drucken bookmarks versenden konfigurieren admin pdf Sicherheit: Mehrere Probleme in MozillaThunderbird
| Name: |
Mehrere Probleme in MozillaThunderbird |
|
| ID: |
SUSE-SU-2025:0849-1 |
|
| Distribution: |
SUSE |
|
| Plattformen: |
SUSE Linux Enterprise Desktop 15 SP6, SUSE Linux Enterprise Server for SAP Applications 15 SP6, SUSE Linux Enterprise Server 15 SP6, SUSE Linux Enterprise Real Time 15 SP6, SUSE openSUSE Leap 15.6, SUSE Package Hub 15 15-SP6, SUSE Linux Enterprise Workstation Extension 15 SP6 |
|
| Datum: |
Mi, 12. März 2025, 23:03 |
|
| Referenzen: |
https://www.cve.org/CVERecord?id=CVE-2025-1932
https://www.cve.org/CVERecord?id=CVE-2025-26696
https://www.cve.org/CVERecord?id=CVE-2025-1936
https://www.cve.org/CVERecord?id=CVE-2024-43097
https://www.cve.org/CVERecord?id=CVE-2025-1930
https://www.cve.org/CVERecord?id=CVE-2025-1938
https://www.cve.org/CVERecord?id=CVE-2025-1931
https://www.cve.org/CVERecord?id=CVE-2025-26695
https://www.cve.org/CVERecord?id=CVE-2025-1935
https://www.cve.org/CVERecord?id=CVE-2025-1934
https://www.cve.org/CVERecord?id=CVE-2025-1937
https://www.cve.org/CVERecord?id=CVE-2025-1933 |
|
| Applikationen: |
Mozilla Thunderbird |
|
Originalnachricht |
--===============4829461397160101561==
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
# Security update for MozillaThunderbird
Announcement ID: SUSE-SU-2025:0849-1
Release Date: 2025-03-12T15:12:49Z
Rating: important
References:
* bsc#1237683
Cross-References:
* CVE-2024-43097
* CVE-2025-1930
* CVE-2025-1931
* CVE-2025-1932
* CVE-2025-1933
* CVE-2025-1934
* CVE-2025-1935
* CVE-2025-1936
* CVE-2025-1937
* CVE-2025-1938
* CVE-2025-26695
* CVE-2025-26696
CVSS scores:
* CVE-2024-43097 ( SUSE ): 8.6
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
* CVE-2024-43097 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2024-43097 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
* CVE-2025-1930 ( SUSE ): 7.1
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:L/VA:H/SC:N/SI:N/SA:N
* CVE-2025-1930 ( SUSE ): 8.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:H
* CVE-2025-1930 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2025-1931 ( SUSE ): 7.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N
* CVE-2025-1931 ( SUSE ): 7.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H
* CVE-2025-1932 ( SUSE ): 7.1
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:L/VA:H/SC:N/SI:N/SA:N
* CVE-2025-1932 ( SUSE ): 8.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:H
* CVE-2025-1932 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
* CVE-2025-1933 ( SUSE ): 7.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N
* CVE-2025-1933 ( SUSE ): 7.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H
* CVE-2025-1933 ( NVD ): 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
* CVE-2025-1934 ( SUSE ): 6.9
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
* CVE-2025-1934 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
* CVE-2025-1934 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
* CVE-2025-1935 ( SUSE ): 5.1
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
* CVE-2025-1935 ( SUSE ): 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
* CVE-2025-1935 ( NVD ): 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
* CVE-2025-1936 ( SUSE ): 5.1
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
* CVE-2025-1936 ( SUSE ): 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
* CVE-2025-1937 ( SUSE ): 8.6
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
* CVE-2025-1937 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2025-1938 ( SUSE ): 8.6
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
* CVE-2025-1938 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2025-1938 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
* CVE-2025-26695 ( SUSE ): 2.3
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
* CVE-2025-26695 ( SUSE ): 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
* CVE-2025-26696 ( SUSE ): 6.9
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
* CVE-2025-26696 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
* CVE-2025-26696 ( NVD ): 7.0 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L
Affected Products:
* openSUSE Leap 15.6
* SUSE Linux Enterprise Desktop 15 SP6
* SUSE Linux Enterprise Real Time 15 SP6
* SUSE Linux Enterprise Server 15 SP6
* SUSE Linux Enterprise Server for SAP Applications 15 SP6
* SUSE Linux Enterprise Workstation Extension 15 SP6
* SUSE Package Hub 15 15-SP6
An update that solves 12 vulnerabilities can now be installed.
