Mozilla Thunderbird: Mehrere Schwachstellen

Summary

Product

Vulnerabilities 13

• High 8.8
  CVE-2023-0767

  An attacker could construct a PKCS 12 cert bundle in such a way that could allow for arbitrary memory writes via PKCS 1…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Jun 2, 2023
• High 8.8
  CVE-2023-25729

  Permission prompts for opening external schemes were only shown for <code>ContentPrincipals</code> resulting in extensi…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Jun 2, 2023
• High 8.8
  CVE-2023-25732

  When encoding data from an <code>inputStream</code> in <code>xpcom</code> the size of the input being encoded was not c…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Jun 2, 2023
• High 8.8
  CVE-2023-25735

  Cross-compartment wrappers wrapping a scripted proxy could have caused objects from other compartments to be stored in …

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Jun 2, 2023
• High 8.8
  CVE-2023-25737

  An invalid downcast from <code>nsTextNode</code> to <code>SVGElement</code> could have lead to undefined behavior. This…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Jun 2, 2023
• High 8.8
  CVE-2023-25739

  Module load requests that failed were not being checked as to whether or not they were cancelled causing a use-after-fr…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Jun 2, 2023
• High 8.8
  CVE-2023-25746

  Memory safety bugs present in Firefox ESR 102.7. Some of these bugs showed evidence of memory corruption and we presume…

  Mozilla Thunderbird Firefox ESR thunderbird Browsers Debian Ubuntu Alpine
  Jun 2, 2023
• High 8.1
  CVE-2023-25734

  After downloading a Windows <code>.url</code> shortcut from the local filesystem, an attacker could supply a remote pat…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Alpine
  Jun 2, 2023
• Medium 6.5
  CVE-2023-0616

  If a MIME email combines OpenPGP and OpenPGP MIME data in a certain way Thunderbird repeatedly attempts to process and …

  Mozilla Thunderbird thunderbird thunderbird Debian Ubuntu
  Jun 2, 2023
• Medium 6.5
  CVE-2023-25728

  The <code>Content-Security-Policy-Report-Only</code> header could allow an attacker to leak a child iframe's unredacted…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Jun 2, 2023
• Medium 6.5
  CVE-2023-25738

  Members of the <code>DEVMODEW</code> struct set by the printer device driver weren't being validated and could have res…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Alpine
  Jun 2, 2023
• Medium 5.4
  CVE-2023-25730

  A background script invoking <code>requestFullscreen</code> and then blocking the main thread could force the browser i…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Jun 2, 2023
• Unscored —
  CVE-2023-25742

  When importing a SPKI RSA public key as ECDSA P-256, the key would be handled incorrectly causing the tab to crash. Thi…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Jun 2, 2023

Revision history

1. 2023-05-29 #10

   Neue Updates von Gentoo aufgenommen

2. 2023-03-26 #9

   Neue Updates von NetApp aufgenommen

3. 2023-03-22 #8

   Neue Updates von XEROX aufgenommen

4. 2023-03-12 #7

   Neue Updates von Ubuntu aufgenommen

5. 2023-03-06 #6

   Neue Updates von Amazon aufgenommen

6. 2023-03-02 #5

   Neue Updates von SUSE aufgenommen

7. 2023-02-22 #4

   Neue Updates von CentOS aufgenommen

8. 2023-02-20 #3

   Neue Updates von Debian, Oracle Linux und Red Hat aufgenommen

9. 2023-02-19 #2

   Neue Updates von SUSE, Debian und Fedora aufgenommen

10. 2023-02-16 #1

    Initiale Fassung

References

• Gentoo Linux Security Advisory GLSA-202305-36 vom 2023-05-30
  https://security.gentoo.org/glsa/202305-36
• NetApp Security Advisory NTAP-20230324-0008 vom 2023-03-24
  https://security.netapp.com/advisory/ntap-20230324-0008/
• XEROX Security Advisory XRX23-002 vom 2023-03-23
  https://security.business.xerox.com/wp-content/uploads/2023/03/Xerox-Security-Bulletin-XRX23-002-FreeFlow-Print-Server-v2_Windows10.pdf
• Ubuntu Security Notice USN-5943-1 vom 2023-03-13
  https://ubuntu.com/security/notices/USN-5943-1
• Amazon Linux Security Advisory ALAS2-2023-1983 vom 2023-03-07
  https://alas.aws.amazon.com/AL2/ALAS-2023-1983.html
• SUSE Security Update SUSE-SU-2023:0599-1 vom 2023-03-02
  https://lists.suse.com/pipermail/sle-security-updates/2023-March/013965.html
• Mozilla Foundation Security Advisory 2023-07 vom 2023-02-16
  https://www.mozilla.org/en-US/security/advisories/mfsa2023-07/
• SUSE Security Update SUSE-SU-2023:0443-1 vom 2023-02-17
  https://lists.suse.com/pipermail/sle-security-updates/2023-February/013833.html
• Debian Security Advisory DSA-5355 vom 2023-02-19
  https://www.debian.org/security/2023/dsa-5355
• Debian Security Advisory DSA-5353 vom 2023-02-18
  https://www.debian.org/security/2023/dsa-5353
• Debian Security Advisory DLA-3324 vom 2023-02-20
  https://lists.debian.org/debian-lts-announce/2023/02/msg00018.html
• Debian Security Advisory DLA-3327 vom 2023-02-20
  https://lists.debian.org/debian-lts-announce/2023/02/msg00021.html
• Oracle Linux Security Advisory ELSA-2023-0824 vom 2023-02-21
  https://linux.oracle.com/errata/ELSA-2023-0824.html
• Oracle Linux Security Advisory ELSA-2023-0821 vom 2023-02-20
  https://linux.oracle.com/errata/ELSA-2023-0821.html
• Oracle Linux Security Advisory ELSA-2023-0817 vom 2023-02-21
  https://linux.oracle.com/errata/ELSA-2023-0817.html
• Red Hat Security Advisory RHSA-2023:0824 vom 2023-02-20
  https://access.redhat.com/errata/RHSA-2023:0824
• Red Hat Security Advisory RHSA-2023:0823 vom 2023-02-20
  https://access.redhat.com/errata/RHSA-2023:0823
• Red Hat Security Advisory RHSA-2023:0822 vom 2023-02-20
  https://access.redhat.com/errata/RHSA-2023:0822
• Red Hat Security Advisory RHSA-2023:0821 vom 2023-02-20
  https://access.redhat.com/errata/RHSA-2023:0821
• Red Hat Security Advisory RHSA-2023:0820 vom 2023-02-20
  https://access.redhat.com/errata/RHSA-2023:0820
• Red Hat Security Advisory RHSA-2023:0819 vom 2023-02-20
  https://access.redhat.com/errata/RHSA-2023:0819
• Red Hat Security Advisory RHSA-2023:0818 vom 2023-02-20
  https://access.redhat.com/errata/RHSA-2023:0818
• Red Hat Security Advisory RHSA-2023:0817 vom 2023-02-20
  https://access.redhat.com/errata/RHSA-2023:0817
• CentOS Security Advisory CESA-2023:0817 vom 2023-02-22
  https://lists.centos.org/pipermail/centos-announce/2023-February/086375.html