Important: thunderbird security update (Amazon Linux 2)

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2021-23964: The Mozilla Foundation Security Advisory describes this flaw as: Mozilla developers reported memory safety bugs present in Firefox 84 and Firefox ESR 78.6. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. 1920651: CVE-2021-23964 Mozilla: Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7 CVE-2021-23960: The Mozilla Foundation Security Advisory describes this flaw as: Performing garbage collection on re-declared JavaScript variables resulted in a user-after-poison, and a potentially exploitable crash. 1920650: CVE-2021-23960 Mozilla: Use-after-poison for incorrectly redeclared JavaScript variables during GC CVE-2021-23954: The Mozilla Foundation Security Advisory describes this flaw as: Using the new logical assignment operators in a JavaScript switch statement could have caused a type confusion, leading to a memory corruption and a potentially exploitable crash. 1920648: CVE-2021-23954 Mozilla: Type confusion when using logical assignment operators in JavaScript switch statements CVE-2021-23953: The Mozilla Foundation Security Advisory describes this flaw as: If a user clicked into a specifically crafted PDF, the PDF reader could be confused into leaking cross-origin information, when said information is served as chunked data. 1920646: CVE-2021-23953 Mozilla: Cross-origin information leakage via redirected PDF requests CVE-2020-26976: The Mozilla Foundation Security Advisory describes this flaw as: When a HTTPS page was embedded in a HTTP page, and there was a service worker registered for the former, the service worker could have intercepted the request for the secure page despite the iframe not being a secure context due to the (insecure) framing. 1920649: CVE-2020-26976 Mozilla: HTTPS pages could have been intercepted by a registered service worker when they should not have been CVE-2020-15685: No description is available for this CVE. 1921543: CVE-2020-15685 Mozilla: IMAP Response Injection when using STARTTLS