## Description:
This update for MozillaThunderbird fixes the following issues:
Updated to Mozilla Thunderbird 128.8 MFSA 2025-18 (bsc#1237683):
* CVE-2024-43097: Overflow when growing an SkRegion's RunArray
* CVE-2025-1930: AudioIPC StreamData could trigger a use-after-free in the
Browser process
* CVE-2025-1931: Use-after-free in WebTransportChild
* CVE-2025-1932: Inconsistent comparator in XSLT sorting led to out-of-bounds
access
* CVE-2025-1933: JIT corruption of WASM i32 return values on 64-bit CPUs
* CVE-2025-1934: Unexpected GC during RegExp bailout processing
* CVE-2025-1935: Clickjacking the registerProtocolHandler info-bar
* CVE-2025-1936: Adding %00 and a fake extension to a jar: URL changed the
interpretation of the contents
* CVE-2025-1937: Memory safety bugs fixed in Firefox 136, Thunderbird 136,
Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
* CVE-2025-1938: Memory safety bugs fixed in Firefox 136, Thunderbird 136,
Firefox ESR 128.8, and Thunderbird 128.8
* CVE-2025-26695: Downloading of OpenPGP keys from WKD used incorrect padding
* CVE-2025-26696: Crafted email message incorrectly shown as being encrypted
Other fixes: * Opening an .EML file in profiles with many folders could take a
long time. * Users with many folders experienced poor performance when resizing
message panes. *"Replace" button in compose window was overwritten when
the
window was narrow. * Export to mobile did not work when "Use default
server" was
selected. * "Save Link As" was not working in feed web content.
## Patch Instructions:
To install this SUSE update use the SUSE recommended installation methods like
YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
* openSUSE Leap 15.6
zypper in -t patch openSUSE-SLE-15.6-2025-849=1
* SUSE Package Hub 15 15-SP6
zypper in -t patch SUSE-SLE-Module-Packagehub-Subpackages-15-SP6-2025-849=1
* SUSE Linux Enterprise Workstation Extension 15 SP6
zypper in -t patch SUSE-SLE-Product-WE-15-SP6-2025-849=1
## Package List:
* openSUSE Leap 15.6 (aarch64 ppc64le s390x x86_64)
* MozillaThunderbird-debugsource-128.8.0-150200.8.203.1
* MozillaThunderbird-translations-common-128.8.0-150200.8.203.1
* MozillaThunderbird-translations-other-128.8.0-150200.8.203.1
* MozillaThunderbird-debuginfo-128.8.0-150200.8.203.1
* MozillaThunderbird-128.8.0-150200.8.203.1
* SUSE Package Hub 15 15-SP6 (aarch64 ppc64le s390x)
* MozillaThunderbird-debugsource-128.8.0-150200.8.203.1
* MozillaThunderbird-translations-common-128.8.0-150200.8.203.1
* MozillaThunderbird-translations-other-128.8.0-150200.8.203.1
* MozillaThunderbird-debuginfo-128.8.0-150200.8.203.1
* MozillaThunderbird-128.8.0-150200.8.203.1
* SUSE Linux Enterprise Workstation Extension 15 SP6 (x86_64)
* MozillaThunderbird-debugsource-128.8.0-150200.8.203.1
* MozillaThunderbird-translations-common-128.8.0-150200.8.203.1
* MozillaThunderbird-translations-other-128.8.0-150200.8.203.1
* MozillaThunderbird-debuginfo-128.8.0-150200.8.203.1
* MozillaThunderbird-128.8.0-150200.8.203.1
## References:
* https://www.suse.com/security/cve/CVE-2024-43097.html
* https://www.suse.com/security/cve/CVE-2025-1930.html
* https://www.suse.com/security/cve/CVE-2025-1931.html
* https://www.suse.com/security/cve/CVE-2025-1932.html
* https://www.suse.com/security/cve/CVE-2025-1933.html
* https://www.suse.com/security/cve/CVE-2025-1934.html
* https://www.suse.com/security/cve/CVE-2025-1935.html
* https://www.suse.com/security/cve/CVE-2025-1936.html
* https://www.suse.com/security/cve/CVE-2025-1937.html
* https://www.suse.com/security/cve/CVE-2025-1938.html
* https://www.suse.com/security/cve/CVE-2025-26695.html
* https://www.suse.com/security/cve/CVE-2025-26696.html
* https://bugzilla.suse.com/show_bug.cgi?id=1237683
--===============4829461397160101561==
Content-Type: text/html; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
<div class="container">
<h1>Security update for MozillaThunderbird</h1>
