Red Hat Security Advisory: thunderbird security update

Fixed packages 9

Vulnerabilities 11

• High 8.8
  CVE-2023-6858

  Firefox was susceptible to a heap buffer overflow in `nsTextFragment` due to insufficient OOM handling. This vulnerabil…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Dec 19, 2023
• Unscored —
  CVE-2023-50761

  The signature of a digitally signed S/MIME email message may optionally specify the signature creation date and time. I…

  Mozilla Thunderbird thunderbird thunderbird Debian Ubuntu
  Dec 19, 2023
• Unscored —
  CVE-2023-50762

  When processing a PGP/MIME payload that contains digitally signed text, the first paragraph of the text was never shown…

  Mozilla Thunderbird thunderbird thunderbird Debian Ubuntu
  Dec 19, 2023
• Unscored —
  CVE-2023-6856 EPSS 21%

  The WebGL `DrawElementsInstanced` method was susceptible to a heap buffer overflow when used on systems with the Mesa V…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Dec 19, 2023
• Unscored —
  CVE-2023-6857

  When resolving a symlink, a race may occur where the buffer passed to `readlink` may actually be smaller than necessary…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Dec 19, 2023
• Unscored —
  CVE-2023-6859

  A use-after-free condition affected TLS socket creation when under memory pressure. This vulnerability affects Firefox …

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Dec 19, 2023
• Unscored —
  CVE-2023-6860

  The `VideoBridge` allowed any content process to use textures produced by remote decoders. This could be abused to esca…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Dec 19, 2023
• Unscored —
  CVE-2023-6861

  The `nsWindow::PickerOpen(void)` method was susceptible to a heap buffer overflow when running in headless mode. This v…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Dec 19, 2023
• Unscored —
  CVE-2023-6862

  A use-after-free was identified in the `nsDNSService::Init`. This issue appears to manifest rarely during start-up. Thi…

  Mozilla Thunderbird Firefox ESR thunderbird Browsers Debian Ubuntu Alpine
  Dec 19, 2023
• Unscored —
  CVE-2023-6863

  The `ShutdownObserver()` was susceptible to potentially undefined behavior due to its reliance on a dynamic type that l…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Dec 19, 2023
• Unscored —
  CVE-2023-6864

  Memory safety bugs present in Firefox 120, Firefox ESR 115.5, and Thunderbird 115.5. Some of these bugs showed evidence…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Dec 19, 2023

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2255360
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2255362
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2255363
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2255364
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2255365
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2255367
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2255368
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2255369
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2255370
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2255378
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2255379
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_0028.json
• report
  https://access.redhat.com/security/cve/CVE-2023-6856
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-6856
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-6856
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2023-54/#CVE-2023-6856
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2023-55/#CVE-2023-6856
• report
  https://access.redhat.com/security/cve/CVE-2023-6857
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-6857
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-6857
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2023-54/#CVE-2023-6857
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2023-55/#CVE-2023-6857
• report
  https://access.redhat.com/security/cve/CVE-2023-6858
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-6858
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-6858
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2023-54/#CVE-2023-6858
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2023-55/#CVE-2023-6858
• report
  https://access.redhat.com/security/cve/CVE-2023-6859
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-6859
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-6859
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2023-54/#CVE-2023-6859
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2023-55/#CVE-2023-6859
• report
  https://access.redhat.com/security/cve/CVE-2023-6860
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-6860
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-6860
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2023-54/#CVE-2023-6860
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2023-55/#CVE-2023-6860
• report
  https://access.redhat.com/security/cve/CVE-2023-6861