Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2023-28427
Vulnerability from cvelistv5
Published
2023-03-28 20:32
Modified
2025-02-18 20:03
Severity ?
EPSS score ?
Summary
matrix-js-sdk is a Matrix messaging protocol Client-Server SDK for JavaScript. In versions prior to 24.0.0 events sent with special strings in key places can temporarily disrupt or impede the matrix-js-sdk from functioning properly, potentially impacting the consumer's ability to process data safely. Note that the matrix-js-sdk can appear to be operating normally but be excluding or corrupting runtime data presented to the consumer. This vulnerability is distinct from GHSA-rfv9-x7hh-xc32 which covers a similar issue. The issue has been patched in matrix-js-sdk 24.0.0 and users are advised to upgrade. There are no known workarounds for this vulnerability.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| matrix-org | matrix-js-sdk |
Version: < 24.0.0 |
{ containers: { adp: [ { providerMetadata: { dateUpdated: "2024-08-02T12:38:25.414Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { name: "https://github.com/matrix-org/matrix-js-sdk/security/advisories/GHSA-mwq8-fjpf-c2gr", tags: [ "x_refsource_CONFIRM", "x_transferred", ], url: "https://github.com/matrix-org/matrix-js-sdk/security/advisories/GHSA-mwq8-fjpf-c2gr", }, { name: "https://matrix.org/blog/2023/03/28/security-releases-matrix-js-sdk-24-0-0-and-matrix-react-sdk-3-69-0", tags: [ "x_refsource_MISC", "x_transferred", ], url: "https://matrix.org/blog/2023/03/28/security-releases-matrix-js-sdk-24-0-0-and-matrix-react-sdk-3-69-0", }, { tags: [ "x_transferred", ], url: "https://www.debian.org/security/2023/dsa-5392", }, { tags: [ "x_transferred", ], url: "https://lists.debian.org/debian-lts-announce/2023/04/msg00027.html", }, { tags: [ "x_transferred", ], url: "https://security.gentoo.org/glsa/202305-36", }, ], title: "CVE Program Container", }, { metrics: [ { other: { content: { id: "CVE-2023-28427", options: [ { Exploitation: "none", }, { Automatable: "yes", }, { "Technical Impact": "partial", }, ], role: "CISA Coordinator", timestamp: "2025-02-18T20:03:37.180251Z", version: "2.0.3", }, type: "ssvc", }, }, ], providerMetadata: { dateUpdated: "2025-02-18T20:03:47.555Z", orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0", shortName: "CISA-ADP", }, title: "CISA ADP Vulnrichment", }, ], cna: { affected: [ { product: "matrix-js-sdk", vendor: "matrix-org", versions: [ { status: "affected", version: "< 24.0.0", }, ], }, ], descriptions: [ { lang: "en", value: "matrix-js-sdk is a Matrix messaging protocol Client-Server SDK for JavaScript. In versions prior to 24.0.0 events sent with special strings in key places can temporarily disrupt or impede the matrix-js-sdk from functioning properly, potentially impacting the consumer's ability to process data safely. Note that the matrix-js-sdk can appear to be operating normally but be excluding or corrupting runtime data presented to the consumer. This vulnerability is distinct from GHSA-rfv9-x7hh-xc32 which covers a similar issue. The issue has been patched in matrix-js-sdk 24.0.0 and users are advised to upgrade. There are no known workarounds for this vulnerability.", }, ], metrics: [ { cvssV3_1: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 8.2, baseSeverity: "HIGH", confidentialityImpact: "NONE", integrityImpact: "LOW", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H", version: "3.1", }, }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-1321", description: "CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2023-05-30T05:09:23.758Z", orgId: "a0819718-46f1-4df5-94e2-005712e83aaa", shortName: "GitHub_M", }, references: [ { name: "https://github.com/matrix-org/matrix-js-sdk/security/advisories/GHSA-mwq8-fjpf-c2gr", tags: [ "x_refsource_CONFIRM", ], url: "https://github.com/matrix-org/matrix-js-sdk/security/advisories/GHSA-mwq8-fjpf-c2gr", }, { name: "https://matrix.org/blog/2023/03/28/security-releases-matrix-js-sdk-24-0-0-and-matrix-react-sdk-3-69-0", tags: [ "x_refsource_MISC", ], url: "https://matrix.org/blog/2023/03/28/security-releases-matrix-js-sdk-24-0-0-and-matrix-react-sdk-3-69-0", }, { url: "https://www.debian.org/security/2023/dsa-5392", }, { url: "https://lists.debian.org/debian-lts-announce/2023/04/msg00027.html", }, { url: "https://security.gentoo.org/glsa/202305-36", }, ], source: { advisory: "GHSA-mwq8-fjpf-c2gr", discovery: "UNKNOWN", }, title: "Prototype pollution in matrix-js-sdk", }, }, cveMetadata: { assignerOrgId: "a0819718-46f1-4df5-94e2-005712e83aaa", assignerShortName: "GitHub_M", cveId: "CVE-2023-28427", datePublished: "2023-03-28T20:32:22.116Z", dateReserved: "2023-03-15T15:59:10.050Z", dateUpdated: "2025-02-18T20:03:47.555Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", "vulnerability-lookup:meta": { nvd: "{\"cve\":{\"id\":\"CVE-2023-28427\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2023-03-28T21:15:11.057\",\"lastModified\":\"2024-11-21T07:55:02.590\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"matrix-js-sdk is a Matrix messaging protocol Client-Server SDK for JavaScript. In versions prior to 24.0.0 events sent with special strings in key places can temporarily disrupt or impede the matrix-js-sdk from functioning properly, potentially impacting the consumer's ability to process data safely. Note that the matrix-js-sdk can appear to be operating normally but be excluding or corrupting runtime data presented to the consumer. This vulnerability is distinct from GHSA-rfv9-x7hh-xc32 which covers a similar issue. The issue has been patched in matrix-js-sdk 24.0.0 and users are advised to upgrade. There are no known workarounds for this vulnerability.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H\",\"baseScore\":8.2,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":4.2},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H\",\"baseScore\":8.2,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":4.2}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-1321\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:matrix:javascript_sdk:*:*:*:*:*:node.js:*:*\",\"versionEndExcluding\":\"24.0.0\",\"matchCriteriaId\":\"F62FDB36-FCF3-46AF-B806-FB5ADD18B0FD\"}]}]}],\"references\":[{\"url\":\"https://github.com/matrix-org/matrix-js-sdk/security/advisories/GHSA-mwq8-fjpf-c2gr\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2023/04/msg00027.html\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://matrix.org/blog/2023/03/28/security-releases-matrix-js-sdk-24-0-0-and-matrix-react-sdk-3-69-0\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://security.gentoo.org/glsa/202305-36\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://www.debian.org/security/2023/dsa-5392\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/matrix-org/matrix-js-sdk/security/advisories/GHSA-mwq8-fjpf-c2gr\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2023/04/msg00027.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://matrix.org/blog/2023/03/28/security-releases-matrix-js-sdk-24-0-0-and-matrix-react-sdk-3-69-0\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://security.gentoo.org/glsa/202305-36\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://www.debian.org/security/2023/dsa-5392\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}", vulnrichment: { containers: "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://github.com/matrix-org/matrix-js-sdk/security/advisories/GHSA-mwq8-fjpf-c2gr\", \"name\": \"https://github.com/matrix-org/matrix-js-sdk/security/advisories/GHSA-mwq8-fjpf-c2gr\", \"tags\": [\"x_refsource_CONFIRM\", \"x_transferred\"]}, {\"url\": \"https://matrix.org/blog/2023/03/28/security-releases-matrix-js-sdk-24-0-0-and-matrix-react-sdk-3-69-0\", \"name\": \"https://matrix.org/blog/2023/03/28/security-releases-matrix-js-sdk-24-0-0-and-matrix-react-sdk-3-69-0\", \"tags\": [\"x_refsource_MISC\", \"x_transferred\"]}, {\"url\": \"https://www.debian.org/security/2023/dsa-5392\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2023/04/msg00027.html\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://security.gentoo.org/glsa/202305-36\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T12:38:25.414Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2023-28427\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-02-18T20:03:37.180251Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-02-18T20:03:41.116Z\"}}], \"cna\": {\"title\": \"Prototype pollution in matrix-js-sdk\", \"source\": {\"advisory\": \"GHSA-mwq8-fjpf-c2gr\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 8.2, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H\", \"integrityImpact\": \"LOW\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"NONE\"}}], \"affected\": [{\"vendor\": \"matrix-org\", \"product\": \"matrix-js-sdk\", \"versions\": [{\"status\": \"affected\", \"version\": \"< 24.0.0\"}]}], \"references\": [{\"url\": \"https://github.com/matrix-org/matrix-js-sdk/security/advisories/GHSA-mwq8-fjpf-c2gr\", \"name\": \"https://github.com/matrix-org/matrix-js-sdk/security/advisories/GHSA-mwq8-fjpf-c2gr\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://matrix.org/blog/2023/03/28/security-releases-matrix-js-sdk-24-0-0-and-matrix-react-sdk-3-69-0\", \"name\": \"https://matrix.org/blog/2023/03/28/security-releases-matrix-js-sdk-24-0-0-and-matrix-react-sdk-3-69-0\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://www.debian.org/security/2023/dsa-5392\"}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2023/04/msg00027.html\"}, {\"url\": \"https://security.gentoo.org/glsa/202305-36\"}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"matrix-js-sdk is a Matrix messaging protocol Client-Server SDK for JavaScript. In versions prior to 24.0.0 events sent with special strings in key places can temporarily disrupt or impede the matrix-js-sdk from functioning properly, potentially impacting the consumer's ability to process data safely. Note that the matrix-js-sdk can appear to be operating normally but be excluding or corrupting runtime data presented to the consumer. This vulnerability is distinct from GHSA-rfv9-x7hh-xc32 which covers a similar issue. The issue has been patched in matrix-js-sdk 24.0.0 and users are advised to upgrade. There are no known workarounds for this vulnerability.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-1321\", \"description\": \"CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2023-05-30T05:09:23.758Z\"}}}", cveMetadata: "{\"cveId\": \"CVE-2023-28427\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-02-18T20:03:47.555Z\", \"dateReserved\": \"2023-03-15T15:59:10.050Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2023-03-28T20:32:22.116Z\", \"assignerShortName\": \"GitHub_M\"}", dataType: "CVE_RECORD", dataVersion: "5.1", }, }, }
rhsa-2023_1811
Vulnerability from csaf_redhat
Published
2023-04-17 14:15
Modified
2024-12-16 05:26
Summary
Red Hat Security Advisory: thunderbird security update
Notes
Topic
An update for thunderbird is now available for Red Hat Enterprise Linux 8.6 Extended Update Support.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Mozilla Thunderbird is a standalone mail and newsgroup client.
