Red Hat Security Advisory: thunderbird security update

Fixed packages 3

Vulnerabilities 9

• Critical 9.8
  CVE-2021-43529

  Thunderbird versions prior to 91.3.0 are vulnerable to the heap overflow described in CVE-2021-43527 when processing S/…

  Mozilla Thunderbird thunderbird thunderbird Debian Ubuntu
  Feb 16, 2023
• Unscored —
  CVE-2021-38503

  The iframe sandbox rules were not correctly applied to XSLT stylesheets, allowing an iframe to bypass restrictions such…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Dec 8, 2021
• Unscored —
  CVE-2021-38504

  When interacting with an HTML input element's file picker dialog with webkitdirectory set, a use-after-free could have …

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Dec 8, 2021
• Unscored —
  CVE-2021-38506

  Through a series of navigations, Firefox could have entered fullscreen mode without notification or warning to the user…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Dec 8, 2021
• Unscored —
  CVE-2021-38507

  The Opportunistic Encryption feature of HTTP2 (RFC 8164) allows a connection to be transparently upgraded to TLS while …

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Dec 8, 2021
• Unscored —
  CVE-2021-38508

  By displaying a form validity message in the correct location at the same time as a permission prompt (such as for geol…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Dec 8, 2021
• Unscored —
  CVE-2021-38509

  Due to an unusual sequence of attacker-controlled events, a Javascript alert() dialog with arbitrary (although unstyled…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Dec 8, 2021
• Unscored —
  CVE-2021-43534

  Mozilla developers and community members reported memory safety bugs present in Firefox 93 and Firefox ESR 91.2. Some o…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Dec 8, 2021
• Unscored —
  CVE-2021-43535

  A use-after-free could have occured when an HTTP2 session object was released on a different thread, leading to memory …

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Dec 8, 2021

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2019621
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2019622
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2019624
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2019625
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2019626
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2019627
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2019628
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2019630
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_4130.json
• report
  https://access.redhat.com/security/cve/CVE-2021-38503
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-38503
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-38503
• report
  https://access.redhat.com/security/cve/CVE-2021-38504
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-38504
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-38504
• report
  https://access.redhat.com/security/cve/CVE-2021-38506
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-38506
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-38506
• report
  https://access.redhat.com/security/cve/CVE-2021-38507
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-38507
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-38507
• report
  https://access.redhat.com/security/cve/CVE-2021-38508
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-38508
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-38508
• report
  https://access.redhat.com/security/cve/CVE-2021-38509
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-38509
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-38509
• report
  https://access.redhat.com/security/cve/CVE-2021-43529
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2088353
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-43529
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-43529
• article
  https://access.redhat.com/security/cve/CVE-2021-43527
• article
  https://access.redhat.com/security/vulnerabilities/RHSB-2021-008
• article
  https://bugzilla.mozilla.org/show_bug.cgi?id=1738501
• report
  https://access.redhat.com/security/cve/CVE-2021-43534
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-43534
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-43534
• report
  https://access.redhat.com/security/cve/CVE-2021-43535