Red Hat Security Advisory: thunderbird security update

Fixed packages 9

Vulnerabilities 10

• Unscored —
  CVE-2023-3417

  File Extension Spoofing using the Text Direction Override Character

  Thunderbird allowed the Text Direction Override Unicode Character in filenames. An email attachment could be incorrectly shown as being a document file, while in fact it was an executable file. Newer versions of Thunderbird will strip the character and show t…

  Mozilla Thunderbird thunderbird thunderbird Debian Ubuntu
  Jul 24, 2023
• Unscored —
  CVE-2023-4045

  Offscreen Canvas did not properly track cross-origin tainting, which could have been used to access image data from ano…

  Mozilla Firefox Firefox ESR thunderbird Browsers Debian Ubuntu Alpine
  Aug 1, 2023
• Unscored —
  CVE-2023-4046

  In some circumstances, a stale value could have been used for a global variable in WASM JIT analysis. This resulted in …

  Mozilla Firefox Firefox ESR thunderbird Browsers Debian Ubuntu Alpine
  Aug 1, 2023
• Unscored —
  CVE-2023-4047

  A bug in popup notifications delay calculation could have made it possible for an attacker to trick a user into grantin…

  Mozilla Firefox Firefox ESR thunderbird Browsers Debian Ubuntu Alpine
  Aug 1, 2023
• Unscored —
  CVE-2023-4048

  An out-of-bounds read could have led to an exploitable crash when parsing HTML with DOMParser in low memory situations.…

  Mozilla Firefox Firefox ESR thunderbird Browsers Debian Ubuntu Alpine
  Aug 1, 2023
• Unscored —
  CVE-2023-4049

  Race conditions in reference counting code were found through code inspection. These could have resulted in potentially…

  Mozilla Firefox Firefox ESR thunderbird Browsers Debian Ubuntu Alpine
  Aug 1, 2023
• Unscored —
  CVE-2023-4050 EPSS 13%

  In some cases, an untrusted input stream was copied to a stack buffer without checking its size. This resulted in a pot…

  Mozilla Firefox Firefox ESR thunderbird Browsers Debian Ubuntu Alpine
  Aug 1, 2023
• Unscored —
  CVE-2023-4055

  When the number of cookies per domain was exceeded in `document.cookie`, the actual cookie jar sent to the host was no …

  Mozilla Firefox Firefox ESR thunderbird Browsers Debian Ubuntu Alpine
  Aug 1, 2023
• Unscored —
  CVE-2023-4056

  Memory safety bugs present in Firefox 115, Firefox ESR 115.0, Firefox ESR 102.13, Thunderbird 115.0, and Thunderbird 10…

  Mozilla Firefox Firefox ESR thunderbird Browsers Debian Ubuntu Alpine
  Aug 1, 2023
• Unscored —
  CVE-2023-4057

  Memory safety bugs present in Firefox 115, Firefox ESR 115.0, and Thunderbird 115.0. Some of these bugs showed evidence…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Aug 1, 2023

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2225325
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2228360
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2228361
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2228362
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2228363
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2228364
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2228365
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2228367
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2228370
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2228371
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_4496.json
• report
  https://access.redhat.com/security/cve/CVE-2023-3417
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-3417
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-3417
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2023-27/#CVE-2023-3417
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2023-28/#CVE-2023-3417
• report
  https://access.redhat.com/security/cve/CVE-2023-4045
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-4045
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-4045
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2023-30/#CVE-2023-4045
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2023-31/#CVE-2023-4045
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2023-32/#CVE-2023-4045
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2023-33/#CVE-2023-4045
• report
  https://access.redhat.com/security/cve/CVE-2023-4046
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-4046
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-4046
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2023-30/#CVE-2023-4046
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2023-31/#CVE-2023-4046
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2023-32/#CVE-2023-4046
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2023-33/#CVE-2023-4046
• report
  https://access.redhat.com/security/cve/CVE-2023-4047
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-4047
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-4047
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2023-30/#CVE-2023-4047
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2023-31/#CVE-2023-4047
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2023-32/#CVE-2023-4047
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2023-33/#CVE-2023-4047
• report
  https://access.redhat.com/security/cve/CVE-2023-4048