This update upgrades Thunderbird to version 102.10.0.
Security Fix(es):
* Thunderbird: Revocation status of S/Mime recipient certificates was not checked (CVE-2023-0547)
* Mozilla: Matrix SDK bundled with Thunderbird vulnerable to denial-of-service attack (CVE-2023-28427)
* Mozilla: Fullscreen notification obscured (CVE-2023-29533)
* Mozilla: Potential Memory Corruption following Garbage Collector compaction (CVE-2023-29535)
* Mozilla: Invalid free from JavaScript code (CVE-2023-29536)
* Mozilla: Memory safety bugs fixed in Firefox 112 and Firefox ESR 102.10 (CVE-2023-29550)
* Mozilla: Memory Corruption in Safe Browsing Code (CVE-2023-1945)
* Thunderbird: Hang when processing certain OpenPGP messages (CVE-2023-29479)
* Mozilla: Content-Disposition filename truncation leads to Reflected File Download (CVE-2023-29539)
* Mozilla: Files with malicious extensions could have been downloaded unsafely on Linux (CVE-2023-29541)
* Mozilla: Incorrect optimization result on ARM64 (CVE-2023-29548)
* MFSA-TMP-2023-0001 Mozilla: Double-free in libwebp (BZ#2186102)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ document: { aggregate_severity: { namespace: "https://access.redhat.com/security/updates/classification/", text: "Important", }, category: "csaf_security_advisory", csaf_version: "2.0", distribution: { text: "Copyright © Red Hat, Inc. All rights reserved.", tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "en", notes: [ { category: "summary", text: "An update for thunderbird is now available for Red Hat Enterprise Linux 8.6 Extended Update Support.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", title: "Topic", }, { category: "general", text: "Mozilla Thunderbird is a standalone mail and newsgroup client.\n\nThis update upgrades Thunderbird to version 102.10.0.\n\nSecurity Fix(es):\n\n* Thunderbird: Revocation status of S/Mime recipient certificates was not checked (CVE-2023-0547)\n\n* Mozilla: Matrix SDK bundled with Thunderbird vulnerable to denial-of-service attack (CVE-2023-28427)\n\n* Mozilla: Fullscreen notification obscured (CVE-2023-29533)\n\n* Mozilla: Potential Memory Corruption following Garbage Collector compaction (CVE-2023-29535)\n\n* Mozilla: Invalid free from JavaScript code (CVE-2023-29536)\n\n* Mozilla: Memory safety bugs fixed in Firefox 112 and Firefox ESR 102.10 (CVE-2023-29550)\n\n* Mozilla: Memory Corruption in Safe Browsing Code (CVE-2023-1945)\n\n* Thunderbird: Hang when processing certain OpenPGP messages (CVE-2023-29479)\n\n* Mozilla: Content-Disposition filename truncation leads to Reflected File Download (CVE-2023-29539)\n\n* Mozilla: Files with malicious extensions could have been downloaded unsafely on Linux (CVE-2023-29541)\n\n* Mozilla: Incorrect optimization result on ARM64 (CVE-2023-29548)\n\n* MFSA-TMP-2023-0001 Mozilla: Double-free in libwebp (BZ#2186102)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", title: "Details", }, { category: "legal_disclaimer", text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", title: "Terms of Use", }, ], publisher: { category: "vendor", contact_details: "https://access.redhat.com/security/team/contact/", issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", name: "Red Hat Product Security", namespace: "https://www.redhat.com", }, references: [ { category: "self", summary: "https://access.redhat.com/errata/RHSA-2023:1811", url: "https://access.redhat.com/errata/RHSA-2023:1811", }, { category: "external", summary: "https://access.redhat.com/security/updates/classification/#important", url: "https://access.redhat.com/security/updates/classification/#important", }, { category: "external", summary: "2183278", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2183278", }, { category: "external", summary: "2186101", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186101", }, { category: "external", summary: "2186102", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186102", }, { category: "external", summary: "2186103", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186103", }, { category: "external", summary: "2186104", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186104", }, { category: "external", summary: "2186105", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186105", }, { category: "external", summary: "2186106", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186106", }, { category: "external", summary: "2186109", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186109", }, { category: "external", summary: "2186110", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186110", }, { category: "external", summary: "2186111", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186111", }, { category: "external", summary: "2186734", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186734", }, { category: "external", summary: "2186735", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186735", }, { category: "self", summary: "Canonical URL", url: "https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_1811.json", }, ], title: "Red Hat Security Advisory: thunderbird security update", tracking: { current_release_date: "2024-12-16T05:26:55+00:00", generator: { date: "2024-12-16T05:26:55+00:00", engine: { name: "Red Hat SDEngine", version: "4.2.3", }, }, id: "RHSA-2023:1811", initial_release_date: "2023-04-17T14:15:32+00:00", revision_history: [ { date: "2023-04-17T14:15:32+00:00", number: "1", summary: "Initial version", }, { date: "2023-04-17T14:15:32+00:00", number: "2", summary: "Last updated version", }, { date: "2024-12-16T05:26:55+00:00", number: "3", summary: "Last generated version", }, ], status: "final", version: "3", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_name", name: "Red Hat Enterprise Linux AppStream EUS (v.8.6)", product: { name: "Red Hat Enterprise Linux AppStream EUS (v.8.6)", product_id: "AppStream-8.6.0.Z.EUS", product_identification_helper: { cpe: "cpe:/a:redhat:rhel_eus:8.6::appstream", }, }, }, ], category: "product_family", name: "Red Hat Enterprise Linux", }, { branches: [ { category: "product_version", name: "thunderbird-0:102.10.0-2.el8_6.src", product: { name: "thunderbird-0:102.10.0-2.el8_6.src", product_id: "thunderbird-0:102.10.0-2.el8_6.src", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird@102.10.0-2.el8_6?arch=src", }, }, }, ], category: "architecture", name: "src", }, { branches: [ { category: "product_version", name: "thunderbird-0:102.10.0-2.el8_6.aarch64", product: { name: "thunderbird-0:102.10.0-2.el8_6.aarch64", product_id: "thunderbird-0:102.10.0-2.el8_6.aarch64", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird@102.10.0-2.el8_6?arch=aarch64", }, }, }, { category: "product_version", name: "thunderbird-debugsource-0:102.10.0-2.el8_6.aarch64", product: { name: "thunderbird-debugsource-0:102.10.0-2.el8_6.aarch64", product_id: "thunderbird-debugsource-0:102.10.0-2.el8_6.aarch64", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird-debugsource@102.10.0-2.el8_6?arch=aarch64", }, }, }, { category: "product_version", name: "thunderbird-debuginfo-0:102.10.0-2.el8_6.aarch64", product: { name: "thunderbird-debuginfo-0:102.10.0-2.el8_6.aarch64", product_id: "thunderbird-debuginfo-0:102.10.0-2.el8_6.aarch64", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird-debuginfo@102.10.0-2.el8_6?arch=aarch64", }, }, }, ], category: "architecture", name: "aarch64", }, { branches: [ { category: "product_version", name: "thunderbird-0:102.10.0-2.el8_6.ppc64le", product: { name: "thunderbird-0:102.10.0-2.el8_6.ppc64le", product_id: "thunderbird-0:102.10.0-2.el8_6.ppc64le", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird@102.10.0-2.el8_6?arch=ppc64le", }, }, }, { category: "product_version", name: "thunderbird-debugsource-0:102.10.0-2.el8_6.ppc64le", product: { name: "thunderbird-debugsource-0:102.10.0-2.el8_6.ppc64le", product_id: "thunderbird-debugsource-0:102.10.0-2.el8_6.ppc64le", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird-debugsource@102.10.0-2.el8_6?arch=ppc64le", }, }, }, { category: "product_version", name: "thunderbird-debuginfo-0:102.10.0-2.el8_6.ppc64le", product: { name: "thunderbird-debuginfo-0:102.10.0-2.el8_6.ppc64le", product_id: "thunderbird-debuginfo-0:102.10.0-2.el8_6.ppc64le", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird-debuginfo@102.10.0-2.el8_6?arch=ppc64le", }, }, }, ], category: "architecture", name: "ppc64le", }, { branches: [ { category: "product_version", name: "thunderbird-0:102.10.0-2.el8_6.x86_64", product: { name: "thunderbird-0:102.10.0-2.el8_6.x86_64", product_id: "thunderbird-0:102.10.0-2.el8_6.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird@102.10.0-2.el8_6?arch=x86_64", }, }, }, { category: "product_version", name: "thunderbird-debugsource-0:102.10.0-2.el8_6.x86_64", product: { name: "thunderbird-debugsource-0:102.10.0-2.el8_6.x86_64", product_id: "thunderbird-debugsource-0:102.10.0-2.el8_6.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird-debugsource@102.10.0-2.el8_6?arch=x86_64", }, }, }, { category: "product_version", name: "thunderbird-debuginfo-0:102.10.0-2.el8_6.x86_64", product: { name: "thunderbird-debuginfo-0:102.10.0-2.el8_6.x86_64", product_id: "thunderbird-debuginfo-0:102.10.0-2.el8_6.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird-debuginfo@102.10.0-2.el8_6?arch=x86_64", }, }, }, ], category: "architecture", name: "x86_64", }, { branches: [ { category: "product_version", name: "thunderbird-0:102.10.0-2.el8_6.s390x", product: { name: "thunderbird-0:102.10.0-2.el8_6.s390x", product_id: "thunderbird-0:102.10.0-2.el8_6.s390x", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird@102.10.0-2.el8_6?arch=s390x", }, }, }, { category: "product_version", name: "thunderbird-debugsource-0:102.10.0-2.el8_6.s390x", product: { name: "thunderbird-debugsource-0:102.10.0-2.el8_6.s390x", product_id: "thunderbird-debugsource-0:102.10.0-2.el8_6.s390x", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird-debugsource@102.10.0-2.el8_6?arch=s390x", }, }, }, { category: "product_version", name: "thunderbird-debuginfo-0:102.10.0-2.el8_6.s390x", product: { name: "thunderbird-debuginfo-0:102.10.0-2.el8_6.s390x", product_id: "thunderbird-debuginfo-0:102.10.0-2.el8_6.s390x", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird-debuginfo@102.10.0-2.el8_6?arch=s390x", }, }, }, ], category: "architecture", name: "s390x", }, ], category: "vendor", name: "Red Hat", }, ], relationships: [ { category: "default_component_of", full_product_name: { name: "thunderbird-0:102.10.0-2.el8_6.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", product_id: "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.aarch64", }, product_reference: "thunderbird-0:102.10.0-2.el8_6.aarch64", relates_to_product_reference: "AppStream-8.6.0.Z.EUS", }, { category: "default_component_of", full_product_name: { name: "thunderbird-0:102.10.0-2.el8_6.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", product_id: "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.ppc64le", }, product_reference: "thunderbird-0:102.10.0-2.el8_6.ppc64le", relates_to_product_reference: "AppStream-8.6.0.Z.EUS", }, { category: "default_component_of", full_product_name: { name: "thunderbird-0:102.10.0-2.el8_6.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", product_id: "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.s390x", }, product_reference: "thunderbird-0:102.10.0-2.el8_6.s390x", relates_to_product_reference: "AppStream-8.6.0.Z.EUS", }, { category: "default_component_of", full_product_name: { name: "thunderbird-0:102.10.0-2.el8_6.src as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", product_id: "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.src", }, product_reference: "thunderbird-0:102.10.0-2.el8_6.src", relates_to_product_reference: "AppStream-8.6.0.Z.EUS", }, { category: "default_component_of", full_product_name: { name: "thunderbird-0:102.10.0-2.el8_6.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", product_id: "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.x86_64", }, product_reference: "thunderbird-0:102.10.0-2.el8_6.x86_64", relates_to_product_reference: "AppStream-8.6.0.Z.EUS", }, { category: "default_component_of", full_product_name: { name: "thunderbird-debuginfo-0:102.10.0-2.el8_6.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", product_id: "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.aarch64", }, product_reference: "thunderbird-debuginfo-0:102.10.0-2.el8_6.aarch64", relates_to_product_reference: "AppStream-8.6.0.Z.EUS", }, { category: "default_component_of", full_product_name: { name: "thunderbird-debuginfo-0:102.10.0-2.el8_6.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", product_id: "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.ppc64le", }, product_reference: "thunderbird-debuginfo-0:102.10.0-2.el8_6.ppc64le", relates_to_product_reference: "AppStream-8.6.0.Z.EUS", }, { category: "default_component_of", full_product_name: { name: "thunderbird-debuginfo-0:102.10.0-2.el8_6.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", product_id: "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.s390x", }, product_reference: "thunderbird-debuginfo-0:102.10.0-2.el8_6.s390x", relates_to_product_reference: "AppStream-8.6.0.Z.EUS", }, { category: "default_component_of", full_product_name: { name: "thunderbird-debuginfo-0:102.10.0-2.el8_6.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", product_id: "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.x86_64", }, product_reference: "thunderbird-debuginfo-0:102.10.0-2.el8_6.x86_64", relates_to_product_reference: "AppStream-8.6.0.Z.EUS", }, { category: "default_component_of", full_product_name: { name: "thunderbird-debugsource-0:102.10.0-2.el8_6.