Mailinglist Archive: opensuse-security-announce (115 mails)

< Previous Next >
[security-announce] openSUSE-SU-2018:1359-1: important: Security update for Mozilla Thunderbird
openSUSE Security Update: Security update for Mozilla Thunderbird

Announcement ID: openSUSE-SU-2018:1359-1
Rating: important
References: #1092548 #1093152
Cross-References: CVE-2018-5150 CVE-2018-5154 CVE-2018-5155
CVE-2018-5159 CVE-2018-5161 CVE-2018-5162
CVE-2018-5168 CVE-2018-5170 CVE-2018-5174
CVE-2018-5178 CVE-2018-5183 CVE-2018-5184
Affected Products:
SUSE Package Hub for SUSE Linux Enterprise 12

An update that fixes 13 vulnerabilities is now available.


This update for Mozilla Thunderbird to version 52.8 fixes the following

Security issues fixed (MFSA 2018-13, boo#1092548):

- CVE-2018-5183: Backport critical security fixes in Skia
- CVE-2018-5154: Use-after-free with SVG animations and clip paths
- CVE-2018-5155: Use-after-free with SVG animations and text paths
- CVE-2018-5159: Integer overflow and out-of-bounds write in Skia
- CVE-2018-5168: Lightweight themes can be installed without user
- CVE-2018-5178: Buffer overflow during UTF-8 to Unicode string conversion
through legacy extension
- CVE-2018-5150: Memory safety bugs fixed in Firefox 60, Firefox ESR 52.8,
and Thunderbird 52.8
- CVE-2018-5161: Hang via malformed headers (bsc#1093970)
- CVE-2018-5162: Encrypted mail leaks plaintext through src attribute
- CVE-2018-5170: Filename spoofing for external attachments (bsc#1093972)
- CVE-2018-5184: Full plaintext recovery in S/MIME via chosen-ciphertext
attack (bsc#1093969)
- CVE-2018-5185: Leaking plaintext through HTML forms (bsc#1093973)

Patch Instructions:

To install this openSUSE Security Update use the SUSE recommended
installation methods
like YaST online_update or "zypper patch".

Alternatively you can run the command listed for your product:

- SUSE Package Hub for SUSE Linux Enterprise 12:

zypper in -t patch openSUSE-2018-486=1

Package List:

- SUSE Package Hub for SUSE Linux Enterprise 12 (x86_64):



To unsubscribe, e-mail: opensuse-security-announce+unsubscribe@xxxxxxxxxxxx
For additional commands, e-mail: opensuse-security-announce+help@xxxxxxxxxxxx

< Previous Next >
This Thread
  • No further messages