openSUSE Security Update: Security update for Mozilla Thunderbird ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:2245-1 Rating: moderate References: #952325 #952810 Cross-References: CVE-2015-4513 CVE-2015-4514 CVE-2015-7181 CVE-2015-7182 CVE-2015-7183 CVE-2015-7188 CVE-2015-7189 CVE-2015-7193 CVE-2015-7194 CVE-2015-7196 CVE-2015-7197 CVE-2015-7198 CVE-2015-7199 CVE-2015-7200 Affected Products: openSUSE 13.2 openSUSE 13.1 ______________________________________________________________________________ An update that fixes 14 vulnerabilities is now available. Description: The MozillaThunderbird package was updated to version 38.4.0 to fix several security and non security issues: Changes in MozillaThunderbird: - update to Thunderbird 38.4.0 (bnc#952810) * MFSA 2015-116/CVE-2015-4513/CVE-2015-4514 Miscellaneous memory safety hazards * MFSA 2015-122/CVE-2015-7188 (bmo#1199430) Trailing whitespace in IP address hostnames can bypass same-origin policy * MFSA 2015-123/CVE-2015-7189 (bmo#1205900) Buffer overflow during image interactions in canvas * MFSA 2015-127/CVE-2015-7193 (bmo#1210302) CORS preflight is bypassed when non-standard Content-Type headers are received * MFSA 2015-128/CVE-2015-7194 (bmo#1211262) Memory corruption in libjar through zip files * MFSA 2015-130/CVE-2015-7196 (bmo#1140616) JavaScript garbage collection crash with Java applet * MFSA 2015-131/CVE-2015-7198/CVE-2015-7199/CVE-2015-7200 (bmo#1188010, bmo#1204061, bmo#1204155) Vulnerabilities found through code inspection * MFSA 2015-132/CVE-2015-7197 (bmo#1204269) Mixed content WebSocket policy bypass through workers * MFSA 2015-133/CVE-2015-7181/CVE-2015-7182/CVE-2015-7183 (bmo#1202868, bmo#1205157) NSS and NSPR memory corruption issues (fixed in mozilla-nspr and mozilla-nss packages) - requires NSPR 4.10.10 and NSS 3.19.2.1 - added explicit appdata provides (bnc#952325) - fix build on aarch64 by reusing the crashreporter conditional from MozillaFirefox - fix libjpeg-turbo configuration Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-885=1 - openSUSE 13.1: zypper in -t patch openSUSE-2015-885=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): MozillaThunderbird-38.4.0-31.1 MozillaThunderbird-buildsymbols-38.4.0-31.1 MozillaThunderbird-debuginfo-38.4.0-31.1 MozillaThunderbird-debugsource-38.4.0-31.1 MozillaThunderbird-devel-38.4.0-31.1 MozillaThunderbird-translations-common-38.4.0-31.1 MozillaThunderbird-translations-other-38.4.0-31.1 - openSUSE 13.1 (i586 x86_64): MozillaThunderbird-38.4.0-70.68.1 MozillaThunderbird-buildsymbols-38.4.0-70.68.1 MozillaThunderbird-debuginfo-38.4.0-70.68.1 MozillaThunderbird-debugsource-38.4.0-70.68.1 MozillaThunderbird-devel-38.4.0-70.68.1 MozillaThunderbird-translations-common-38.4.0-70.68.1 MozillaThunderbird-translations-other-38.4.0-70.68.1 References: https://www.suse.com/security/cve/CVE-2015-4513.html https://www.suse.com/security/cve/CVE-2015-4514.html https://www.suse.com/security/cve/CVE-2015-7181.html https://www.suse.com/security/cve/CVE-2015-7182.html https://www.suse.com/security/cve/CVE-2015-7183.html https://www.suse.com/security/cve/CVE-2015-7188.html https://www.suse.com/security/cve/CVE-2015-7189.html https://www.suse.com/security/cve/CVE-2015-7193.html https://www.suse.com/security/cve/CVE-2015-7194.html https://www.suse.com/security/cve/CVE-2015-7196.html https://www.suse.com/security/cve/CVE-2015-7197.html https://www.suse.com/security/cve/CVE-2015-7198.html https://www.suse.com/security/cve/CVE-2015-7199.html https://www.suse.com/security/cve/CVE-2015-7200.html https://bugzilla.suse.com/952325 https://bugzilla.suse.com/952810