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", product_id: "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.aarch64", }, product_reference: "thunderbird-debugsource-0:102.10.0-2.el8_6.aarch64", relates_to_product_reference: "AppStream-8.6.0.Z.EUS", }, { category: "default_component_of", full_product_name: { name: "thunderbird-debugsource-0:102.10.0-2.el8_6.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", product_id: "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.ppc64le", }, product_reference: "thunderbird-debugsource-0:102.10.0-2.el8_6.ppc64le", relates_to_product_reference: "AppStream-8.6.0.Z.EUS", }, { category: "default_component_of", full_product_name: { name: "thunderbird-debugsource-0:102.10.0-2.el8_6.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", product_id: "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.s390x", }, product_reference: "thunderbird-debugsource-0:102.10.0-2.el8_6.s390x", relates_to_product_reference: "AppStream-8.6.0.Z.EUS", }, { category: "default_component_of", full_product_name: { name: "thunderbird-debugsource-0:102.10.0-2.el8_6.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", product_id: "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.x86_64", }, product_reference: "thunderbird-debugsource-0:102.10.0-2.el8_6.x86_64", relates_to_product_reference: "AppStream-8.6.0.Z.EUS", }, ], }, vulnerabilities: [ { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Paul Menzel", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-0547", cwe: { id: "CWE-356", name: "Product UI does not Warn User of Unsafe Actions", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186734", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nOCSP revocation status of recipient certificates was not checked when sending S/Mime encrypted email, and revoked certificates would be accepted. Thunderbird versions from 68 to 102.9.1 were affected by this bug.", title: "Vulnerability description", }, { category: "summary", text: "Thunderbird: Revocation status of S/Mime recipient certificates was not checked", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.src", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-0547", }, { category: "external", summary: "RHBZ#2186734", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186734", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-0547", url: "https://www.cve.org/CVERecord?id=CVE-2023-0547", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-0547", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-0547", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-15/#CVE-2023-0547", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-15/#CVE-2023-0547", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T14:15:32+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.src", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1811", }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 7.5, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.src", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "Thunderbird: Revocation status of S/Mime recipient certificates was not checked", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Gabriele Svelto", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-1945", cwe: { id: "CWE-119", name: "Improper Restriction of Operations within the Bounds of a Memory Buffer", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186109", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nUnexpected data returned from the Safe Browsing API could have led to memory corruption and a potentially exploitable crash.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Memory Corruption in Safe Browsing Code", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.src", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-1945", }, { category: "external", summary: "RHBZ#2186109", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186109", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-1945", url: "https://www.cve.org/CVERecord?id=CVE-2023-1945", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-1945", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-1945", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-1945", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-1945", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T14:15:32+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.src", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1811", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "NONE", baseScore: 6.1, baseSeverity: "MEDIUM", confidentialityImpact: "LOW", integrityImpact: "LOW", privilegesRequired: "NONE", scope: "CHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", version: "3.1", }, products: [ "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.src", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "Mozilla: Memory Corruption in Safe Browsing Code", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Irvan Kurniawan", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-1999", cwe: { id: "CWE-415", name: "Double Free", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186102", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nA double-free in libwebp could have led to memory corruption and a potentially exploitable crash.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: libwebp: Double-free in libwebp", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.src", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-1999", }, { category: "external", summary: "RHBZ#2186102", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186102", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-1999", url: "https://www.cve.org/CVERecord?id=CVE-2023-1999", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-1999", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-1999", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-1999", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-1999", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-15/#CVE-2023-1999", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-15/#CVE-2023-1999", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T14:15:32+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.src", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1811", }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 7.5, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.src", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "Mozilla: libwebp: Double-free in libwebp", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Matrix Security Team", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-28427", cwe: { id: "CWE-1321", name: "Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')", }, discovery_date: "2023-03-28T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2183278", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nThunderbird users who use the Matrix chat protocol were vulnerable to a denial-of-service attack.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Matrix SDK bundled with Thunderbird vulnerable to denial-of-service attack", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.src", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-28427", }, { category: "external", summary: "RHBZ#2183278", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2183278", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-28427", url: "https://www.cve.org/CVERecord?id=CVE-2023-28427", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-28427", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-28427", }, { category: "external", summary: "https://github.com/matrix-org/matrix-js-sdk/security/advisories/GHSA-mwq8-fjpf-c2gr", url: "https://github.com/matrix-org/matrix-js-sdk/security/advisories/GHSA-mwq8-fjpf-c2gr", }, { category: "external", summary: "https://matrix.org/blog/2023/03/28/security-releases-matrix-js-sdk-24-0-0-and-matrix-react-sdk-3-69-0", url: "https://matrix.org/blog/2023/03/28/security-releases-matrix-js-sdk-24-0-0-and-matrix-react-sdk-3-69-0", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-12/#CVE-2023-28427", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-12/#CVE-2023-28427", }, ], release_date: "2023-03-28T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T14:15:32+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.src", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1811", }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 7.5, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.src", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "Mozilla: Matrix SDK bundled with Thunderbird vulnerable to denial-of-service attack", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Ribose RNP Team", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29479", cwe: { id: "CWE-400", name: "Uncontrolled Resource Consumption", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186735", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nCertain malformed OpenPGP messages could trigger incorrect parsing of PKESK/SKESK packets due to a bug in the Ribose RNP library used by Thunderbird up to version 102.9.1, which would cause the Thunderbird user interface to hang. The issue was discovered using Google's oss-fuzz.", title: "Vulnerability description", }, { category: "summary", text: "Thunderbird: Hang when processing certain OpenPGP messages", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.src", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29479", }, { category: "external", summary: "RHBZ#2186735", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186735", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29479", url: "https://www.cve.org/CVERecord?id=CVE-2023-29479", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29479", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29479", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-15/#CVE-2023-29479", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-15/#CVE-2023-29479", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T14:15:32+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.src", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1811", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 6.5, baseSeverity: "MEDIUM", confidentialityImpact: "NONE", integrityImpact: "NONE", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", version: "3.1", }, products: [ "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.src", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "Thunderbird: Hang when processing certain OpenPGP messages", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Irvan Kurniawan", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29533", cwe: { id: "CWE-425", name: "Direct Request ('Forced Browsing')", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186101", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nA website could have obscured the fullscreen notification by using a combination of `window.open`, fullscreen requests, `window.name` assignments, and `setInterval` calls. This could have led to user confusion and possible spoofing attacks.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Fullscreen notification obscured", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.src", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29533", }, { category: "external", summary: "RHBZ#2186101", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186101", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29533", url: "https://www.cve.org/CVERecord?id=CVE-2023-29533", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29533", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29533", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29533", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29533", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T14:15:32+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.src", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1811", }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 7.5, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.src", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "Mozilla: Fullscreen notification obscured", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Lukas Bernhard", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29535", cwe: { id: "CWE-119", name: "Improper Restriction of Operations within the Bounds of a Memory Buffer", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186103", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nFollowing a Garbage Collector compaction, weak maps may have been accessed before they were correctly traced. This resulted in memory corruption and a potentially exploitable crash.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Potential Memory Corruption following Garbage Collector compaction", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.src", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29535", }, { category: "external", summary: "RHBZ#2186103", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186103", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29535", url: "https://www.cve.org/CVERecord?id=CVE-2023-29535", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29535", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29535", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29535", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29535", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T14:15:32+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.src", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1811", }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 7.5, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.src", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "Mozilla: Potential Memory Corruption following Garbage Collector compaction", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "zx from qriousec", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29536", cwe: { id: "CWE-617", name: "Reachable Assertion", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186104", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nAn attacker could cause the memory manager to incorrectly free a pointer that addresses attacker-controlled memory, resulting in an assertion, memory corruption, or a potentially exploitable crash.