Red Hat Security Advisory: thunderbird security update

Fixed packages 3

Vulnerabilities 8

• Unscored —
  CVE-2020-16042

  Uninitialized Use in V8 in Google Chrome prior to 87.0.4280.88 allowed a remote attacker to obtain potentially sensitiv…

  Google Chrome chromium chromium-browser Browsers Debian Ubuntu Alpine
  Jan 8, 2021
• Unscored —
  CVE-2020-26970

  When reading SMTP server status codes, Thunderbird writes an integer value to a position on the stack that is intended …

  Mozilla Thunderbird thunderbird thunderbird Debian Ubuntu Alpine
  Dec 9, 2020
• Unscored —
  CVE-2020-26971

  Certain blit values provided by the user were not properly constrained leading to a heap buffer overflow on some video …

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Jan 7, 2021
• Unscored —
  CVE-2020-26973

  Certain input to the CSS Sanitizer confused it, resulting in incorrect components being removed. This could have been u…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Jan 7, 2021
• Unscored —
  CVE-2020-26974

  When flex-basis was used on a table wrapper, a StyleGenericFlexBasis object could have been incorrectly cast to the wro…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Jan 7, 2021
• Unscored —
  CVE-2020-26978

  Using techniques that built on the slipstream research, a malicious webpage could have exposed both an internal network…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Jan 7, 2021
• Unscored —
  CVE-2020-35111

  When an extension with the proxy permission registered to receive <all_urls>, the proxy.onRequest callback was not trig…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Jan 7, 2021
• Unscored —
  CVE-2020-35113

  Mozilla developers reported memory safety bugs present in Firefox 83 and Firefox ESR 78.5. Some of these bugs showed ev…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Jan 7, 2021

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1903443
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1904515
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1908022
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1908023
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1908024
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1908025
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1908027
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1908029
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_5645.json
• report
  https://access.redhat.com/security/cve/CVE-2020-16042
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-16042
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-16042
• article
  https://chromereleases.googleblog.com/2020/12/stable-channel-update-for-desktop.html
• report
  https://access.redhat.com/security/cve/CVE-2020-26970
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-26970
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-26970
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2020-53/#CVE-2020-26970
• report
  https://access.redhat.com/security/cve/CVE-2020-26971
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-26971
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-26971
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2020-55/#CVE-2020-26971
• report
  https://access.redhat.com/security/cve/CVE-2020-26973
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-26973
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-26973
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2020-55/#CVE-2020-26973
• report
  https://access.redhat.com/security/cve/CVE-2020-26974
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-26974
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-26974
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2020-55/#CVE-2020-26974
• report
  https://access.redhat.com/security/cve/CVE-2020-26978
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-26978
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-26978
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2020-55/#CVE-2020-26978
• report
  https://access.redhat.com/security/cve/CVE-2020-35111
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-35111
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-35111
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2020-55/#CVE-2020-35111
• report
  https://access.redhat.com/security/cve/CVE-2020-35113