<table class="table table-striped table-bordered">
<tbody>
<tr>
<th>Announcement ID:</th>
<td>SUSE-SU-2025:0849-1</td>
</tr>
<tr>
<th>Release Date:</th>
<td>2025-03-12T15:12:49Z</td>
</tr>
<tr>
<th>Rating:</th>
<td>important</td>
</tr>
<tr>
<th>References:</th>
<td>
<ul>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1237683">bsc#1237683</a>
</li>
</ul>
</td>
</tr>
<tr>
<th>
Cross-References:
</th>
<td>
<ul>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2024-43097.html">CVE-2024-43097</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2025-1930.html">CVE-2025-1930</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2025-1931.html">CVE-2025-1931</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2025-1932.html">CVE-2025-1932</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2025-1933.html">CVE-2025-1933</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2025-1934.html">CVE-2025-1934</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2025-1935.html">CVE-2025-1935</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2025-1936.html">CVE-2025-1936</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2025-1937.html">CVE-2025-1937</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2025-1938.html">CVE-2025-1938</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2025-26695.html">CVE-2025-26695</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2025-26696.html">CVE-2025-26696</a>
</li>
</ul>
</td>
</tr>
<tr>
<th>CVSS scores:</th>
<td>
<ul class="list-group">
<li class="list-group-item">
<span
class="cvss-reference">CVE-2024-43097</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span
class="cvss-score">8.6</span>
<span
class="cvss-vector">CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N</span>
</li>
<li class="list-group-item">
<span
class="cvss-reference">CVE-2024-43097</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span
class="cvss-score">8.8</span>
<span
class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H</span>
</li>
<li class="list-group-item">
<span
class="cvss-reference">CVE-2024-43097</span>
<span class="cvss-source">
(
NVD
):
</span>
<span
class="cvss-score">7.8</span>
<span
class="cvss-vector">CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H</span>
</li>
<li class="list-group-item">
<span
class="cvss-reference">CVE-2025-1930</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span
class="cvss-score">7.1</span>
<span
class="cvss-vector">CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:L/VA:H/SC:N/SI:N/SA:N</span>
</li>
<li class="list-group-item">
<span
class="cvss-reference">CVE-2025-1930</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span
class="cvss-score">8.3</span>
<span
class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:H</span>
</li>
<li class="list-group-item">
<span
class="cvss-reference">CVE-2025-1930</span>
<span class="cvss-source">
(
NVD
):
</span>
<span
class="cvss-score">8.8</span>
<span
class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H</span>
</li>
<li class="list-group-item">
<span
class="cvss-reference">CVE-2025-1931</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span
class="cvss-score">7.0</span>
<span
class="cvss-vector">CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N</span>
</li>
<li class="list-group-item">
<span
class="cvss-reference">CVE-2025-1931</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span
class="cvss-score">7.6</span>
<span
class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H</span>
</li>
<li class="list-group-item">
<span
class="cvss-reference">CVE-2025-1932</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span
class="cvss-score">7.1</span>
<span
class="cvss-vector">CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:L/VA:H/SC:N/SI:N/SA:N</span>
</li>
<li class="list-group-item">
<span
class="cvss-reference">CVE-2025-1932</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span