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Invalid free from JavaScript code", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.src", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29536", }, { category: "external", summary: "RHBZ#2186104", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186104", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29536", url: "https://www.cve.org/CVERecord?id=CVE-2023-29536", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29536", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29536", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29536", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29536", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T14:15:32+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.src", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1811", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 8.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.src", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "Mozilla: Invalid free from JavaScript code", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Trung Pham", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29539", cwe: { id: "CWE-159", name: "Improper Handling of Invalid Use of Special Elements", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186105", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nWhen handling the filename directive in the Content-Disposition header, the filename would be truncated if the filename contained a NULL character. This could have led to reflected file download attacks potentially tricking users to install malware.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Content-Disposition filename truncation leads to Reflected File Download", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.src", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29539", }, { category: "external", summary: "RHBZ#2186105", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186105", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29539", url: "https://www.cve.org/CVERecord?id=CVE-2023-29539", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29539", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29539", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29539", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29539", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T14:15:32+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.src", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1811", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 8.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.src", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "Mozilla: Content-Disposition filename truncation leads to Reflected File Download", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Ameen Basha M K", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29541", cwe: { id: "CWE-434", name: "Unrestricted Upload of File with Dangerous Type", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186106", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nFirefox did not properly handle downloads of files ending in `.desktop`, which can be interpreted to run attacker-controlled commands.\r\n\r\n*This bug only affects Firefox for Linux on certain Distributions. Other operating systems are unaffected, and Mozilla is unable to enumerate all affected Linux Distributions.*", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Files with malicious extensions could have been downloaded unsafely on Linux", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.src", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29541", }, { category: "external", summary: "RHBZ#2186106", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186106", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29541", url: "https://www.cve.org/CVERecord?id=CVE-2023-29541", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29541", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29541", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29541", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29541", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T14:15:32+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.src", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1811", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 8.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.src", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "Mozilla: Files with malicious extensions could have been downloaded unsafely on Linux", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "JunYoung Park", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29548", cwe: { id: "CWE-682", name: "Incorrect Calculation", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186110", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nA wrong lowering instruction in the ARM64 Ion compiler resulted in a wrong optimization result.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Incorrect optimization result on ARM64", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.src", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29548", }, { category: "external", summary: "RHBZ#2186110", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186110", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29548", url: "https://www.cve.org/CVERecord?id=CVE-2023-29548", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29548", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29548", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29548", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29548", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T14:15:32+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.src", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1811", }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "NONE", baseScore: 3.4, baseSeverity: "LOW", confidentialityImpact: "NONE", integrityImpact: "LOW", privilegesRequired: "NONE", scope: "CHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:N", version: "3.1", }, products: [ "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.src", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.x86_64", ], }, ], threats: [ { category: "impact", details: "Low", }, ], title: "Mozilla: Incorrect optimization result on ARM64", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Mozilla developers and community", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29550", cwe: { id: "CWE-120", name: "Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186111", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nMozilla developers Andrew Osmond, Sebastian Hengst, Andrew McCreight, and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 111 and Firefox ESR 102.9. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Memory safety bugs fixed in Firefox 112 and Firefox ESR 102.10", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.src", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29550", }, { category: "external", summary: "RHBZ#2186111", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186111", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29550", url: "https://www.cve.org/CVERecord?id=CVE-2023-29550", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29550", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29550", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29550", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29550", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T14:15:32+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.src", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1811", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 8.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.src", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "Mozilla: Memory safety bugs fixed in Firefox 112 and Firefox ESR 102.10", }, ], }
rhsa-2023_1806
Vulnerability from csaf_redhat
Published
2023-04-17 15:05
Modified
2024-12-16 05:26
Summary
Red Hat Security Advisory: thunderbird security update
Notes
Topic
An update for thunderbird is now available for Red Hat Enterprise Linux 7.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Mozilla Thunderbird is a standalone mail and newsgroup client.
This update upgrades Thunderbird to version 102.10.0.
Security Fix(es):
* Thunderbird: Revocation status of S/Mime recipient certificates was not checked (CVE-2023-0547)
* Mozilla: Matrix SDK bundled with Thunderbird vulnerable to denial-of-service attack (CVE-2023-28427)
* Mozilla: Fullscreen notification obscured (CVE-2023-29533)
* Mozilla: Potential Memory Corruption following Garbage Collector compaction (CVE-2023-29535)
* Mozilla: Invalid free from JavaScript code (CVE-2023-29536)
* Mozilla: Memory safety bugs fixed in Firefox 112 and Firefox ESR 102.10 (CVE-2023-29550)
* Mozilla: Memory Corruption in Safe Browsing Code (CVE-2023-1945)
* Thunderbird: Hang when processing certain OpenPGP messages (CVE-2023-29479)
* Mozilla: Content-Disposition filename truncation leads to Reflected File Download (CVE-2023-29539)
* Mozilla: Files with malicious extensions could have been downloaded unsafely on Linux (CVE-2023-29541)
* Mozilla: Incorrect optimization result on ARM64 (CVE-2023-29548)
* MFSA-TMP-2023-0001 Mozilla: Double-free in libwebp (BZ#2186102)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ document: { aggregate_severity: { namespace: "https://access.redhat.com/security/updates/classification/", text: "Important", }, category: "csaf_security_advisory", csaf_version: "2.0", distribution: { text: "Copyright © Red Hat, Inc. All rights reserved.", tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "en", notes: [ { category: "summary", text: "An update for thunderbird is now available for Red Hat Enterprise Linux 7.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", title: "Topic", }, { category: "general", text: "Mozilla Thunderbird is a standalone mail and newsgroup client.\n\nThis update upgrades Thunderbird to version 102.10.0.\n\nSecurity Fix(es):\n\n* Thunderbird: Revocation status of S/Mime recipient certificates was not checked (CVE-2023-0547)\n\n* Mozilla: Matrix SDK bundled with Thunderbird vulnerable to denial-of-service attack (CVE-2023-28427)\n\n* Mozilla: Fullscreen notification obscured (CVE-2023-29533)\n\n* Mozilla: Potential Memory Corruption following Garbage Collector compaction (CVE-2023-29535)\n\n* Mozilla: Invalid free from JavaScript code (CVE-2023-29536)\n\n* Mozilla: Memory safety bugs fixed in Firefox 112 and Firefox ESR 102.10 (CVE-2023-29550)\n\n* Mozilla: Memory Corruption in Safe Browsing Code (CVE-2023-1945)\n\n* Thunderbird: Hang when processing certain OpenPGP messages (CVE-2023-29479)\n\n* Mozilla: Content-Disposition filename truncation leads to Reflected File Download (CVE-2023-29539)\n\n* Mozilla: Files with malicious extensions could have been downloaded unsafely on Linux (CVE-2023-29541)\n\n* Mozilla: Incorrect optimization result on ARM64 (CVE-2023-29548)\n\n* MFSA-TMP-2023-0001 Mozilla: Double-free in libwebp (BZ#2186102)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", title: "Details", }, { category: "legal_disclaimer", text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", title: "Terms of Use", }, ], publisher: { category: "vendor", contact_details: "https://access.redhat.com/security/team/contact/", issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", name: "Red Hat Product Security", namespace: "https://www.redhat.com", }, references: [ { category: "self", summary: "https://access.redhat.com/errata/RHSA-2023:1806", url: "https://access.redhat.com/errata/RHSA-2023:1806", }, { category: "external", summary: "https://access.redhat.com/security/updates/classification/#important", url: "https://access.redhat.com/security/updates/classification/#important", }, { category: "external", summary: "2183278", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2183278", }, { category: "external", summary: "2186101", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186101", }, { category: "external", summary: "2186102", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186102", }, { category: "external", summary: "2186103", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186103", }, { category: "external", summary: "2186104", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186104", }, { category: "external", summary: "2186105", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186105", }, { category: "external", summary: "2186106", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186106", }, { category: "external", summary: "2186109", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186109", }, { category: "external", summary: "2186110", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186110", }, { category: "external", summary: "2186111", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186111", }, { category: "external", summary: "2186734", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186734", }, { category: "external", summary: "2186735", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186735", }, { category: "self", summary: "Canonical URL", url: "https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_1806.json", }, ], title: "Red Hat Security Advisory: thunderbird security update", tracking: { current_release_date: "2024-12-16T05:26:29+00:00", generator: { date: "2024-12-16T05:26:29+00:00", engine: { name: "Red Hat SDEngine", version: "4.2.3", }, }, id: "RHSA-2023:1806", initial_release_date: "2023-04-17T15:05:37+00:00", revision_history: [ { date: "2023-04-17T15:05:37+00:00", number: "1", summary: "Initial version", }, { date: "2023-04-17T15:05:37+00:00", number: "2", summary: "Last updated version", }, { date: "2024-12-16T05:26:29+00:00", number: "3", summary: "Last generated version", }, ], status: "final", version: "3", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_name", name: "Red Hat Enterprise Linux Client (v. 7)", product: { name: "Red Hat Enterprise Linux Client (v. 7)", product_id: "7Client-7.9.Z", product_identification_helper: { cpe: "cpe:/o:redhat:enterprise_linux:7::client", }, }, }, { category: "product_name", name: "Red Hat Enterprise Linux Server Optional (v. 7)", product: { name: "Red Hat Enterprise Linux Server Optional (v. 7)", product_id: "7Server-optional-7.9.Z", product_identification_helper: { cpe: "cpe:/o:redhat:enterprise_linux:7::server", }, }, }, { category: "product_name", name: "Red Hat Enterprise Linux Workstation (v. 7)", product: { name: "Red Hat Enterprise Linux Workstation (v. 7)", product_id: "7Workstation-7.9.Z", product_identification_helper: { cpe: "cpe:/o:redhat:enterprise_linux:7::workstation", }, }, }, ], category: "product_family", name: "Red Hat Enterprise Linux", }, { branches: [ { category: "product_version", name: "thunderbird-0:102.10.0-2.el7_9.src", product: { name: "thunderbird-0:102.10.0-2.el7_9.src", product_id: "thunderbird-0:102.10.0-2.el7_9.src", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird@102.10.0-2.el7_9?arch=src", }, }, }, ], category: "architecture", name: "src", }, { branches: [ { category: "product_version", name: "thunderbird-0:102.10.0-2.el7_9.x86_64", product: { name: "thunderbird-0:102.10.0-2.el7_9.x86_64", product_id: "thunderbird-0:102.10.0-2.el7_9.