Summary
Mozilla Thunderbird is a standalone mail and newsgroup client.
This update upgrades Thunderbird to version 102.13.0.
Security Fix(es):
* Mozilla: Use-after-free in WebRTC certificate generation (CVE-2023-37201)
* Mozilla: Potential use-after-free from compartment mismatch in SpiderMonkey (CVE-2023-37202)
* Mozilla: Memory safety bugs fixed in Firefox 115, Firefox ESR 102.13, and Thunderbird 102.13 (CVE-2023-37211)
* Mozilla: Fullscreen notification obscured (CVE-2023-37207)
* Mozilla: Lack of warning when opening Diagcab files (CVE-2023-37208)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Rocky Linux · 8 | thunderbird | 0:102.13.0-2.el8_8 |
Vulnerabilities 5
-
Unscored —
An attacker could have triggered a use-after-free condition when creating a WebRTC connection over HTTPS. This vulnerab…
-
Unscored —
Cross-compartment wrappers wrapping a scripted proxy could have caused objects from other compartments to be stored in …
-
Unscored —
A website could have obscured the fullscreen notification by using a URL with a scheme handled by an external program, …
-
Unscored —
When opening Diagcab files, Firefox did not warn the user that these files may contain malicious code. This vulnerabili…
-
Unscored —
Memory safety bugs present in Firefox 114, Firefox ESR 102.12, and Thunderbird 102.12. Some of these bugs showed eviden…