Red Hat Security Advisory: thunderbird security update

Fixed packages 9

Vulnerabilities 7

• High 7.5
  CVE-2023-5724

  Drivers are not always robust to extremely large draw calls and in some cases this scenario could have led to a crash. …

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Oct 24, 2023
• High 7.5
  CVE-2023-5728

  During garbage collection extra operations were performed on a object that should not be. This could have led to a pote…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Oct 24, 2023
• Unscored —
  CVE-2023-44488

  VP9 in libvpx before 1.13.1 mishandles widths, leading to a crash related to encoding.

  mozjs38 mozjs52 mozjs68 mozjs78 Debian Ubuntu Azure Linux
  Sep 30, 2023
• Unscored —
  CVE-2023-5721

  It was possible for certain browser prompts and dialogs to be activated or dismissed unintentionally by the user due to…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Oct 24, 2023
• Unscored —
  CVE-2023-5725

  A malicious installed WebExtension could open arbitrary URLs, which under the right circumstance could be leveraged to …

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Oct 24, 2023
• Unscored —
  CVE-2023-5730

  Memory safety bugs present in Firefox 118, Firefox ESR 115.3, and Thunderbird 115.3. Some of these bugs showed evidence…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Oct 24, 2023
• Unscored —
  CVE-2023-5732

  Address bar spoofing via bidirectional characters

  An attacker could have created a malicious link using bidirectional characters to spoof the location in the address bar when visited. This vulnerability affects Firefox < 117, Firefox ESR < 115.4, and Thunderbird < 115.4.1.

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Oct 24, 2023

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2241806
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2245896
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2245898
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2245899
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2245900
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2245903
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2245906
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_6196.json
• report
  https://access.redhat.com/security/cve/CVE-2023-5721
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-5721
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-5721
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2023-46/#CVE-2023-5721
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2023-47/#CVE-2023-5721
• report
  https://access.redhat.com/security/cve/CVE-2023-5724
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-5724
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-5724
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2023-46/#CVE-2023-5724
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2023-47/#CVE-2023-5724
• report
  https://access.redhat.com/security/cve/CVE-2023-5725
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-5725
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-5725
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2023-46/#CVE-2023-5725
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2023-47/#CVE-2023-5725
• report
  https://access.redhat.com/security/cve/CVE-2023-5728
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-5728
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-5728
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2023-46/#CVE-2023-5728
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2023-47/#CVE-2023-5728
• report
  https://access.redhat.com/security/cve/CVE-2023-5730
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-5730
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-5730
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2023-46/#CVE-2023-5730
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2023-47/#CVE-2023-5730
• report
  https://access.redhat.com/security/cve/CVE-2023-5732
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-5732
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-5732
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2023-46/#CVE-2023-5732
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2023-47/#CVE-2023-5732