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird@102.10.0-2.el7_9?arch=x86_64", }, }, }, { category: "product_version", name: "thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", product: { name: "thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", product_id: "thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird-debuginfo@102.10.0-2.el7_9?arch=x86_64", }, }, }, ], category: "architecture", name: "x86_64", }, { branches: [ { category: "product_version", name: "thunderbird-0:102.10.0-2.el7_9.ppc64le", product: { name: "thunderbird-0:102.10.0-2.el7_9.ppc64le", product_id: "thunderbird-0:102.10.0-2.el7_9.ppc64le", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird@102.10.0-2.el7_9?arch=ppc64le", }, }, }, { category: "product_version", name: "thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", product: { name: "thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", product_id: "thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird-debuginfo@102.10.0-2.el7_9?arch=ppc64le", }, }, }, ], category: "architecture", name: "ppc64le", }, ], category: "vendor", name: "Red Hat", }, ], relationships: [ { category: "default_component_of", full_product_name: { name: "thunderbird-0:102.10.0-2.el7_9.ppc64le as a component of Red Hat Enterprise Linux Client (v. 7)", product_id: "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", }, product_reference: "thunderbird-0:102.10.0-2.el7_9.ppc64le", relates_to_product_reference: "7Client-7.9.Z", }, { category: "default_component_of", full_product_name: { name: "thunderbird-0:102.10.0-2.el7_9.src as a component of Red Hat Enterprise Linux Client (v. 7)", product_id: "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", }, product_reference: "thunderbird-0:102.10.0-2.el7_9.src", relates_to_product_reference: "7Client-7.9.Z", }, { category: "default_component_of", full_product_name: { name: "thunderbird-0:102.10.0-2.el7_9.x86_64 as a component of Red Hat Enterprise Linux Client (v. 7)", product_id: "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", }, product_reference: "thunderbird-0:102.10.0-2.el7_9.x86_64", relates_to_product_reference: "7Client-7.9.Z", }, { category: "default_component_of", full_product_name: { name: "thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le as a component of Red Hat Enterprise Linux Client (v. 7)", product_id: "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", }, product_reference: "thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", relates_to_product_reference: "7Client-7.9.Z", }, { category: "default_component_of", full_product_name: { name: "thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64 as a component of Red Hat Enterprise Linux Client (v. 7)", product_id: "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", }, product_reference: "thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", relates_to_product_reference: "7Client-7.9.Z", }, { category: "default_component_of", full_product_name: { name: "thunderbird-0:102.10.0-2.el7_9.ppc64le as a component of Red Hat Enterprise Linux Server Optional (v. 7)", product_id: "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", }, product_reference: "thunderbird-0:102.10.0-2.el7_9.ppc64le", relates_to_product_reference: "7Server-optional-7.9.Z", }, { category: "default_component_of", full_product_name: { name: "thunderbird-0:102.10.0-2.el7_9.src as a component of Red Hat Enterprise Linux Server Optional (v. 7)", product_id: "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", }, product_reference: "thunderbird-0:102.10.0-2.el7_9.src", relates_to_product_reference: "7Server-optional-7.9.Z", }, { category: "default_component_of", full_product_name: { name: "thunderbird-0:102.10.0-2.el7_9.x86_64 as a component of Red Hat Enterprise Linux Server Optional (v. 7)", product_id: "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", }, product_reference: "thunderbird-0:102.10.0-2.el7_9.x86_64", relates_to_product_reference: "7Server-optional-7.9.Z", }, { category: "default_component_of", full_product_name: { name: "thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le as a component of Red Hat Enterprise Linux Server Optional (v. 7)", product_id: "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", }, product_reference: "thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", relates_to_product_reference: "7Server-optional-7.9.Z", }, { category: "default_component_of", full_product_name: { name: "thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64 as a component of Red Hat Enterprise Linux Server Optional (v. 7)", product_id: "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", }, product_reference: "thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", relates_to_product_reference: "7Server-optional-7.9.Z", }, { category: "default_component_of", full_product_name: { name: "thunderbird-0:102.10.0-2.el7_9.ppc64le as a component of Red Hat Enterprise Linux Workstation (v. 7)", product_id: "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", }, product_reference: "thunderbird-0:102.10.0-2.el7_9.ppc64le", relates_to_product_reference: "7Workstation-7.9.Z", }, { category: "default_component_of", full_product_name: { name: "thunderbird-0:102.10.0-2.el7_9.src as a component of Red Hat Enterprise Linux Workstation (v. 7)", product_id: "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", }, product_reference: "thunderbird-0:102.10.0-2.el7_9.src", relates_to_product_reference: "7Workstation-7.9.Z", }, { category: "default_component_of", full_product_name: { name: "thunderbird-0:102.10.0-2.el7_9.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 7)", product_id: "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", }, product_reference: "thunderbird-0:102.10.0-2.el7_9.x86_64", relates_to_product_reference: "7Workstation-7.9.Z", }, { category: "default_component_of", full_product_name: { name: "thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le as a component of Red Hat Enterprise Linux Workstation (v. 7)", product_id: "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", }, product_reference: "thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", relates_to_product_reference: "7Workstation-7.9.Z", }, { category: "default_component_of", full_product_name: { name: "thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 7)", product_id: "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", }, product_reference: "thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", relates_to_product_reference: "7Workstation-7.9.Z", }, ], }, vulnerabilities: [ { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Paul Menzel", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-0547", cwe: { id: "CWE-356", name: "Product UI does not Warn User of Unsafe Actions", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186734", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nOCSP revocation status of recipient certificates was not checked when sending S/Mime encrypted email, and revoked certificates would be accepted. Thunderbird versions from 68 to 102.9.1 were affected by this bug.", title: "Vulnerability description", }, { category: "summary", text: "Thunderbird: Revocation status of S/Mime recipient certificates was not checked", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-0547", }, { category: "external", summary: "RHBZ#2186734", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186734", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-0547", url: "https://www.cve.org/CVERecord?id=CVE-2023-0547", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-0547", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-0547", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-15/#CVE-2023-0547", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-15/#CVE-2023-0547", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T15:05:37+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1806", }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 7.5, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "Thunderbird: Revocation status of S/Mime recipient certificates was not checked", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Gabriele Svelto", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-1945", cwe: { id: "CWE-119", name: "Improper Restriction of Operations within the Bounds of a Memory Buffer", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186109", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nUnexpected data returned from the Safe Browsing API could have led to memory corruption and a potentially exploitable crash.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Memory Corruption in Safe Browsing Code", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-1945", }, { category: "external", summary: "RHBZ#2186109", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186109", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-1945", url: "https://www.cve.org/CVERecord?id=CVE-2023-1945", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-1945", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-1945", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-1945", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-1945", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T15:05:37+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1806", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "NONE", baseScore: 6.1, baseSeverity: "MEDIUM", confidentialityImpact: "LOW", integrityImpact: "LOW", privilegesRequired: "NONE", scope: "CHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", version: "3.1", }, products: [ "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "Mozilla: Memory Corruption in Safe Browsing Code", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Irvan Kurniawan", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-1999", cwe: { id: "CWE-415", name: "Double Free", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186102", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nA double-free in libwebp could have led to memory corruption and a potentially exploitable crash.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: libwebp: Double-free in libwebp", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-1999", }, { category: "external", summary: "RHBZ#2186102", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186102", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-1999", url: "https://www.cve.org/CVERecord?id=CVE-2023-1999", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-1999", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-1999", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-1999", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-1999", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-15/#CVE-2023-1999", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-15/#CVE-2023-1999", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T15:05:37+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1806", }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 7.5, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "Mozilla: libwebp: Double-free in libwebp", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Matrix Security Team", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-28427", cwe: { id: "CWE-1321", name: "Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')", }, discovery_date: "2023-03-28T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2183278", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nThunderbird users who use the Matrix chat protocol were vulnerable to a denial-of-service attack.