Mailinglist Archive: opensuse-updates (144 mails)

< Previous Next >
openSUSE-SU-2015:2229-1: moderate: Security update for MozillaThunderbird
openSUSE Security Update: Security update for MozillaThunderbird

Announcement ID: openSUSE-SU-2015:2229-1
Rating: moderate
References: #952325 #952810
Cross-References: CVE-2015-4513 CVE-2015-4514 CVE-2015-7181
CVE-2015-7182 CVE-2015-7183 CVE-2015-7188
CVE-2015-7189 CVE-2015-7193 CVE-2015-7194
CVE-2015-7196 CVE-2015-7197 CVE-2015-7198
CVE-2015-7199 CVE-2015-7200
Affected Products:
openSUSE Leap 42.1

An update that fixes 14 vulnerabilities is now available.


The MozillaThunderbird package was updated to fix the following security
and non security issues:

- update to Thunderbird 38.4.0 (bnc#952810)
* MFSA 2015-116/CVE-2015-4513/CVE-2015-4514 Miscellaneous memory safety
* MFSA 2015-122/CVE-2015-7188 (bmo#1199430) Trailing whitespace in IP
address hostnames can bypass same-origin policy
* MFSA 2015-123/CVE-2015-7189 (bmo#1205900) Buffer overflow during image
interactions in canvas
* MFSA 2015-127/CVE-2015-7193 (bmo#1210302) CORS preflight is bypassed
when non-standard Content-Type headers are received
* MFSA 2015-128/CVE-2015-7194 (bmo#1211262) Memory corruption in libjar
through zip files
* MFSA 2015-130/CVE-2015-7196 (bmo#1140616) JavaScript garbage
collection crash with Java applet
* MFSA 2015-131/CVE-2015-7198/CVE-2015-7199/CVE-2015-7200 (bmo#1188010,
bmo#1204061, bmo#1204155) Vulnerabilities found through code inspection
* MFSA 2015-132/CVE-2015-7197 (bmo#1204269) Mixed content WebSocket
policy bypass through workers
* MFSA 2015-133/CVE-2015-7181/CVE-2015-7182/CVE-2015-7183 (bmo#1202868,
bmo#1205157) NSS and NSPR memory corruption issues (fixed in
mozilla-nspr and mozilla-nss packages)
- requires NSPR 4.10.10 and NSS
- added explicit appdata provides (bnc#952325)

Patch Instructions:

To install this openSUSE Security Update use YaST online_update.
Alternatively you can run the command listed for your product:

- openSUSE Leap 42.1:

zypper in -t patch openSUSE-2015-877=1

To bring your system up-to-date, use "zypper patch".

Package List:

- openSUSE Leap 42.1 (i586 x86_64):



< Previous Next >
This Thread
  • No further messages