Red Hat Security Advisory: thunderbird security update

Fixed packages 3

Vulnerabilities 6

• High 8.8
  CVE-2020-15685

  During the plaintext phase of the STARTTLS connection setup, protocol commands could have been injected and evaluated w…

  Mozilla Thunderbird thunderbird thunderbird Debian Ubuntu Alpine
  Dec 22, 2022
• Unscored —
  CVE-2020-26976

  When a HTTPS pages was embedded in a HTTP page, and there was a service worker registered for the former, the service w…

  Mozilla Firefox thunderbird mozjs38 Browsers Debian Ubuntu Alpine
  Jan 7, 2021
• Unscored —
  CVE-2021-23953

  If a user clicked into a specifically crafted PDF, the PDF reader could be confused into leaking cross-origin informati…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Feb 26, 2021
• Unscored —
  CVE-2021-23954

  Using the new logical assignment operators in a JavaScript switch statement could have caused a type confusion, leading…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Feb 26, 2021
• Unscored —
  CVE-2021-23960

  Performing garbage collection on re-declared JavaScript variables resulted in a user-after-poison, and a potentially ex…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Feb 26, 2021
• Unscored —
  CVE-2021-23964

  Mozilla developers reported memory safety bugs present in Firefox 84 and Firefox ESR 78.6. Some of these bugs showed ev…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Feb 26, 2021

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1920646
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1920648
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1920649
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1920650
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1920651
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1921543
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_0397.json
• report
  https://access.redhat.com/security/cve/CVE-2020-15685
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-15685
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-15685
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2021-05/#CVE-2020-15685
• report
  https://access.redhat.com/security/cve/CVE-2020-26976
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-26976
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-26976
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2021-04/#CVE-2020-26976
• report
  https://access.redhat.com/security/cve/CVE-2021-23953
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-23953
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-23953
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2021-04/#CVE-2021-23953
• report
  https://access.redhat.com/security/cve/CVE-2021-23954
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-23954
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-23954
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2021-04/#CVE-2021-23954
• report
  https://access.redhat.com/security/cve/CVE-2021-23960
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-23960
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-23960
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2021-04/#CVE-2021-23960
• report
  https://access.redhat.com/security/cve/CVE-2021-23964
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-23964
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-23964
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2021-04/#CVE-2021-23964