drucken bookmarks versenden konfigurieren admin pdf Sicherheit: Mehrere Probleme in MozillaThunderbird
Name: |
Mehrere Probleme in MozillaThunderbird |
|
ID: |
SUSE-SU-2023:0599-1 |
|
Distribution: |
SUSE |
|
Plattformen: |
openSUSE Leap 15.4, SUSE Manager Proxy 4.3, SUSE Manager Server 4.3, SUSE Manager Retail Branch Server 4.3, SUSE Linux Enterprise Micro 5.3, SUSE Linux Enterprise High Performance Computing 15 SP4, SUSE Linux Enterprise Server 15 SP4, SUSE Linux Enterprise Desktop 15 SP4, SUSE Linux Enterprise Server for SAP Applications 15 SP4, SUSE Package Hub 15 15-SP4, SUSE Linux Enterprise Micro 5.4, SUSE Linux Enterprise Workstation Extension 15 SP4 |
|
Datum: |
Do, 2. März 2023, 22:10 |
|
Referenzen: |
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-25734
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-25737
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-25729
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-25739
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-25735
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-25732
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-0616
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-25728
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-0767
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-25742
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-25746
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-25730
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-25738 |
|
Applikationen: |
Mozilla Thunderbird |
|
Originalnachricht |
--===============5258977534001349714== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit
# Security update for MozillaThunderbird
Announcement ID: SUSE-SU-2023:0599-1 Rating: important References:
* #1208144
Cross-References:
* CVE-2023-0616 * CVE-2023-0767 * CVE-2023-25728 * CVE-2023-25729 * CVE-2023-25730 * CVE-2023-25732 * CVE-2023-25734 * CVE-2023-25735 * CVE-2023-25737 * CVE-2023-25738 * CVE-2023-25739 * CVE-2023-25742 * CVE-2023-25746
CVSS scores:
* CVE-2023-0767 ( SUSE ): 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Products:
* openSUSE Leap 15.4 * SUSE Linux Enterprise Desktop 15 SP4 * SUSE Linux Enterprise High Performance Computing 15 SP4 * SUSE Linux Enterprise Micro 5.3 * SUSE Linux Enterprise Micro 5.4 * SUSE Linux Enterprise Server 15 SP4 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 * SUSE Linux Enterprise Workstation Extension 15 SP4 * SUSE Manager Proxy 4.3 * SUSE Manager Retail Branch Server 4.3 * SUSE Manager Server 4.3 * SUSE Package Hub 15 15-SP4
An update that solves 13 vulnerabilities can now be installed.
## Description:
This update for MozillaThunderbird fixes the following issues:
Updated Mozilla Thunderbird to version 102.8.0 (bsc#1208144): \- CVE-2023-0616: Fixed User Interface lockup via messages combining S/MIME and OpenPGP. \- CVE-2023-25728: Fixed content security policy leak in violation reports using iframes. \- CVE-2023-25730: Fixed screen hijack via browser fullscreen mode. \- CVE-2023-0767: Fixed arbitrary memory write via PKCS 12 in NSS. \- CVE-2023-25735: Fixed potential use-after-free from compartment mismatch in SpiderMonkey. \- CVE-2023-25737: Fixed invalid downcast in SVGUtils::SetupStrokeGeometry. \- CVE-2023-25738: Fixed printing on Windows could potentially crash Thunderbird with some device drivers. \- CVE-2023-25739: Fixed use-after-free in mozilla::dom::ScriptLoadContext::~ScriptLoadContext. \- CVE-2023-25729: Fixed vulnerability where extensions could have opened external schemes without user knowledge. \- CVE-2023-25732: Fixed out of bounds memory write from EncodeInputStream. \- CVE-2023-25734: Fixed issue where opening local .url files could cause unexpected network loads. \- CVE-2023-25742: Fixed tab crashing caused by Web Crypto ImportKey. \- CVE-2023-25746: Fixed memory safety bugs.