class="cvss-score">8.3</span>
<span
class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:H</span>
</li>
<li class="list-group-item">
<span
class="cvss-reference">CVE-2025-1932</span>
<span class="cvss-source">
(
NVD
):
</span>
<span
class="cvss-score">9.8</span>
<span
class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H</span>
</li>
<li class="list-group-item">
<span
class="cvss-reference">CVE-2025-1933</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span
class="cvss-score">7.0</span>
<span
class="cvss-vector">CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N</span>
</li>
<li class="list-group-item">
<span
class="cvss-reference">CVE-2025-1933</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span
class="cvss-score">7.6</span>
<span
class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H</span>
</li>
<li class="list-group-item">
<span
class="cvss-reference">CVE-2025-1933</span>
<span class="cvss-source">
(
NVD
):
</span>
<span
class="cvss-score">8.1</span>
<span
class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H</span>
</li>
<li class="list-group-item">
<span
class="cvss-reference">CVE-2025-1934</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span
class="cvss-score">6.9</span>
<span
class="cvss-vector">CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N</span>
</li>
<li class="list-group-item">
<span
class="cvss-reference">CVE-2025-1934</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span
class="cvss-score">6.5</span>
<span
class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H</span>
</li>
<li class="list-group-item">
<span
class="cvss-reference">CVE-2025-1934</span>
<span class="cvss-source">
(
NVD
):
</span>
<span
class="cvss-score">6.5</span>
<span
class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N</span>
</li>
<li class="list-group-item">
<span
class="cvss-reference">CVE-2025-1935</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span
class="cvss-score">5.1</span>
<span
class="cvss-vector">CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N</span>
</li>
<li class="list-group-item">
<span
class="cvss-reference">CVE-2025-1935</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span
class="cvss-score">4.3</span>
<span
class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N</span>
</li>
<li class="list-group-item">
<span
class="cvss-reference">CVE-2025-1935</span>
<span class="cvss-source">
(
NVD
):
</span>
<span
class="cvss-score">4.3</span>
<span
class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N</span>
</li>
<li class="list-group-item">
<span
class="cvss-reference">CVE-2025-1936</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span
class="cvss-score">5.1</span>
<span
class="cvss-vector">CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N</span>
</li>
<li class="list-group-item">
<span
class="cvss-reference">CVE-2025-1936</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span
class="cvss-score">5.4</span>
<span
class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N</span>
</li>
<li class="list-group-item">
<span
class="cvss-reference">CVE-2025-1937</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span
class="cvss-score">8.6</span>
<span
class="cvss-vector">CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N</span>
</li>
<li class="list-group-item">
<span
class="cvss-reference">CVE-2025-1937</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span
class="cvss-score">8.8</span>
<span
class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H</span>
</li>
<li class="list-group-item">
<span
class="cvss-reference">CVE-2025-1938</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span
class="cvss-score">8.6</span>
<span
class="cvss-vector">CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N</span>
</li>
<li class="list-group-item">
<span
class="cvss-reference">CVE-2025-1938</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span
