Security update for MozillaThunderbird

Announcement ID:	SUSE-SU-2023:4016-1
Rating:	critical
References:	#1210168 #1215309 #1215575 #1215814
Cross-References:	CVE-2023-5168 CVE-2023-5169 CVE-2023-5171 CVE-2023-5174 CVE-2023-5176 CVE-2023-5217
CVSS scores:	CVE-2023-5168 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2023-5169 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2023-5171 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2023-5174 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2023-5176 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2023-5217 ( SUSE ): 8.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2023-5217 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected Products:	openSUSE Leap 15.4 openSUSE Leap 15.5 SUSE Linux Enterprise Desktop 15 SP4 SUSE Linux Enterprise Desktop 15 SP5 SUSE Linux Enterprise High Performance Computing 15 SP4 SUSE Linux Enterprise High Performance Computing 15 SP5 SUSE Linux Enterprise Micro 5.3 SUSE Linux Enterprise Micro 5.4 SUSE Linux Enterprise Micro 5.5 SUSE Linux Enterprise Real Time 15 SP4 SUSE Linux Enterprise Real Time 15 SP5 SUSE Linux Enterprise Server 15 SP4 SUSE Linux Enterprise Server 15 SP5 SUSE Linux Enterprise Server for SAP Applications 15 SP4 SUSE Linux Enterprise Server for SAP Applications 15 SP5 SUSE Linux Enterprise Workstation Extension 15 SP4 SUSE Linux Enterprise Workstation Extension 15 SP5 SUSE Manager Proxy 4.3 SUSE Manager Retail Branch Server 4.3 SUSE Manager Server 4.3 SUSE Package Hub 15 15-SP4 SUSE Package Hub 15 15-SP5

An update that solves six vulnerabilities can now be installed.

Description:

This update for MozillaThunderbird fixes the following issues:

Security fixes: - CVE-2023-5217: Fixed a heap buffer overflow in libvpx. (bsc#1215814) - CVE-2023-5168: Out-of-bounds write in FilterNodeD2D1. (bsc#1215575) - CVE-2023-5169: Out-of-bounds write in PathOps. (bsc#1215575) - CVE-2023-5171: Use-after-free in Ion Compiler. (bsc#1215575) - CVE-2023-5174: Double-free in process spawning on Windows. (bsc#1215575) - CVE-2023-5176: Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3, and Thunderbird 115.3. (bsc#1215575)

Other fixes:

• Mozilla Thunderbird 115.3.1
• fixed: In Unified Folders view, some folders had incorrect unified folder parent (bmo#1852525)
• fixed: "Edit message as new" did not restore encrypted subject from selected message (bmo#1788534)
• fixed: Importing some CalDAV calendars with yearly recurrence events caused Thunderbird to freeze (bmo#1850732)
• fixed: Security fixes MFSA 2023-44 (bsc#1215814)
• CVE-2023-5217 (bmo#1855550) Heap buffer overflow in libvpx
• Mozilla Thunderbird 115.3
• fixed: Thunderbird could not import profiles with hostname ending in dot (".") (bmo#1825374)
• fixed: Message header was occasionally missing in message preview (bmo#1840943)
• fixed: Setting an existing folder's type flag did not add descendant folders to the Unified Folders view (bmo#1848904)
• fixed: Thunderbird did not always delete all temporary mail files, sometimes preventing messages from being sent (bmo#673703)
• fixed: Status bar in Message Compose window could not be hidden (bmo#1806860)
• fixed: Message header was intermittently missing from message preview (bmo#1840943)
• fixed: OAuth2 did not work on some profiles created in Thunderbird 102.6.1 or earlier (bmo#1814823)
• fixed: In Vertical View, decrypted subject lines were displayed as ellipsis ("...") in message list (bmo#1831764)
• fixed: Condensed address preference (mail.showCondensedAddresses) did not show condensed addresses in message list (bmo#1831280)
• fixed: Spam folder could not be assigned non-ASCII names with IMAP UTF-8 enabled (bmo#1816332)
• fixed: Message header was not displayed until images finished loading, causing noticeable delay for messages containing large images (bmo#1851871)
• fixed: Large SVG favicons did not display on RSS feeds (bmo#1853895)
• fixed: Context menu items did not display a hover background color (bmo#1852732)
• fixed: Security fixes MFSA 2023-43 (bsc#1215575)
• CVE-2023-5168 (bmo#1846683) Out-of-bounds write in FilterNodeD2D1
• CVE-2023-5169 (bmo#1846685) Out-of-bounds write in PathOps
• CVE-2023-5171 (bmo#1851599) Use-after-free in Ion Compiler
• CVE-2023-5174 (bmo#1848454) Double-free in process spawning on Windows
• CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824, bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983, bmo#1851195) Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3, and Thunderbird 115.3
• Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build with newer binutils (bsc#1215309)
• Fix i586 build by reducing debug info to -g1. (bsc#1210168)
• Mozilla Thunderbird 115.2.3
• changed: Card view and vertical layout are now default for new profiles (bmo#1849000)
• fixed: Go - Folder menu was disabled (bmo#1849919)
• fixed: "Tools" menu was blank when opened from compose window on macOS (bmo#1848155)
• fixed: Deleting an attachment from a message on an IMAP server corrupted the local copy when configured with "mark as deleted" (bmo#1135434)
• fixed: Manually entered passwords were not remembered for OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
• fixed: Quick Filter's "Keep filters applied" did not persist after restarting Thunderbird (bmo#1846880,bmo#1849221)
• fixed: Top-level Quick Filter settings did not persist after restart (bmo#1849249)
• fixed: Notifications for new messages with non-ASCII characters in the subject were garbled (bmo#1842384)
• fixed: "Mark Thread As Read" did not work when some messages in thread were already read (bmo#1850850)
• fixed: New Groups tab in NNTP subscribe dialog id not work as expected (bmo#1848366)
• fixed: Negative values were allowed in "Share for files larger than" field (bmo#1850281)
• fixed: Thunderbird sometimes crashed when deleting a parent folder with subfolders (bmo#1851293)
• fixed: "Send Message Error" appeared intermittently while Thunderbird was idle (bmo#1801668)
• fixed: Focused but not selected messages were missing visual indication of focus in card view (bmo#1844263)
• fixed: Notification dot did not disappear from taskbar icon on Windows after messages had already been read (bmo#1824889)
• fixed: Multiple selected messages could not be opened simultaneously if selection included more than 19 messages (bmo#1851563)
• fixed: Email replies received via BCC incorrectly populated From field with default identity (bmo#1851512)
• fixed: User was not always notified of message send failures in outbox (bmo#1851542)
• fixed: Tag dialog did not close properly after editing tag (bmo#1852414)
• fixed: Newsgroup field in compose window did not autocomplete with suggested newsgroup names (bmo#1670457)
• fixed: Canceling newsgroup messages did not check if sender matched user's own identity (bmo#1823274)
• fixed: Event dialog with several invitees expanded beyond screen height (bmo#1848261)
• fixed: Message check boxes were partially obstructed in message list (bmo#1850760)
• unresolved: Some folders missing from Unified Folders ()

Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:

• openSUSE Leap 15.4
  zypper in -t patch openSUSE-SLE-15.4-2023-4016=1
• openSUSE Leap 15.5
  zypper in -t patch openSUSE-SLE-15.5-2023-4016=1
• SUSE Package Hub 15 15-SP4
  zypper in -t patch SUSE-SLE-Module-Packagehub-Subpackages-15-SP4-2023-4016=1
• SUSE Package Hub 15 15-SP5
  zypper in -t patch SUSE-SLE-Module-Packagehub-Subpackages-15-SP5-2023-4016=1
• SUSE Linux Enterprise Workstation Extension 15 SP4
  zypper in -t patch SUSE-SLE-Product-WE-15-SP4-2023-4016=1
• SUSE Linux Enterprise Workstation Extension 15 SP5
  zypper in -t patch SUSE-SLE-Product-WE-15-SP5-2023-4016=1

Package List:

• openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64)
  • MozillaThunderbird-debuginfo-115.3.1-150200.8.133.1
  • MozillaThunderbird-translations-other-115.3.1-150200.8.133.1
  • MozillaThunderbird-translations-common-115.3.1-150200.8.133.1
  • MozillaThunderbird-debugsource-115.3.1-150200.8.133.1
  • MozillaThunderbird-115.3.1-150200.8.133.1
• openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64)
  • MozillaThunderbird-debuginfo-115.3.1-150200.8.133.1
  • MozillaThunderbird-translations-other-115.3.1-150200.8.133.1
  • MozillaThunderbird-translations-common-115.3.1-150200.8.133.1
  • MozillaThunderbird-debugsource-115.3.1-150200.8.133.1
  • MozillaThunderbird-115.3.1-150200.8.133.1
• SUSE Package Hub 15 15-SP4 (aarch64 ppc64le s390x)
  • MozillaThunderbird-debuginfo-115.3.1-150200.8.133.1
  • MozillaThunderbird-translations-other-115.3.1-150200.8.133.1
  • MozillaThunderbird-translations-common-115.3.1-150200.8.133.1
  • MozillaThunderbird-debugsource-115.3.1-150200.8.133.1
  • MozillaThunderbird-115.3.1-150200.8.133.1
• SUSE Package Hub 15 15-SP5 (aarch64 ppc64le s390x)
  • MozillaThunderbird-debuginfo-115.3.1-150200.8.133.1
  • MozillaThunderbird-translations-other-115.3.1-150200.8.133.1
  • MozillaThunderbird-translations-common-115.3.1-150200.8.133.1
  • MozillaThunderbird-debugsource-115.3.1-150200.8.133.1
  • MozillaThunderbird-115.3.1-150200.8.133.1
• SUSE Linux Enterprise Workstation Extension 15 SP4 (x86_64)
  • MozillaThunderbird-debuginfo-115.3.1-150200.8.133.1
  • MozillaThunderbird-translations-other-115.3.1-150200.8.133.1
  • MozillaThunderbird-translations-common-115.3.1-150200.8.133.1
  • MozillaThunderbird-debugsource-115.3.1-150200.8.133.1
  • MozillaThunderbird-115.3.1-150200.8.133.1
• SUSE Linux Enterprise Workstation Extension 15 SP5 (x86_64)
  • MozillaThunderbird-debuginfo-115.3.1-150200.8.133.1
  • MozillaThunderbird-translations-other-115.3.1-150200.8.133.1
  • MozillaThunderbird-translations-common-115.3.1-150200.8.133.1
  • MozillaThunderbird-debugsource-115.3.1-150200.8.133.1
  • MozillaThunderbird-115.3.1-150200.8.133.1

References:

• https://www.suse.com/security/cve/CVE-2023-5168.html
• https://www.suse.com/security/cve/CVE-2023-5169.html
• https://www.suse.com/security/cve/CVE-2023-5171.html
• https://www.suse.com/security/cve/CVE-2023-5174.html
• https://www.suse.com/security/cve/CVE-2023-5176.html
• https://www.suse.com/security/cve/CVE-2023-5217.html
• https://bugzilla.suse.com/show_bug.cgi?id=1210168
• https://bugzilla.suse.com/show_bug.cgi?id=1215309
• https://bugzilla.suse.com/show_bug.cgi?id=1215575
• https://bugzilla.suse.com/show_bug.cgi?id=1215814