## Patch Instructions:
To install this SUSE Important update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product:
* openSUSE Leap 15.4 zypper in -t patch openSUSE-SLE-15.4-2023-599=1
* SUSE Package Hub 15 15-SP4 zypper in -t patch SUSE-SLE-Module-Packagehub-Subpackages-15-SP4-2023-599=1
* SUSE Linux Enterprise Workstation Extension 15 SP4 zypper in -t patch SUSE-SLE-Product-WE-15-SP4-2023-599=1
## Package List:
* openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64) * MozillaThunderbird-translations-common-102.8.0-150200.8.105.2 * MozillaThunderbird-102.8.0-150200.8.105.2 * MozillaThunderbird-debuginfo-102.8.0-150200.8.105.2 * MozillaThunderbird-translations-other-102.8.0-150200.8.105.2 * MozillaThunderbird-debugsource-102.8.0-150200.8.105.2 * SUSE Package Hub 15 15-SP4 (aarch64 ppc64le s390x) * MozillaThunderbird-translations-common-102.8.0-150200.8.105.2 * MozillaThunderbird-102.8.0-150200.8.105.2 * MozillaThunderbird-debuginfo-102.8.0-150200.8.105.2 * MozillaThunderbird-translations-other-102.8.0-150200.8.105.2 * MozillaThunderbird-debugsource-102.8.0-150200.8.105.2 * SUSE Linux Enterprise Workstation Extension 15 SP4 (x86_64) * MozillaThunderbird-translations-common-102.8.0-150200.8.105.2 * MozillaThunderbird-102.8.0-150200.8.105.2 * MozillaThunderbird-debuginfo-102.8.0-150200.8.105.2 * MozillaThunderbird-translations-other-102.8.0-150200.8.105.2 * MozillaThunderbird-debugsource-102.8.0-150200.8.105.2
## References:
* https://www.suse.com/security/cve/CVE-2023-0616.html * https://www.suse.com/security/cve/CVE-2023-0767.html * https://www.suse.com/security/cve/CVE-2023-25728.html * https://www.suse.com/security/cve/CVE-2023-25729.html * https://www.suse.com/security/cve/CVE-2023-25730.html * https://www.suse.com/security/cve/CVE-2023-25732.html * https://www.suse.com/security/cve/CVE-2023-25734.html * https://www.suse.com/security/cve/CVE-2023-25735.html * https://www.suse.com/security/cve/CVE-2023-25737.html * https://www.suse.com/security/cve/CVE-2023-25738.html * https://www.suse.com/security/cve/CVE-2023-25739.html * https://www.suse.com/security/cve/CVE-2023-25742.html * https://www.suse.com/security/cve/CVE-2023-25746.html * https://bugzilla.suse.com/show_bug.cgi?id=1208144
--===============5258977534001349714== Content-Type: text/html; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit
<div class="container"> <h1>Security update for MozillaThunderbird</h1>
<table class="table table-striped table-bordered"> <tbody> <tr> <th>Announcement ID:</th> <td>SUSE-SU-2023:0599-1</td> </tr> <tr> <th>Rating:</th> <td>important</td> </tr> <tr> <th>References:</th> <td> <ul> <li style="display: inline;"> <a href="https://bugzilla.suse.com/show_bug.cgi?id=1208144">#1208144</a> </li> </ul> </td> </tr> <tr> <th> Cross-References: </th> <td> <ul> <li style="display: inline;"> <a href="https://www.suse.com/security/cve/CVE-2023-0616.html">CVE-2023-0616</a> </li> <li style="display: inline;"> <a href="https://www.suse.com/security/cve/CVE-2023-0767.html">CVE-2023-0767</a> </li> <li style="display: inline;"> <a href="https://www.suse.com/security/cve/CVE-2023-25728.html">CVE-2023-25728</a> </li> <li style="display: inline;"> <a href="https://www.suse.com/security/cve/CVE-2023-25729.html">CVE-2023-25729</a> </li> <li style="display: inline;"> <a href="https://www.suse.com/security/cve/CVE-2023-25730.html">CVE-2023-25730</a> </li> <li style="display: inline;"> <a href="https://www.suse.com/security/cve/CVE-2023-25732.html">CVE-2023-25732</a> </li> <li style="display: inline;"> <a href="https://www.suse.com/security/cve/CVE-2023-25734.html">CVE-2023-25734</a> </li> <li