class="cvss-score">8.8</span>
<span
class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H</span>
</li>
<li class="list-group-item">
<span
class="cvss-reference">CVE-2025-1938</span>
<span class="cvss-source">
(
NVD
):
</span>
<span
class="cvss-score">6.5</span>
<span
class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N</span>
</li>
<li class="list-group-item">
<span
class="cvss-reference">CVE-2025-26695</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span
class="cvss-score">2.3</span>
<span
class="cvss-vector">CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N</span>
</li>
<li class="list-group-item">
<span
class="cvss-reference">CVE-2025-26695</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span
class="cvss-score">3.7</span>
<span
class="cvss-vector">CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N</span>
</li>
<li class="list-group-item">
<span
class="cvss-reference">CVE-2025-26696</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span
class="cvss-score">6.9</span>
<span
class="cvss-vector">CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N</span>
</li>
<li class="list-group-item">
<span
class="cvss-reference">CVE-2025-26696</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span
class="cvss-score">6.5</span>
<span
class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N</span>
</li>
<li class="list-group-item">
<span
class="cvss-reference">CVE-2025-26696</span>
<span class="cvss-source">
(
NVD
):
</span>
<span
class="cvss-score">7.0</span>
<span
class="cvss-vector">CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L</span>
</li>
</ul>
</td>
</tr>
<tr>
<th>Affected Products:</th>
<td>
<ul class="list-group">
<li class="list-group-item">openSUSE Leap
15.6</li>
<li class="list-group-item">SUSE Linux
Enterprise Desktop 15 SP6</li>
<li class="list-group-item">SUSE Linux
Enterprise Real Time 15 SP6</li>
<li class="list-group-item">SUSE Linux
Enterprise Server 15 SP6</li>
<li class="list-group-item">SUSE Linux
Enterprise Server for SAP Applications 15 SP6</li>
<li class="list-group-item">SUSE Linux
Enterprise Workstation Extension 15 SP6</li>
<li class="list-group-item">SUSE Package
Hub 15 15-SP6</li>
</ul>
</td>
</tr>
</tbody>
</table>
<p>An update that solves 12 vulnerabilities can now be
installed.</p>
<h2>Description:</h2>
<p>This update for MozillaThunderbird fixes the following
issues:</p>
<p>Updated to Mozilla Thunderbird 128.8 MFSA 2025-18
(bsc#1237683):</p>
<ul>
<li>CVE-2024-43097: Overflow when growing an SkRegion's
RunArray</li>
<li>CVE-2025-1930: AudioIPC StreamData could trigger a use-after-free in
the
Browser process</li>
<li>CVE-2025-1931: Use-after-free in WebTransportChild</li>
<li>CVE-2025-1932: Inconsistent comparator in XSLT sorting led to
out-of-bounds
access</li>
<li>CVE-2025-1933: JIT corruption of WASM i32 return values on 64-bit
CPUs</li>
<li>CVE-2025-1934: Unexpected GC during RegExp bailout
processing</li>
<li>CVE-2025-1935: Clickjacking the registerProtocolHandler
info-bar</li>
<li>CVE-2025-1936: Adding %00 and a fake extension to a jar: URL changed
the
interpretation of the contents</li>
<li>CVE-2025-1937: Memory safety bugs fixed in Firefox 136, Thunderbird
136,
Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8</li>
<li>CVE-2025-1938: Memory safety bugs fixed in Firefox 136, Thunderbird
136,
Firefox ESR 128.8, and Thunderbird 128.8</li>
<li>CVE-2025-26695: Downloading of OpenPGP keys from WKD used incorrect
padding</li>
<li>CVE-2025-26696: Crafted email message incorrectly shown as being
encrypted </li>
</ul>
<p>Other fixes:
* Opening an .EML file in profiles with many folders
could take a long time.
* Users with many folders experienced poor performance
when resizing message panes.
*"Replace" button in compose window was overwritten
when the window was narrow.
* Export to mobile did not work when "Use default
server" was selected.
