Red Hat Security Advisory: thunderbird security update

Fixed packages 3

Vulnerabilities 10

• Unscored —
  CVE-2020-16012 Public exploit

  Side-channel information leakage in graphics in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to leak c…

  Google Chrome chromium chromium-browser Browsers Debian Ubuntu Alpine
  Jan 8, 2021
• Unscored —
  CVE-2020-26951

  A parsing and event loading mismatch in Firefox's SVG code could have allowed load events to fire, even after sanitizat…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Dec 9, 2020
• Unscored —
  CVE-2020-26953

  It was possible to cause the browser to enter fullscreen mode without displaying the security UI; thus making it possib…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Dec 9, 2020
• Unscored —
  CVE-2020-26956

  In some cases, removing HTML elements during sanitization would keep existing SVG event handlers and therefore lead to …

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Dec 9, 2020
• Unscored —
  CVE-2020-26958

  Firefox did not block execution of scripts with incorrect MIME types when the response was intercepted and cached throu…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Dec 9, 2020
• Unscored —
  CVE-2020-26959

  During browser shutdown, reference decrementing could have occured on a previously freed object, resulting in a use-aft…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Dec 9, 2020
• Unscored —
  CVE-2020-26960

  If the Compact() method was called on an nsTArray, the array could have been reallocated without updating other pointer…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Dec 9, 2020
• Unscored —
  CVE-2020-26961

  When DNS over HTTPS is in use, it intentionally filters RFC1918 and related IP ranges from the responses as these do no…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Dec 9, 2020
• Unscored —
  CVE-2020-26965

  Some websites have a feature "Show Password" where clicking a button will change a password field into a textbook field…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Dec 9, 2020
• Unscored —
  CVE-2020-26968

  Mozilla developers reported memory safety bugs present in Firefox 82 and Firefox ESR 78.4. Some of these bugs showed ev…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Dec 9, 2020

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1898731
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1898732
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1898733
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1898734
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1898735
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1898736
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1898737
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1898738
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1898739
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1898741
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_5240.json
• report
  https://access.redhat.com/security/cve/CVE-2020-16012
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-16012
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-16012
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2020-51/#CVE-2020-16012
• report
  https://access.redhat.com/security/cve/CVE-2020-26951
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-26951
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-26951
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2020-51/#CVE-2020-26951
• report
  https://access.redhat.com/security/cve/CVE-2020-26953
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-26953
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-26953
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2020-51/#CVE-2020-26953
• report
  https://access.redhat.com/security/cve/CVE-2020-26956
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-26956
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-26956
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2020-51/#CVE-2020-26956
• report
  https://access.redhat.com/security/cve/CVE-2020-26958
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-26958
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-26958
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2020-51/#CVE-2020-26958
• report
  https://access.redhat.com/security/cve/CVE-2020-26959
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-26959
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-26959
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2020-51/#CVE-2020-26959
• report
  https://access.redhat.com/security/cve/CVE-2020-26960
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-26960
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-26960