Red Hat Security Advisory: thunderbird security update

Fixed packages 3

Vulnerabilities 12

• High 8.8
  CVE-2023-25729

  Permission prompts for opening external schemes were only shown for <code>ContentPrincipals</code> resulting in extensi…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Jun 2, 2023
• High 8.8
  CVE-2023-25732

  When encoding data from an <code>inputStream</code> in <code>xpcom</code> the size of the input being encoded was not c…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Jun 2, 2023
• High 8.8
  CVE-2023-25735

  Cross-compartment wrappers wrapping a scripted proxy could have caused objects from other compartments to be stored in …

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Jun 2, 2023
• High 8.8
  CVE-2023-25737

  An invalid downcast from <code>nsTextNode</code> to <code>SVGElement</code> could have lead to undefined behavior. This…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Jun 2, 2023
• High 8.8
  CVE-2023-25739

  Module load requests that failed were not being checked as to whether or not they were cancelled causing a use-after-fr…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Jun 2, 2023
• High 8.8
  CVE-2023-25746

  Memory safety bugs present in Firefox ESR 102.7. Some of these bugs showed evidence of memory corruption and we presume…

  Mozilla Thunderbird Firefox ESR thunderbird Browsers Debian Ubuntu Alpine
  Jun 2, 2023
• Medium 6.5
  CVE-2023-0616

  If a MIME email combines OpenPGP and OpenPGP MIME data in a certain way Thunderbird repeatedly attempts to process and …

  Mozilla Thunderbird thunderbird thunderbird Debian Ubuntu
  Jun 2, 2023
• Medium 6.5
  CVE-2023-25728

  The <code>Content-Security-Policy-Report-Only</code> header could allow an attacker to leak a child iframe's unredacted…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Jun 2, 2023
• Medium 5.4
  CVE-2023-25730

  A background script invoking <code>requestFullscreen</code> and then blocking the main thread could force the browser i…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Jun 2, 2023
• Unscored —
  CVE-2023-25742

  When importing a SPKI RSA public key as ECDSA P-256, the key would be handled incorrectly causing the tab to crash. Thi…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Jun 2, 2023
• Unscored —
  CVE-2023-25743

  A lack of in app notification for entering fullscreen mode could have lead to a malicious website spoofing browser chro…

  Mozilla Firefox Firefox ESR Browsers
  Jun 2, 2023
• Unscored —
  CVE-2023-25744

  Mmemory safety bugs present in Firefox 109 and Firefox ESR 102.7. Some of these bugs showed evidence of memory corrupti…

  Mozilla Firefox Firefox ESR mozjs38 Browsers Debian Ubuntu Alpine
  Jun 2, 2023

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2170374
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2170375
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2170376
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2170378
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2170379
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2170381
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2170382
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2170383
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2170390
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2170391
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2170402
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2171397
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_0820.json
• report
  https://access.redhat.com/security/cve/CVE-2023-0616
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-0616
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-0616
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2023-07/#CVE-2023-0616
• report
  https://access.redhat.com/security/cve/CVE-2023-25728
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-25728
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-25728
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2023-06/#CVE-2023-25728
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2023-07/#CVE-2023-25728
• report
  https://access.redhat.com/security/cve/CVE-2023-25729
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-25729
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-25729
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2023-06/#CVE-2023-25729
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2023-07/#CVE-2023-25729
• report
  https://access.redhat.com/security/cve/CVE-2023-25730
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-25730
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-25730
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2023-06/#CVE-2023-25730
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2023-07/#CVE-2023-25730
• report
  https://access.redhat.com/security/cve/CVE-2023-25732
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-25732
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-25732
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2023-06/#CVE-2023-25732
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2023-07/#CVE-2023-25732
• report
  https://access.redhat.com/security/cve/CVE-2023-25735