* "Save Link As" was not working in feed web
content.</p>
<h2>Patch Instructions:</h2>
<p>
To install this SUSE update use the SUSE recommended
installation methods like YaST online_update or "zypper
patch".<br/>
Alternatively you can run the command listed for your product:
</p>
<ul class="list-group">
<li class="list-group-item">
openSUSE Leap 15.6
<br/>
<code>zypper in -t patch
openSUSE-SLE-15.6-2025-849=1</code>
</li>
<li class="list-group-item">
SUSE Package Hub 15 15-SP6
<br/>
<code>zypper in -t patch
SUSE-SLE-Module-Packagehub-Subpackages-15-SP6-2025-849=1</code>
</li>
<li class="list-group-item">
SUSE Linux Enterprise Workstation Extension 15 SP6
<br/>
<code>zypper in -t patch
SUSE-SLE-Product-WE-15-SP6-2025-849=1</code>
</li>
</ul>
<h2>Package List:</h2>
<ul>
<li>
openSUSE Leap 15.6 (aarch64 ppc64le s390x x86_64)
<ul>
<li>MozillaThunderbird-debugsource-128.8.0-150200.8.203.1</li>
<li>MozillaThunderbird-translations-common-128.8.0-150200.8.203.1</li>
<li>MozillaThunderbird-translations-other-128.8.0-150200.8.203.1</li>
<li>MozillaThunderbird-debuginfo-128.8.0-150200.8.203.1</li>
<li>MozillaThunderbird-128.8.0-150200.8.203.1</li>
</ul>
</li>
<li>
SUSE Package Hub 15 15-SP6 (aarch64 ppc64le s390x)
<ul>
<li>MozillaThunderbird-debugsource-128.8.0-150200.8.203.1</li>
<li>MozillaThunderbird-translations-common-128.8.0-150200.8.203.1</li>
<li>MozillaThunderbird-translations-other-128.8.0-150200.8.203.1</li>
<li>MozillaThunderbird-debuginfo-128.8.0-150200.8.203.1</li>
<li>MozillaThunderbird-128.8.0-150200.8.203.1</li>
</ul>
</li>
<li>
SUSE Linux Enterprise Workstation Extension 15 SP6 (x86_64)
<ul>
<li>MozillaThunderbird-debugsource-128.8.0-150200.8.203.1</li>
<li>MozillaThunderbird-translations-common-128.8.0-150200.8.203.1</li>
<li>MozillaThunderbird-translations-other-128.8.0-150200.8.203.1</li>
<li>MozillaThunderbird-debuginfo-128.8.0-150200.8.203.1</li>
<li>MozillaThunderbird-128.8.0-150200.8.203.1</li>
</ul>
</li>
</ul>
<h2>References:</h2>
<ul>
<li>
<a href="https://www.suse.com/security/cve/CVE-2024-43097.html">https://www.suse.com/security/cve/CVE-2024-43097.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2025-1930.html">https://www.suse.com/security/cve/CVE-2025-1930.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2025-1931.html">https://www.suse.com/security/cve/CVE-2025-1931.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2025-1932.html">https://www.suse.com/security/cve/CVE-2025-1932.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2025-1933.html">https://www.suse.com/security/cve/CVE-2025-1933.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2025-1934.html">https://www.suse.com/security/cve/CVE-2025-1934.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2025-1935.html">https://www.suse.com/security/cve/CVE-2025-1935.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2025-1936.html">https://www.suse.com/security/cve/CVE-2025-1936.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2025-1937.html">https://www.suse.com/security/cve/CVE-2025-1937.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2025-1938.html">https://www.suse.com/security/cve/CVE-2025-1938.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2025-26695.html">https://www.suse.com/security/cve/CVE-2025-26695.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2025-26696.html">https://www.suse.com/security/cve/CVE-2025-26696.html</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1237683">https://bugzilla.suse.com/show_bug.cgi?id=1237683</a>
</li>
</ul>
</div>
--===============4829461397160101561==--
|
|
|
|