style="display: inline;"> <a href="https://www.suse.com/security/cve/CVE-2023-25735.html">CVE-2023-25735</a> </li> <li style="display: inline;"> <a href="https://www.suse.com/security/cve/CVE-2023-25737.html">CVE-2023-25737</a> </li> <li style="display: inline;"> <a href="https://www.suse.com/security/cve/CVE-2023-25738.html">CVE-2023-25738</a> </li> <li style="display: inline;"> <a href="https://www.suse.com/security/cve/CVE-2023-25739.html">CVE-2023-25739</a> </li> <li style="display: inline;"> <a href="https://www.suse.com/security/cve/CVE-2023-25742.html">CVE-2023-25742</a> </li> <li style="display: inline;"> <a href="https://www.suse.com/security/cve/CVE-2023-25746.html">CVE-2023-25746</a> </li> </ul> </td> </tr> <tr> <th>CVSS scores:</th> <td> <ul class="list-group"> <li class="list-group-item"> <span class="cvss-reference">CVE-2023-0767</span> <span class="cvss-source"> ( SUSE ): </span> <span class="cvss-score">8.1</span> <span class="cvss-vector">CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H</span> </li> </ul> </td> </tr> <tr> <th>Affected Products:</th> <td> <ul class="list-group"> <li class="list-group-item">openSUSE Leap 15.4</li> <li class="list-group-item">SUSE Linux Enterprise Desktop 15 SP4</li> <li class="list-group-item">SUSE Linux Enterprise High Performance Computing 15 SP4</li> <li class="list-group-item">SUSE Linux Enterprise Micro 5.3</li> <li class="list-group-item">SUSE Linux Enterprise Micro 5.4</li> <li class="list-group-item">SUSE Linux Enterprise Server 15 SP4</li> <li class="list-group-item">SUSE Linux Enterprise Server for SAP Applications 15 SP4</li> <li class="list-group-item">SUSE Linux Enterprise Workstation Extension 15 SP4</li> <li class="list-group-item">SUSE Manager Proxy 4.3</li> <li class="list-group-item">SUSE Manager Retail Branch Server 4.3</li> <li class="list-group-item">SUSE Manager Server 4.3</li> <li class="list-group-item">SUSE Package Hub 15 15-SP4</li> </ul> </td> </tr> </tbody> </table>
<p>An update that solves 13 vulnerabilities can now be installed.</p>
<h2>Description:</h2> <p>This update for MozillaThunderbird fixes the following issues:</p> <p>Updated Mozilla Thunderbird to version 102.8.0 (bsc#1208144): - CVE-2023-0616: Fixed User Interface lockup via messages combining S/MIME and OpenPGP. - CVE-2023-25728: Fixed content security policy leak in violation reports using iframes. - CVE-2023-25730: Fixed screen hijack via browser fullscreen mode. - CVE-2023-0767: Fixed arbitrary memory write via PKCS 12 in NSS. - CVE-2023-25735: Fixed potential use-after-free from compartment mismatch in SpiderMonkey. - CVE-2023-25737: Fixed invalid downcast in SVGUtils::SetupStrokeGeometry. - CVE-2023-25738: Fixed printing on Windows could potentially crash Thunderbird with some device drivers. - CVE-2023-25739: Fixed use-after-free in mozilla::dom::ScriptLoadContext::~ScriptLoadContext. - CVE-2023-25729: Fixed vulnerability where extensions could have opened external schemes without user knowledge. - CVE-2023-25732: Fixed out of bounds memory write from EncodeInputStream. - CVE-2023-25734: Fixed issue where opening local .url files could cause unexpected network loads. - CVE-2023-25742: Fixed tab crashing caused by Web Crypto ImportKey. - CVE-2023-25746: Fixed memory safety bugs.</p>
<h2>Patch Instructions:</h2> <p> To install this SUSE Important update use the SUSE recommended installation methods like YaST online_update or "zypper patch".<br/>