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Matrix SDK bundled with Thunderbird vulnerable to denial-of-service attack", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-28427", }, { category: "external", summary: "RHBZ#2183278", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2183278", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-28427", url: "https://www.cve.org/CVERecord?id=CVE-2023-28427", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-28427", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-28427", }, { category: "external", summary: "https://github.com/matrix-org/matrix-js-sdk/security/advisories/GHSA-mwq8-fjpf-c2gr", url: "https://github.com/matrix-org/matrix-js-sdk/security/advisories/GHSA-mwq8-fjpf-c2gr", }, { category: "external", summary: "https://matrix.org/blog/2023/03/28/security-releases-matrix-js-sdk-24-0-0-and-matrix-react-sdk-3-69-0", url: "https://matrix.org/blog/2023/03/28/security-releases-matrix-js-sdk-24-0-0-and-matrix-react-sdk-3-69-0", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-12/#CVE-2023-28427", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-12/#CVE-2023-28427", }, ], release_date: "2023-03-28T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T15:05:37+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1806", }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 7.5, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "Mozilla: Matrix SDK bundled with Thunderbird vulnerable to denial-of-service attack", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Ribose RNP Team", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29479", cwe: { id: "CWE-400", name: "Uncontrolled Resource Consumption", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186735", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nCertain malformed OpenPGP messages could trigger incorrect parsing of PKESK/SKESK packets due to a bug in the Ribose RNP library used by Thunderbird up to version 102.9.1, which would cause the Thunderbird user interface to hang. The issue was discovered using Google's oss-fuzz.", title: "Vulnerability description", }, { category: "summary", text: "Thunderbird: Hang when processing certain OpenPGP messages", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29479", }, { category: "external", summary: "RHBZ#2186735", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186735", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29479", url: "https://www.cve.org/CVERecord?id=CVE-2023-29479", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29479", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29479", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-15/#CVE-2023-29479", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-15/#CVE-2023-29479", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T15:05:37+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1806", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 6.5, baseSeverity: "MEDIUM", confidentialityImpact: "NONE", integrityImpact: "NONE", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", version: "3.1", }, products: [ "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "Thunderbird: Hang when processing certain OpenPGP messages", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Irvan Kurniawan", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29533", cwe: { id: "CWE-425", name: "Direct Request ('Forced Browsing')", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186101", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nA website could have obscured the fullscreen notification by using a combination of `window.open`, fullscreen requests, `window.name` assignments, and `setInterval` calls. This could have led to user confusion and possible spoofing attacks.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Fullscreen notification obscured", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29533", }, { category: "external", summary: "RHBZ#2186101", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186101", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29533", url: "https://www.cve.org/CVERecord?id=CVE-2023-29533", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29533", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29533", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29533", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29533", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T15:05:37+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1806", }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 7.5, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "Mozilla: Fullscreen notification obscured", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Lukas Bernhard", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29535", cwe: { id: "CWE-119", name: "Improper Restriction of Operations within the Bounds of a Memory Buffer", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186103", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nFollowing a Garbage Collector compaction, weak maps may have been accessed before they were correctly traced. This resulted in memory corruption and a potentially exploitable crash.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Potential Memory Corruption following Garbage Collector compaction", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29535", }, { category: "external", summary: "RHBZ#2186103", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186103", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29535", url: "https://www.cve.org/CVERecord?id=CVE-2023-29535", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29535", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29535", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29535", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29535", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T15:05:37+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1806", }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 7.5, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "Mozilla: Potential Memory Corruption following Garbage Collector compaction", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "zx from qriousec", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29536", cwe: { id: "CWE-617", name: "Reachable Assertion", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186104", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nAn attacker could cause the memory manager to incorrectly free a pointer that addresses attacker-controlled memory, resulting in an assertion, memory corruption, or a potentially exploitable crash.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Invalid free from JavaScript code", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29536", }, { category: "external", summary: "RHBZ#2186104", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186104", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29536", url: "https://www.cve.org/CVERecord?id=CVE-2023-29536", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29536", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29536", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29536", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29536", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T15:05:37+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1806", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 8.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "Mozilla: Invalid free from JavaScript code", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Trung Pham", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29539", cwe: { id: "CWE-159", name: "Improper Handling of Invalid Use of Special Elements", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186105", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nWhen handling the filename directive in the Content-Disposition header, the filename would be truncated if the filename contained a NULL character. This could have led to reflected file download attacks potentially tricking users to install malware.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Content-Disposition filename truncation leads to Reflected File Download", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29539", }, { category: "external", summary: "RHBZ#2186105", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186105", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29539", url: "https://www.cve.org/CVERecord?id=CVE-2023-29539", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29539", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29539", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29539", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29539", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T15:05:37+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1806", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 8.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "Mozilla: Content-Disposition filename truncation leads to Reflected File Download", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Ameen Basha M K", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29541", cwe: { id: "CWE-434", name: "Unrestricted Upload of File with Dangerous Type", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186106", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nFirefox did not properly handle downloads of files ending in `.desktop`, which can be interpreted to run attacker-controlled commands.\r\n\r\n*This bug only affects Firefox for Linux on certain Distributions. Other operating systems are unaffected, and Mozilla is unable to enumerate all affected Linux Distributions.*", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Files with malicious extensions could have been downloaded unsafely on Linux", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29541", }, { category: "external", summary: "RHBZ#2186106", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186106", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29541", url: "https://www.cve.org/CVERecord?id=CVE-2023-29541", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29541", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29541", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29541", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29541", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T15:05:37+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1806", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 8.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "Mozilla: Files with malicious extensions could have been downloaded unsafely on Linux", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "JunYoung Park", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29548", cwe: { id: "CWE-682", name: "Incorrect Calculation", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186110", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nA wrong lowering instruction in the ARM64 Ion compiler resulted in a wrong optimization result.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Incorrect optimization result on ARM64", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29548", }, { category: "external", summary: "RHBZ#2186110", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186110", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29548", url: "https://www.cve.org/CVERecord?id=CVE-2023-29548", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29548", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29548", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29548", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29548", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T15:05:37+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1806", }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "NONE", baseScore: 3.4, baseSeverity: "LOW", confidentialityImpact: "NONE", integrityImpact: "LOW", privilegesRequired: "NONE", scope: "CHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:N", version: "3.1", }, products: [ "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", ], }, ], threats: [ { category: "impact", details: "Low", }, ], title: "Mozilla: Incorrect optimization result on ARM64", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Mozilla developers and community", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29550", cwe: { id: "CWE-120", name: "Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186111", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nMozilla developers Andrew Osmond, Sebastian Hengst, Andrew McCreight, and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 111 and Firefox ESR 102.9. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Memory safety bugs fixed in Firefox 112 and Firefox ESR 102.10", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29550", }, { category: "external", summary: "RHBZ#2186111", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186111", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29550", url: "https://www.cve.org/CVERecord?id=CVE-2023-29550", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29550", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29550", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29550", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29550", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T15:05:37+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1806", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 8.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "Mozilla: Memory safety bugs fixed in Firefox 112 and Firefox ESR 102.10", }, ], }
RHSA-2023:1809
Vulnerability from csaf_redhat
Published
2023-04-17 14:10
Modified
2024-12-16 05:27
Summary
Red Hat Security Advisory: thunderbird security update
Notes
Topic
An update for thunderbird is now available for Red Hat Enterprise Linux 9.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Mozilla Thunderbird is a standalone mail and newsgroup client.
This update upgrades Thunderbird to version 102.10.0.
