Skip to content
OpenAdvisories
High ALAS2-2021-1644 12 CVEs

Important: thunderbird security update (Amazon Linux 2)

Published May 20, 2021 · Updated May 24, 2021

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2021-29948: No description is available for this CVE. 1951381: CVE-2021-29948 Mozilla: Race condition when reading from disk while verifying signatures CVE-2021-29946: No description is available for this CVE. 1951371: CVE-2021-29946 Mozilla: Port blocking could be bypassed CVE-2021-29945: No description is available for this CVE. 1951370: CVE-2021-29945 Mozilla: Incorrect size computation in WebAssembly JIT could lead to null-reads CVE-2021-24002: No description is available for this CVE. 1951369: CVE-2021-24002 Mozilla: Arbitrary FTP command execution on FTP servers using an encoded URL CVE-2021-23999: No description is available for this CVE. 1951368: CVE-2021-23999 Mozilla: Blob URLs may have been granted additional privileges CVE-2021-23998: No description is available for this CVE. 1951366: CVE-2021-23998 Mozilla: Secure Lock icon could have been spoofed CVE-2021-23995: No description is available for this CVE. 1951365: CVE-2021-23995 Mozilla: Use-after-free in Responsive Design Mode CVE-2021-23994: No description is available for this CVE. 1951364: CVE-2021-23994 Mozilla: Out of bound write due to lazy initialization CVE-2021-23993: No description is available for this CVE. 1948395: CVE-2021-23993 Mozilla: Inability to send encrypted OpenPGP email after importing a crafted OpenPGP key CVE-2021-23992: No description is available for this CVE. 1948394: CVE-2021-23992 Mozilla: A crafted OpenPGP key with an invalid user ID could be used to confuse the user CVE-2021-23991: No description is available for this CVE. 1948393: CVE-2021-23991 Mozilla: An attacker may use Thunderbird's OpenPGP key refresh mechanism to poison an existing key CVE-2021-23961: Further techniques that built on the slipstream research combined with a malicious webpage could have exposed both an internal network's hosts as well as services running on the user's local machine. This vulnerability affects Firefox < 85. 1951367: CVE-2021-23961 Mozilla: More internal network hosts could have been probed by a malicious webpage

Fixed packages 2

ReleasePackageFixed in
Amazon Linux · 2 thunderbird 0:78.10.0-1.amzn2.0.1
Amazon Linux · 2 thunderbird-debuginfo 0:78.10.0-1.amzn2.0.1

Vulnerabilities 12

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2021-23961.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2021-23991.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2021-23992.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2021-23993.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2021-23994.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2021-23995.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2021-23998.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2021-23999.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2021-24002.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2021-29945.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2021-29946.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2021-29948.html