Red Hat Security Advisory: thunderbird security update

Fixed packages 3

Vulnerabilities 9

• Unscored —
  CVE-2021-23961

  Further techniques that built on the slipstream research combined with a malicious webpage could have exposed both an i…

  Mozilla Firefox thunderbird mozjs38 Browsers Debian Ubuntu Alpine
  Feb 26, 2021
• Unscored —
  CVE-2021-23994

  A WebGL framebuffer was not initialized early enough, resulting in memory corruption and an out of bound write. This vu…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Jun 24, 2021
• Unscored —
  CVE-2021-23995

  When Responsive Design Mode was enabled, it used references to objects that were previously freed. We presume that with…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Jun 24, 2021
• Unscored —
  CVE-2021-23998

  Through complicated navigations with new windows, an HTTP page could have inherited a secure lock icon from an HTTPS pa…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Jun 24, 2021
• Unscored —
  CVE-2021-23999

  If a Blob URL was loaded through some unusual user interaction, it could have been loaded by the System Principal and g…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Jun 24, 2021
• Unscored —
  CVE-2021-24002

  When a user clicked on an FTP URL containing encoded newline characters (%0A and %0D), the newlines would have been int…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Jun 24, 2021
• Unscored —
  CVE-2021-29945

  The WebAssembly JIT could miscalculate the size of a return type, which could lead to a null read and result in a crash…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Jun 24, 2021
• Unscored —
  CVE-2021-29946

  Ports that were written as an integer overflow above the bounds of a 16-bit integer could have bypassed port blocking r…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Jun 24, 2021
• Unscored —
  CVE-2021-29948

  Signatures are written to disk before and read during verification, which might be subject to a race condition when a m…

  Mozilla Thunderbird thunderbird thunderbird Debian Ubuntu Alpine
  Jun 24, 2021

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1951364
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1951365
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1951366
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1951367
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1951368
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1951369
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1951370
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1951371
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1951381
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_1351.json
• report
  https://access.redhat.com/security/cve/CVE-2021-23961
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-23961
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-23961
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2021-15/#CVE-2021-23961
• report
  https://access.redhat.com/security/cve/CVE-2021-23994
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-23994
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-23994
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2021-15/#CVE-2021-23994
• report
  https://access.redhat.com/security/cve/CVE-2021-23995
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-23995
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-23995
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2021-15/#CVE-2021-23995
• report
  https://access.redhat.com/security/cve/CVE-2021-23998
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-23998
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-23998
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2021-15/#CVE-2021-23998
• report
  https://access.redhat.com/security/cve/CVE-2021-23999
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-23999
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-23999
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2021-15/#CVE-2021-23999
• report
  https://access.redhat.com/security/cve/CVE-2021-24002
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-24002
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-24002
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2021-15/#CVE-2021-24002
• report
  https://access.redhat.com/security/cve/CVE-2021-29945
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-29945
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-29945
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2021-15/#CVE-2021-29945