Summary
Mozilla Thunderbird is a standalone mail and newsgroup client.
This update upgrades Thunderbird to version 102.11.0.
Security Fix(es):
* Mozilla: Browser prompts could have been obscured by popups (CVE-2023-32205)
* Mozilla: Crash in RLBox Expat driver (CVE-2023-32206)
* Mozilla: Potential permissions request bypass via clickjacking (CVE-2023-32207)
* Mozilla: Memory safety bugs fixed in Firefox 113 and Firefox ESR 102.11 (CVE-2023-32215)
* Mozilla: Content process crash due to invalid wasm code (CVE-2023-32211)
* Mozilla: Potential spoof due to obscured address bar (CVE-2023-32212)
* Mozilla: Potential memory corruption in FileReader::DoReadData() (CVE-2023-32213)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux · 8 | thunderbird | 102.11.0-1.el8_7.alma |
Vulnerabilities 7
-
High 8.8
A missing delay in popup notifications could have made it possible for an attacker to trick a user into granting permis…
-
Unscored —
In multiple cases browser prompts could have been obscured by popups controlled by content. These could have led to pot…
-
Unscored —
An out-of-bound read could have led to a crash in the RLBox Expat driver. This vulnerability affects Firefox < 113, Fir…
-
Unscored —
A type checking bug would have led to invalid code being compiled. This vulnerability affects Firefox < 113, Firefox ES…
-
Unscored —
An attacker could have positioned a `datalist` element to obscure the address bar. This vulnerability affects Firefox <…
-
Unscored —
When reading a file, an uninitialized value could have been used as read limit. This vulnerability affects Firefox < 11…
-
Unscored —
Mozilla developers and community members Gabriele Svelto, Andrew Osmond, Emily McDonough, Sebastian Hengst, Andrew McCr…
References
-
report
https://access.redhat.com/security/cve/CVE-2023-32205
-
report
https://access.redhat.com/security/cve/CVE-2023-32206
-
report
https://access.redhat.com/security/cve/CVE-2023-32207
-
report
https://access.redhat.com/security/cve/CVE-2023-32211
-
report
https://access.redhat.com/security/cve/CVE-2023-32212
-
report
https://access.redhat.com/security/cve/CVE-2023-32213
-
report
https://access.redhat.com/security/cve/CVE-2023-32215
-
report
https://bugzilla.redhat.com/2196736
-
report
https://bugzilla.redhat.com/2196737
-
report
https://bugzilla.redhat.com/2196738
-
report
https://bugzilla.redhat.com/2196740
-
report
https://bugzilla.redhat.com/2196741
-
report
https://bugzilla.redhat.com/2196742
-
report
https://bugzilla.redhat.com/2196753
-
advisory
https://errata.almalinux.org/8/ALSA-2023-3221.html