Security Fix(es):
* Thunderbird: Revocation status of S/Mime recipient certificates was not checked (CVE-2023-0547)
* Mozilla: Matrix SDK bundled with Thunderbird vulnerable to denial-of-service attack (CVE-2023-28427)
* Mozilla: Fullscreen notification obscured (CVE-2023-29533)
* Mozilla: Potential Memory Corruption following Garbage Collector compaction (CVE-2023-29535)
* Mozilla: Invalid free from JavaScript code (CVE-2023-29536)
* Mozilla: Memory safety bugs fixed in Firefox 112 and Firefox ESR 102.10 (CVE-2023-29550)
* Mozilla: Memory Corruption in Safe Browsing Code (CVE-2023-1945)
* Thunderbird: Hang when processing certain OpenPGP messages (CVE-2023-29479)
* Mozilla: Content-Disposition filename truncation leads to Reflected File Download (CVE-2023-29539)
* Mozilla: Files with malicious extensions could have been downloaded unsafely on Linux (CVE-2023-29541)
* Mozilla: Incorrect optimization result on ARM64 (CVE-2023-29548)
* MFSA-TMP-2023-0001 Mozilla: Double-free in libwebp (BZ#2186102)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ document: { aggregate_severity: { namespace: "https://access.redhat.com/security/updates/classification/", text: "Important", }, category: "csaf_security_advisory", csaf_version: "2.0", distribution: { text: "Copyright © Red Hat, Inc. All rights reserved.", tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "en", notes: [ { category: "summary", text: "An update for thunderbird is now available for Red Hat Enterprise Linux 9.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", title: "Topic", }, { category: "general", text: "Mozilla Thunderbird is a standalone mail and newsgroup client.\n\nThis update upgrades Thunderbird to version 102.10.0.\n\nSecurity Fix(es):\n\n* Thunderbird: Revocation status of S/Mime recipient certificates was not checked (CVE-2023-0547)\n\n* Mozilla: Matrix SDK bundled with Thunderbird vulnerable to denial-of-service attack (CVE-2023-28427)\n\n* Mozilla: Fullscreen notification obscured (CVE-2023-29533)\n\n* Mozilla: Potential Memory Corruption following Garbage Collector compaction (CVE-2023-29535)\n\n* Mozilla: Invalid free from JavaScript code (CVE-2023-29536)\n\n* Mozilla: Memory safety bugs fixed in Firefox 112 and Firefox ESR 102.10 (CVE-2023-29550)\n\n* Mozilla: Memory Corruption in Safe Browsing Code (CVE-2023-1945)\n\n* Thunderbird: Hang when processing certain OpenPGP messages (CVE-2023-29479)\n\n* Mozilla: Content-Disposition filename truncation leads to Reflected File Download (CVE-2023-29539)\n\n* Mozilla: Files with malicious extensions could have been downloaded unsafely on Linux (CVE-2023-29541)\n\n* Mozilla: Incorrect optimization result on ARM64 (CVE-2023-29548)\n\n* MFSA-TMP-2023-0001 Mozilla: Double-free in libwebp (BZ#2186102)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", title: "Details", }, { category: "legal_disclaimer", text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", title: "Terms of Use", }, ], publisher: { category: "vendor", contact_details: "https://access.redhat.com/security/team/contact/", issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", name: "Red Hat Product Security", namespace: "https://www.redhat.com", }, references: [ { category: "self", summary: "https://access.redhat.com/errata/RHSA-2023:1809", url: "https://access.redhat.com/errata/RHSA-2023:1809", }, { category: "external", summary: "https://access.redhat.com/security/updates/classification/#important", url: "https://access.redhat.com/security/updates/classification/#important", }, { category: "external", summary: "2183278", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2183278", }, { category: "external", summary: "2186101", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186101", }, { category: "external", summary: "2186102", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186102", }, { category: "external", summary: "2186103", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186103", }, { category: "external", summary: "2186104", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186104", }, { category: "external", summary: "2186105", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186105", }, { category: "external", summary: "2186106", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186106", }, { category: "external", summary: "2186109", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186109", }, { category: "external", summary: "2186110", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186110", }, { category: "external", summary: "2186111", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186111", }, { category: "external", summary: "2186734", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186734", }, { category: "external", summary: "2186735", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186735", }, { category: "self", summary: "Canonical URL", url: "https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_1809.json", }, ], title: "Red Hat Security Advisory: thunderbird security update", tracking: { current_release_date: "2024-12-16T05:27:13+00:00", generator: { date: "2024-12-16T05:27:13+00:00", engine: { name: "Red Hat SDEngine", version: "4.2.3", }, }, id: "RHSA-2023:1809", initial_release_date: "2023-04-17T14:10:15+00:00", revision_history: [ { date: "2023-04-17T14:10:15+00:00", number: "1", summary: "Initial version", }, { date: "2023-04-17T14:10:15+00:00", number: "2", summary: "Last updated version", }, { date: "2024-12-16T05:27:13+00:00", number: "3", summary: "Last generated version", }, ], status: "final", version: "3", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_name", name: "Red Hat Enterprise Linux AppStream (v. 9)", product: { name: "Red Hat Enterprise Linux AppStream (v. 9)", product_id: "AppStream-9.1.0.Z.MAIN", product_identification_helper: { cpe: "cpe:/a:redhat:enterprise_linux:9::appstream", }, }, }, ], category: "product_family", name: "Red Hat Enterprise Linux", }, { branches: [ { category: "product_version", name: "thunderbird-0:102.10.0-2.el9_1.src", product: { name: "thunderbird-0:102.10.0-2.el9_1.src", product_id: "thunderbird-0:102.10.0-2.el9_1.src", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird@102.10.0-2.el9_1?arch=src", }, }, }, ], category: "architecture", name: "src", }, { branches: [ { category: "product_version", name: "thunderbird-0:102.10.0-2.el9_1.aarch64", product: { name: "thunderbird-0:102.10.0-2.el9_1.aarch64", product_id: "thunderbird-0:102.10.0-2.el9_1.aarch64", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird@102.10.0-2.el9_1?arch=aarch64", }, }, }, { category: "product_version", name: "thunderbird-debugsource-0:102.10.0-2.el9_1.aarch64", product: { name: "thunderbird-debugsource-0:102.10.0-2.el9_1.aarch64", product_id: "thunderbird-debugsource-0:102.10.0-2.el9_1.aarch64", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird-debugsource@102.10.0-2.el9_1?arch=aarch64", }, }, }, { category: "product_version", name: "thunderbird-debuginfo-0:102.10.0-2.el9_1.aarch64", product: { name: "thunderbird-debuginfo-0:102.10.0-2.el9_1.aarch64", product_id: "thunderbird-debuginfo-0:102.10.0-2.el9_1.aarch64", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird-debuginfo@102.10.0-2.el9_1?arch=aarch64", }, }, }, ], category: "architecture", name: "aarch64", }, { branches: [ { category: "product_version", name: "thunderbird-0:102.10.0-2.el9_1.ppc64le", product: { name: "thunderbird-0:102.10.0-2.el9_1.ppc64le", product_id: "thunderbird-0:102.10.0-2.el9_1.ppc64le", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird@102.10.0-2.el9_1?arch=ppc64le", }, }, }, { category: "product_version", name: "thunderbird-debugsource-0:102.10.0-2.el9_1.ppc64le", product: { name: "thunderbird-debugsource-0:102.10.0-2.el9_1.ppc64le", product_id: "thunderbird-debugsource-0:102.10.0-2.el9_1.ppc64le", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird-debugsource@102.10.0-2.el9_1?arch=ppc64le", }, }, }, { category: "product_version", name: "thunderbird-debuginfo-0:102.10.0-2.el9_1.ppc64le", product: { name: "thunderbird-debuginfo-0:102.10.0-2.el9_1.ppc64le", product_id: "thunderbird-debuginfo-0:102.10.0-2.el9_1.ppc64le", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird-debuginfo@102.10.0-2.el9_1?arch=ppc64le", }, }, }, ], category: "architecture", name: "ppc64le", }, { branches: [ { category: "product_version", name: "thunderbird-0:102.10.0-2.el9_1.x86_64", product: { name: "thunderbird-0:102.10.0-2.el9_1.x86_64", product_id: "thunderbird-0:102.10.0-2.el9_1.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird@102.10.0-2.el9_1?arch=x86_64", }, }, }, { category: "product_version", name: "thunderbird-debugsource-0:102.10.0-2.el9_1.x86_64", product: { name: "thunderbird-debugsource-0:102.10.0-2.el9_1.x86_64", product_id: "thunderbird-debugsource-0:102.10.0-2.el9_1.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird-debugsource@102.10.0-2.el9_1?arch=x86_64", }, }, }, { category: "product_version", name: "thunderbird-debuginfo-0:102.10.0-2.el9_1.x86_64", product: { name: "thunderbird-debuginfo-0:102.10.0-2.el9_1.x86_64", product_id: "thunderbird-debuginfo-0:102.10.0-2.el9_1.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird-debuginfo@102.10.0-2.el9_1?arch=x86_64", }, }, }, ], category: "architecture", name: "x86_64", }, { branches: [ { category: "product_version", name: "thunderbird-0:102.10.0-2.el9_1.s390x", product: { name: "thunderbird-0:102.10.0-2.el9_1.s390x", product_id: "thunderbird-0:102.10.0-2.el9_1.s390x", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird@102.10.0-2.el9_1?arch=s390x", }, }, }, { category: "product_version", name: "thunderbird-debugsource-0:102.10.0-2.el9_1.s390x", product: { name: "thunderbird-debugsource-0:102.10.0-2.el9_1.s390x", product_id: "thunderbird-debugsource-0:102.10.0-2.el9_1.s390x", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird-debugsource@102.10.0-2.el9_1?arch=s390x", }, }, }, { category: "product_version", name: "thunderbird-debuginfo-0:102.10.0-2.el9_1.s390x", product: { name: "thunderbird-debuginfo-0:102.10.0-2.el9_1.s390x", product_id: "thunderbird-debuginfo-0:102.10.0-2.el9_1.s390x", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird-debuginfo@102.10.0-2.el9_1?arch=s390x", }, }, }, ], category: "architecture", name: "s390x", }, ], category: "vendor", name: "Red Hat", }, ], relationships: [ { category: "default_component_of", full_product_name: { name: "thunderbird-0:102.10.0-2.el9_1.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)", product_id: "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.aarch64", }, product_reference: "thunderbird-0:102.10.0-2.el9_1.aarch64", relates_to_product_reference: "AppStream-9.1.0.Z.MAIN", }, { category: "default_component_of", full_product_name: { name: "thunderbird-0:102.10.0-2.el9_1.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)", product_id: "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.ppc64le", }, product_reference: "thunderbird-0:102.10.0-2.el9_1.ppc64le", relates_to_product_reference: "AppStream-9.1.0.Z.MAIN", }, { category: "default_component_of", full_product_name: { name: "thunderbird-0:102.10.0-2.el9_1.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)", product_id: "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.s390x", }, product_reference: "thunderbird-0:102.10.0-2.el9_1.s390x", relates_to_product_reference: "AppStream-9.1.0.Z.MAIN", }, { category: "default_component_of", full_product_name: { name: "thunderbird-0:102.10.0-2.el9_1.src as a component of Red Hat Enterprise Linux AppStream (v. 9)", product_id: "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.src", }, product_reference: "thunderbird-0:102.10.0-2.el9_1.src", relates_to_product_reference: "AppStream-9.1.0.Z.MAIN", }, { category: "default_component_of", full_product_name: { name: "thunderbird-0:102.10.0-2.el9_1.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)", product_id: "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.x86_64", }, product_reference: "thunderbird-0:102.10.0-2.el9_1.x86_64", relates_to_product_reference: "AppStream-9.1.0.Z.MAIN", }, { category: "default_component_of", full_product_name: { name: "thunderbird-debuginfo-0:102.10.0-2.el9_1.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)", product_id: "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.aarch64", }, product_reference: "thunderbird-debuginfo-0:102.10.0-2.el9_1.aarch64", relates_to_product_reference: "AppStream-9.1.0.Z.MAIN", }, { category: "default_component_of", full_product_name: { name: "thunderbird-debuginfo-0:102.10.0-2.el9_1.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)", product_id: "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.ppc64le", }, product_reference: "thunderbird-debuginfo-0:102.10.0-2.el9_1.ppc64le", relates_to_product_reference: "AppStream-9.1.0.Z.MAIN", }, { category: "default_component_of", full_product_name: { name: "thunderbird-debuginfo-0:102.10.0-2.el9_1.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)", product_id: "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.s390x", }, product_reference: "thunderbird-debuginfo-0:102.10.0-2.el9_1.s390x", relates_to_product_reference: "AppStream-9.1.0.Z.MAIN", }, { category: "default_component_of", full_product_name: { name: "thunderbird-debuginfo-0:102.10.0-2.el9_1.