Alternatively you can run the command listed for your product: </p> <ul class="list-group"> <li class="list-group-item"> openSUSE Leap 15.4 <br/> <code>zypper in -t patch openSUSE-SLE-15.4-2023-599=1</code> </li> <li class="list-group-item"> SUSE Package Hub 15 15-SP4 <br/> <code>zypper in -t patch SUSE-SLE-Module-Packagehub-Subpackages-15-SP4-2023-599=1</code> </li> <li class="list-group-item"> SUSE Linux Enterprise Workstation Extension 15 SP4 <br/> <code>zypper in -t patch SUSE-SLE-Product-WE-15-SP4-2023-599=1</code> </li> </ul>
<h2>Package List:</h2> <ul> <li> openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64) <ul> <li>MozillaThunderbird-translations-common-102.8.0-150200.8.105.2</li> <li>MozillaThunderbird-102.8.0-150200.8.105.2</li> <li>MozillaThunderbird-debuginfo-102.8.0-150200.8.105.2</li> <li>MozillaThunderbird-translations-other-102.8.0-150200.8.105.2</li> <li>MozillaThunderbird-debugsource-102.8.0-150200.8.105.2</li> </ul> </li> <li> SUSE Package Hub 15 15-SP4 (aarch64 ppc64le s390x) <ul> <li>MozillaThunderbird-translations-common-102.8.0-150200.8.105.2</li> <li>MozillaThunderbird-102.8.0-150200.8.105.2</li> <li>MozillaThunderbird-debuginfo-102.8.0-150200.8.105.2</li> <li>MozillaThunderbird-translations-other-102.8.0-150200.8.105.2</li> <li>MozillaThunderbird-debugsource-102.8.0-150200.8.105.2</li> </ul> </li> <li> SUSE Linux Enterprise Workstation Extension 15 SP4 (x86_64) <ul> <li>MozillaThunderbird-translations-common-102.8.0-150200.8.105.2</li> <li>MozillaThunderbird-102.8.0-150200.8.105.2</li> <li>MozillaThunderbird-debuginfo-102.8.0-150200.8.105.2</li> <li>MozillaThunderbird-translations-other-102.8.0-150200.8.105.2</li> <li>MozillaThunderbird-debugsource-102.8.0-150200.8.105.2</li> </ul> </li> </ul>
<h2>References:</h2> <ul> <li> <a href="https://www.suse.com/security/cve/CVE-2023-0616.html">https://www.suse.com/security/cve/CVE-2023-0616.html</a> </li> <li> <a href="https://www.suse.com/security/cve/CVE-2023-0767.html">https://www.suse.com/security/cve/CVE-2023-0767.html</a> </li> <li> <a href="https://www.suse.com/security/cve/CVE-2023-25728.html">https://www.suse.com/security/cve/CVE-2023-25728.html</a> </li> <li> <a href="https://www.suse.com/security/cve/CVE-2023-25729.html">https://www.suse.com/security/cve/CVE-2023-25729.html</a> </li> <li> <a href="https://www.suse.com/security/cve/CVE-2023-25730.html">https://www.suse.com/security/cve/CVE-2023-25730.html</a> </li> <li> <a href="https://www.suse.com/security/cve/CVE-2023-25732.html">https://www.suse.com/security/cve/CVE-2023-25732.html</a> </li> <li> <a href="https://www.suse.com/security/cve/CVE-2023-25734.html">https://www.suse.com/security/cve/CVE-2023-25734.html</a> </li> <li> <a href="https://www.suse.com/security/cve/CVE-2023-25735.html">https://www.suse.com/security/cve/CVE-2023-25735.html</a> </li> <li> <a href="https://www.suse.com/security/cve/CVE-2023-25737.html">https://www.suse.com/security/cve/CVE-2023-25737.html</a> </li> <li> <a href="https://www.suse.com/security/cve/CVE-2023-25738.html">https://www.suse.com/security/cve/CVE-2023-25738.html</a> </li> <li> <a href="https://www.suse.com/security/cve/CVE-2023-25739.html">https://www.suse.com/security/cve/CVE-2023-25739.html</a> </li> <li> <a href="https://www.suse.com/security/cve/CVE-2023-25742.html">https://www.suse.com/security/cve/CVE-2023-25742.html</a> </li> <li> <a href="https://www.suse.com/security/cve/CVE-2023-25746.html">https://www.suse.com/security/cve/CVE-2023-25746.html</a> </li> <li> <a href="https://bugzilla.suse.com/show_bug.cgi?id=1208144">https://bugzilla.suse.com/show_bug.cgi?id=1208144</a> </li> </ul> </div>
--===============5258977534001349714==--
|
|
|
|