Login
Newsletter
Werbung

Sicherheit: Mehrere Probleme in MozillaThunderbird
Aktuelle Meldungen Distributionen
Name: Mehrere Probleme in MozillaThunderbird
ID: SUSE-SU-2019:0338-1
Distribution: SUSE
Plattformen: SUSE Linux Enterprise Workstation Extension 15
Datum: Mi, 13. Februar 2019, 00:04
Referenzen: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-18500
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-18494
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-18505
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-18492
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-18501
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5824
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-12405
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-17466
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-18498
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-18493
Applikationen: Mozilla Thunderbird

Originalnachricht

   SUSE Security Update: Security update for MozillaThunderbird
______________________________________________________________________________

Announcement ID: SUSE-SU-2019:0338-1
Rating: important
References: #1119105 #1122983
Cross-References: CVE-2016-5824 CVE-2018-12405 CVE-2018-17466
CVE-2018-18492 CVE-2018-18493 CVE-2018-18494
CVE-2018-18498 CVE-2018-18500 CVE-2018-18501
CVE-2018-18505
Affected Products:
SUSE Linux Enterprise Workstation Extension 15
______________________________________________________________________________

An update that fixes 10 vulnerabilities is now available.

Description:

This update for MozillaThunderbird to version 60.5 fixes the following
issues:

Security vulnerabilities addressed (MSFA 2019-03 MSFA 2018-31 bsc#1122983
bsc#1119105):

* CVE-2018-18500: Use-after-free parsing HTML5 stream
* CVE-2018-18505: Privilege escalation through IPC channel messages
* CVE-2016-5824 DoS (use-after-free) via a crafted ics file
* CVE-2018-18501: Memory safety bugs fixed in Firefox 65 and Firefox ESR
60.5
* CVE-2018-17466: Buffer overflow and out-of-bounds read in ANGLE library
with TextureStorage11
* CVE-2018-18492: Use-after-free with select element
* CVE-2018-18493: Buffer overflow in accelerated 2D canvas with Skia
* CVE-2018-18494: Same-origin policy violation using location attribute
and performance.getEntries to steal cross-origin URLs
* CVE-2018-18498: Integer overflow when calculating buffer sizes for images
* CVE-2018-12405: Memory safety bugs fixed in Firefox 64, 60.4, and
Thunderbird 60.4

Other bug fixes and changes:

* FileLink provider WeTransfer to upload large attachments
* Thunderbird now allows the addition of OpenSearch search engines from a
local XML file using a minimal user interface: [+] button to select a
file an add, [-] to remove.
* More search engines: Google and DuckDuckGo available by default in some
locales
* During account creation, Thunderbird will now detect servers using the
Microsoft Exchange protocol. It will offer the installation of a 3rd
party add-on (Owl) which supports that protocol.
* Thunderbird now compatible with other WebExtension-based FileLink
add-ons like the Dropbox add-on
* New WebExtensions FileLink API to facilitate add-ons
* Fix decoding problems for messages with less common charsets (cp932,
cp936)
* New messages in the drafts folder (and other special or virtual folders)
will no longer be included in the new messages notification
* Thunderbird 60 will migrate security databases (key3.db, cert8.db to
key4.db, cert9.db).
* Address book search and auto-complete slowness
* Plain text markup with * for bold, / for italics, _ for underline and |
for code did not work when the enclosed text contained non-ASCII
characters
* While composing a message, a link not removed when link location was
removed in the link properties panel
* Encoding problems when exporting address books or messages using the
system charset. Messages are now always exported using the UTF-8 encoding
* If the "Date" header of a message was invalid, Jan 1970 or Dec
1969 was
displayed. Now using date from "Received" header instead.
* Body search/filtering didn't reliably ignore content of tags
* Inappropriate warning "Thunderbird prevented the site
(addons.thunderbird.net) from asking you to install software on your
computer" when installing add-ons
* Incorrect display of correspondents column since own email address was
not always detected
* Spurious 
 (encoded newline) inserted into drafts and sent email
* Double-clicking on a word in the Write window sometimes launched the
Advanced Property Editor or Link Properties dialog
* Fixe Cookie removal
* "Download rest of message" was not working if global inbox was
used
* Fix Encoding problems for users (especially in Poland) when a file was
sent via a folder using "Sent to > Mail recipient" due to a
problem in
the Thunderbird MAPI interface
* According to RFC 4616 and RFC 5721, passwords containing non-ASCII
characters are encoded using UTF-8 which can lead to problems with
non-compliant providers, for example office365.com. The SMTP LOGIN and
POP3 USER/PASS authentication methods are now using a Latin-1 encoding
again to work around this issue
* Fix shutdown crash/hang after entering an empty IMAP password


Patch Instructions:

To install this SUSE Security Update use the SUSE recommended installation
methods
like YaST online_update or "zypper patch".

Alternatively you can run the command listed for your product:

- SUSE Linux Enterprise Workstation Extension 15:

zypper in -t patch SUSE-SLE-Product-WE-15-2019-338=1



Package List:

- SUSE Linux Enterprise Workstation Extension 15 (x86_64):

MozillaThunderbird-60.5.0-3.20.2
MozillaThunderbird-debuginfo-60.5.0-3.20.2
MozillaThunderbird-debugsource-60.5.0-3.20.2
MozillaThunderbird-translations-common-60.5.0-3.20.2
MozillaThunderbird-translations-other-60.5.0-3.20.2


References:

https://www.suse.com/security/cve/CVE-2016-5824.html
https://www.suse.com/security/cve/CVE-2018-12405.html
https://www.suse.com/security/cve/CVE-2018-17466.html
https://www.suse.com/security/cve/CVE-2018-18492.html
https://www.suse.com/security/cve/CVE-2018-18493.html
https://www.suse.com/security/cve/CVE-2018-18494.html
https://www.suse.com/security/cve/CVE-2018-18498.html
https://www.suse.com/security/cve/CVE-2018-18500.html
https://www.suse.com/security/cve/CVE-2018-18501.html
https://www.suse.com/security/cve/CVE-2018-18505.html
https://bugzilla.suse.com/1119105
https://bugzilla.suse.com/1122983

_______________________________________________
sle-security-updates mailing list
sle-security-updates@lists.suse.com
http://lists.suse.com/mailman/listinfo/sle-security-updates
Pro-Linux
Unterstützer werden
Neue Nachrichten
Werbung