115.10.1
Security fixes (MFSA 2024-20) (bsc#1222535):
- CVE-2024-3852: GetBoundName in the JIT returned the wrong object (bmo#1883542)
- CVE-2024-3854: Out-of-bounds-read after mis-optimized switch statement (bmo#1884552)
- CVE-2024-3857: Incorrect JITting of arguments led to use-after-free during garbage collection (bmo#1886683)
- CVE-2024-2609: Permission prompt input delay could expire when not in focus (bmo#1866100)
- CVE-2024-3859: Integer-overflow led to out-of-bounds-read in the OpenType sanitizer (bmo#1874489)
- CVE-2024-3861: Potentia
This update for MozillaThunderbird fixes the following issues:
- Mozilla Thunderbird 115.9 (bsc#1221327)
- CVE-2024-0743: Crash in NSS TLS method
- CVE-2024-2605: Windows Error Reporter could be used as a Sandbox escape vector
- CVE-2024-2607: JIT code failed to save return registers on Armv7-A
- CVE-2024-2608: Integer overflow could have led to out of bounds write
- CVE-2024-2616: Improve handling of out-of-memory conditions in ICU
- CVE-2023-5388: NSS susceptible to timing attack against RSA decryption
- CVE-2024-2610: Improper handling of html and body tags enabled CSP nonce leakage
- CVE-2024-2611: Clickjacking vulnerability could have l
This update for MozillaThunderbird fixes the following issues:
Security Vulnerabilities fixed in Thunderbird 115.8.1 (bsc#1221054):
- CVE-2024-1936: Fixed leaking of encrypted email subjects to other conversations (MFSA 2024-11) (bsc#1221054).
This update for MozillaThunderbird fixes the following issues:
Mozilla Thunderbird 115.8 (bsc#1220048):
- CVE-2024-1546: Out-of-bounds memory read in networking channels
- CVE-2024-1547: Alert dialog could have been spoofed on another site
- CVE-2024-1548: Fullscreen Notification could have been hidden by select element
- CVE-2024-1549: Custom cursor could obscure the permission dialog
- CVE-2024-1550: Mouse cursor re-positioned unexpectedly could have led to unintended permission grants
- CVE-2024-1551: Multipart HTTP Responses would accept the Set-Cookie header in response parts
- CVE-2024-1552: Incorrect code generation on 32-bit ARM dev
This update for MozillaThunderbird fixes the following issues:
Update to Mozilla Thunderbird 115.7 (MFSA 2024-04) (bsc#1218955):
- CVE-2024-0741: Out of bounds write in ANGLE
- CVE-2024-0742: Failure to update user input timestamp
- CVE-2024-0746: Crash when listing printers on Linux
- CVE-2024-0747: Bypass of Content Security Policy when directive unsafe-inline was set
- CVE-2024-0749: Phishing site popup could show local origin in address bar
- CVE-2024-0750: Potential permissions request bypass via clickjacking
- CVE-2024-0751: Privilege escalation through devtools
- CVE-2024-0753: HSTS policy on subdomain could bypass po
This update for MozillaThunderbird fixes the following issues:
Firefox Extended Support Release 115.6.0 ESR (bsc#1217974):
* CVE-2023-6856: Heap-buffer-overflow affecting WebGL DrawElementsInstanced method with Mesa VM driver (bmo#1843782).
* CVE-2023-6857: Symlinks may resolve to smaller than expected buffers (bmo#1796023).
* CVE-2023-6858: Heap buffer overflow in nsTextFragment (bmo#1826791).
* CVE-2023-6859: Use-after-free in PR_GetIdentitiesLayer (bmo#1840144).
* CVE-2023-6860: Potential sandbox escape due to VideoBridge lack of texture validation (bmo#1854669).
* CVE-2023-6861: Heap buffer overflow affected nsWindow::PickerOpen(v
This update for MozillaThunderbird fixes the following issues:
- Mozilla Thunderbird 115.5.0 MFSA 2023-52 (bsc#1217230)
* CVE-2023-6204: Out-of-bound memory access in WebGL2 blitFramebuffer
* CVE-2023-6205: Use-after-free in MessagePort::Entangled
* CVE-2023-6206: Clickjacking permission prompts using the fullscreen transition
* CVE-2023-6207: Use-after-free in ReadableByteStreamQueueEntry::Buffer
* CVE-2023-6208: Using Selection API would copy contents into X11 primary selection.
* CVE-2023-6209: Incorrect parsing of relative URLs starting with '///'
* CVE-2023-6212: Memory safety bugs
This update for MozillaThunderbird fixes the following issues:
- Updated to version 115.4.1:
- CVE-2023-5721: Fixed a potential clickjack via queued up
rendering.
- CVE-2023-5732: Fixed an address bar spoofing via bidirectional
characters
- CVE-2023-5724: Fixed a crash due to a large WebGL draw.
- CVE-2023-5725: Fixed an issue where WebExtensions could open
arbitrary URLs.
- CVE-2023-5726: Fixed an issue where fullscreen notifications would
be obscured by file the open dialog on macOS.
- CVE-2023-5727: Fixed a download protection bypass on on Windows.
- CVE-2023-5728: Fixed a crash caused by improper object tra
This update for MozillaThunderbird fixes the following issues:
Security fixes:
- CVE-2023-5217: Fixed a heap buffer overflow in libvpx. (bsc#1215814)
- CVE-2023-5168: Out-of-bounds write in FilterNodeD2D1. (bsc#1215575)
- CVE-2023-5169: Out-of-bounds write in PathOps. (bsc#1215575)
- CVE-2023-5171: Use-after-free in Ion Compiler. (bsc#1215575)
- CVE-2023-5174: Double-free in process spawning on Windows. (bsc#1215575)
- CVE-2023-5176: Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3, and Thunderbird 115.3. (bsc#1215575)
Other fixes:
- Mozilla Thunderbird 115.3.1
* fixed: In Unified Folders view, some folders had incorrect
un