Mailinglist Archive: opensuse-updates (121 mails)

< Previous Next >
openSUSE-SU-2017:0357-1: moderate: Security update for MozillaThunderbird
openSUSE Security Update: Security update for MozillaThunderbird
______________________________________________________________________________

Announcement ID: openSUSE-SU-2017:0357-1
Rating: moderate
References: #1021814 #1021817 #1021818 #1021819 #1021820
#1021821 #1021822 #1021824 #1021991
Cross-References: CVE-2017-5373 CVE-2017-5375 CVE-2017-5376
CVE-2017-5378 CVE-2017-5380 CVE-2017-5383
CVE-2017-5390 CVE-2017-5396
Affected Products:
openSUSE Leap 42.2
openSUSE Leap 42.1
______________________________________________________________________________

An update that solves 8 vulnerabilities and has one errata
is now available.

Description:

This update to Mozilla Thunderbird 45.7.0 fixes security issues and bugs.

The following security issues from advisory MFSA 2017-03 were fixed
(boo#1021991) In general, these flaws cannot be exploited through email in
Thunderbird because scripting is disabled when reading mail, but are
potentially risks in browser or browser-like contexts:

- CVE-2017-5375: Excessive JIT code allocation allows bypass of ASLR and
DEP (boo#1021814)
- CVE-2017-5376: Use-after-free in XSL (boo#1021817)
- CVE-2017-5378: Pointer and frame data leakage of Javascript objects
(boo#1021818)
- CVE-2017-5380: Potential use-after-free during DOM manipulations
(boo#1021819)
- CVE-2017-5390: Insecure communication methods in Developer Tools JSON
viewer (boo#1021820)
- CVE-2017-5396: Use-after-free with Media Decoder (boo#1021821)
- CVE-2017-5383: Location bar spoofing with unicode characters
(boo#1021822)
- CVE-2017-5373: Memory safety bugs fixed in Thunderbird 45.7 (boo#1021824)

The following non-security bugs were fixed:

- Message preview pane non-functional after IMAP folder was renamed or
moved
- "Move To" button on "Search Messages" panel not working
- Message sent to "undisclosed recipients" shows no recipient
(non-functional since Thunderbird version 38)


Patch Instructions:

To install this openSUSE Security Update use YaST online_update.
Alternatively you can run the command listed for your product:

- openSUSE Leap 42.2:

zypper in -t patch openSUSE-2017-188=1

- openSUSE Leap 42.1:

zypper in -t patch openSUSE-2017-188=1

To bring your system up-to-date, use "zypper patch".


Package List:

- openSUSE Leap 42.2 (x86_64):

MozillaThunderbird-45.7.0-34.1
MozillaThunderbird-buildsymbols-45.7.0-34.1
MozillaThunderbird-debuginfo-45.7.0-34.1
MozillaThunderbird-debugsource-45.7.0-34.1
MozillaThunderbird-devel-45.7.0-34.1
MozillaThunderbird-translations-common-45.7.0-34.1
MozillaThunderbird-translations-other-45.7.0-34.1

- openSUSE Leap 42.1 (i586 x86_64):

MozillaThunderbird-45.7.0-34.1
MozillaThunderbird-buildsymbols-45.7.0-34.1
MozillaThunderbird-debuginfo-45.7.0-34.1
MozillaThunderbird-debugsource-45.7.0-34.1
MozillaThunderbird-devel-45.7.0-34.1
MozillaThunderbird-translations-common-45.7.0-34.1
MozillaThunderbird-translations-other-45.7.0-34.1


References:

https://www.suse.com/security/cve/CVE-2017-5373.html
https://www.suse.com/security/cve/CVE-2017-5375.html
https://www.suse.com/security/cve/CVE-2017-5376.html
https://www.suse.com/security/cve/CVE-2017-5378.html
https://www.suse.com/security/cve/CVE-2017-5380.html
https://www.suse.com/security/cve/CVE-2017-5383.html
https://www.suse.com/security/cve/CVE-2017-5390.html
https://www.suse.com/security/cve/CVE-2017-5396.html
https://bugzilla.suse.com/1021814
https://bugzilla.suse.com/1021817
https://bugzilla.suse.com/1021818
https://bugzilla.suse.com/1021819
https://bugzilla.suse.com/1021820
https://bugzilla.suse.com/1021821
https://bugzilla.suse.com/1021822
https://bugzilla.suse.com/1021824
https://bugzilla.suse.com/1021991


< Previous Next >
This Thread
  • No further messages