Red Hat Security Advisory: thunderbird security update

Fixed packages 3

Vulnerabilities 6

• High 8.8
  CVE-2023-0767

  An attacker could construct a PKCS 12 cert bundle in such a way that could allow for arbitrary memory writes via PKCS 1…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Jun 2, 2023
• High 8.8
  CVE-2023-28162

  While implementing AudioWorklets, some code may have casted one type to another, invalid, dynamic type. This could have…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Jun 2, 2023
• High 8.8
  CVE-2023-28176

  Memory safety bugs present in Firefox 110 and Firefox ESR 102.8. Some of these bugs showed evidence of memory corruptio…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Jun 2, 2023
• Medium 6.5
  CVE-2023-28164

  Dragging a URL from a cross-origin iframe that was removed during the drag could have led to user confusion and website…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Jun 2, 2023
• Unscored —
  CVE-2023-25751

  Sometimes, when invalidating JIT code while following an iterator, the newly generated code could be overwritten incorr…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Jun 2, 2023
• Unscored —
  CVE-2023-25752

  When accessing throttled streams, the count of available bytes needed to be checked in the calling function to be withi…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Jun 2, 2023

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2178458
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2178460
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2178466
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2178470
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2178472
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_1472.json
• report
  https://access.redhat.com/security/cve/CVE-2023-0767
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2170377
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-0767
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-0767
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2023-06/#CVE-2023-0767
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2023-07/#CVE-2023-0767
• report
  https://access.redhat.com/security/cve/CVE-2023-25751
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-25751
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-25751
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2023-10/#CVE-2023-25751
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2023-11/#CVE-2023-25751
• report
  https://access.redhat.com/security/cve/CVE-2023-25752
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-25752
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-25752
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2023-10/#CVE-2023-25752
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2023-11/#CVE-2023-25752
• report
  https://access.redhat.com/security/cve/CVE-2023-28162
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-28162
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-28162
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2023-10/#CVE-2023-28162
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2023-11/#CVE-2023-28162
• report
  https://access.redhat.com/security/cve/CVE-2023-28164
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-28164
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-28164
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2023-10/#CVE-2023-28164
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2023-11/#CVE-2023-28164
• report
  https://access.redhat.com/security/cve/CVE-2023-28176
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-28176
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-28176
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2023-10/#CVE-2023-28176
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2023-11/#CVE-2023-28176