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)", product_id: "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.x86_64", }, product_reference: "thunderbird-debuginfo-0:102.10.0-2.el9_1.x86_64", relates_to_product_reference: "AppStream-9.1.0.Z.MAIN", }, { category: "default_component_of", full_product_name: { name: "thunderbird-debugsource-0:102.10.0-2.el9_1.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)", product_id: "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.aarch64", }, product_reference: "thunderbird-debugsource-0:102.10.0-2.el9_1.aarch64", relates_to_product_reference: "AppStream-9.1.0.Z.MAIN", }, { category: "default_component_of", full_product_name: { name: "thunderbird-debugsource-0:102.10.0-2.el9_1.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)", product_id: "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.ppc64le", }, product_reference: "thunderbird-debugsource-0:102.10.0-2.el9_1.ppc64le", relates_to_product_reference: "AppStream-9.1.0.Z.MAIN", }, { category: "default_component_of", full_product_name: { name: "thunderbird-debugsource-0:102.10.0-2.el9_1.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)", product_id: "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.s390x", }, product_reference: "thunderbird-debugsource-0:102.10.0-2.el9_1.s390x", relates_to_product_reference: "AppStream-9.1.0.Z.MAIN", }, { category: "default_component_of", full_product_name: { name: "thunderbird-debugsource-0:102.10.0-2.el9_1.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)", product_id: "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.x86_64", }, product_reference: "thunderbird-debugsource-0:102.10.0-2.el9_1.x86_64", relates_to_product_reference: "AppStream-9.1.0.Z.MAIN", }, ], }, vulnerabilities: [ { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Paul Menzel", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-0547", cwe: { id: "CWE-356", name: "Product UI does not Warn User of Unsafe Actions", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186734", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nOCSP revocation status of recipient certificates was not checked when sending S/Mime encrypted email, and revoked certificates would be accepted. Thunderbird versions from 68 to 102.9.1 were affected by this bug.", title: "Vulnerability description", }, { category: "summary", text: "Thunderbird: Revocation status of S/Mime recipient certificates was not checked", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.src", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-0547", }, { category: "external", summary: "RHBZ#2186734", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186734", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-0547", url: "https://www.cve.org/CVERecord?id=CVE-2023-0547", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-0547", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-0547", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-15/#CVE-2023-0547", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-15/#CVE-2023-0547", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T14:10:15+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.src", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1809", }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 7.5, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.src", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "Thunderbird: Revocation status of S/Mime recipient certificates was not checked", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Gabriele Svelto", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-1945", cwe: { id: "CWE-119", name: "Improper Restriction of Operations within the Bounds of a Memory Buffer", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186109", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nUnexpected data returned from the Safe Browsing API could have led to memory corruption and a potentially exploitable crash.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Memory Corruption in Safe Browsing Code", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.src", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-1945", }, { category: "external", summary: "RHBZ#2186109", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186109", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-1945", url: "https://www.cve.org/CVERecord?id=CVE-2023-1945", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-1945", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-1945", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-1945", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-1945", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T14:10:15+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.src", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1809", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "NONE", baseScore: 6.1, baseSeverity: "MEDIUM", confidentialityImpact: "LOW", integrityImpact: "LOW", privilegesRequired: "NONE", scope: "CHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", version: "3.1", }, products: [ "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.src", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "Mozilla: Memory Corruption in Safe Browsing Code", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Irvan Kurniawan", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-1999", cwe: { id: "CWE-415", name: "Double Free", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186102", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nA double-free in libwebp could have led to memory corruption and a potentially exploitable crash.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: libwebp: Double-free in libwebp", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.src", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-1999", }, { category: "external", summary: "RHBZ#2186102", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186102", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-1999", url: "https://www.cve.org/CVERecord?id=CVE-2023-1999", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-1999", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-1999", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-1999", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-1999", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-15/#CVE-2023-1999", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-15/#CVE-2023-1999", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T14:10:15+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.src", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1809", }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 7.5, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.src", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "Mozilla: libwebp: Double-free in libwebp", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Matrix Security Team", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-28427", cwe: { id: "CWE-1321", name: "Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')", }, discovery_date: "2023-03-28T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2183278", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nThunderbird users who use the Matrix chat protocol were vulnerable to a denial-of-service attack.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Matrix SDK bundled with Thunderbird vulnerable to denial-of-service attack", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.src", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-28427", }, { category: "external", summary: "RHBZ#2183278", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2183278", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-28427", url: "https://www.cve.org/CVERecord?id=CVE-2023-28427", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-28427", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-28427", }, { category: "external", summary: "https://github.com/matrix-org/matrix-js-sdk/security/advisories/GHSA-mwq8-fjpf-c2gr", url: "https://github.com/matrix-org/matrix-js-sdk/security/advisories/GHSA-mwq8-fjpf-c2gr", }, { category: "external", summary: "https://matrix.org/blog/2023/03/28/security-releases-matrix-js-sdk-24-0-0-and-matrix-react-sdk-3-69-0", url: "https://matrix.org/blog/2023/03/28/security-releases-matrix-js-sdk-24-0-0-and-matrix-react-sdk-3-69-0", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-12/#CVE-2023-28427", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-12/#CVE-2023-28427", }, ], release_date: "2023-03-28T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T14:10:15+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.src", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1809", }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 7.5, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.src", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "Mozilla: Matrix SDK bundled with Thunderbird vulnerable to denial-of-service attack", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Ribose RNP Team", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29479", cwe: { id: "CWE-400", name: "Uncontrolled Resource Consumption", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186735", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nCertain malformed OpenPGP messages could trigger incorrect parsing of PKESK/SKESK packets due to a bug in the Ribose RNP library used by Thunderbird up to version 102.9.1, which would cause the Thunderbird user interface to hang. The issue was discovered using Google's oss-fuzz.", title: "Vulnerability description", }, { category: "summary", text: "Thunderbird: Hang when processing certain OpenPGP messages", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.src", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29479", }, { category: "external", summary: "RHBZ#2186735", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186735", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29479", url: "https://www.cve.org/CVERecord?id=CVE-2023-29479", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29479", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29479", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-15/#CVE-2023-29479", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-15/#CVE-2023-29479", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T14:10:15+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.src", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1809", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 6.5, baseSeverity: "MEDIUM", confidentialityImpact: "NONE", integrityImpact: "NONE", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", version: "3.1", }, products: [ "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.src", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "Thunderbird: Hang when processing certain OpenPGP messages", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Irvan Kurniawan", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29533", cwe: { id: "CWE-425", name: "Direct Request ('Forced Browsing')", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186101", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nA website could have obscured the fullscreen notification by using a combination of `window.open`, fullscreen requests, `window.name` assignments, and `setInterval` calls. This could have led to user confusion and possible spoofing attacks.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Fullscreen notification obscured", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.src", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29533", }, { category: "external", summary: "RHBZ#2186101", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186101", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29533", url: "https://www.cve.org/CVERecord?id=CVE-2023-29533", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29533", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29533", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29533", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29533", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T14:10:15+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.src", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1809", }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 7.5, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.src", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "Mozilla: Fullscreen notification obscured", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Lukas Bernhard", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29535", cwe: { id: "CWE-119", name: "Improper Restriction of Operations within the Bounds of a Memory Buffer", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186103", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nFollowing a Garbage Collector compaction, weak maps may have been accessed before they were correctly traced. This resulted in memory corruption and a potentially exploitable crash.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Potential Memory Corruption following Garbage Collector compaction", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.src", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29535", }, { category: "external", summary: "RHBZ#2186103", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186103", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29535", url: "https://www.cve.org/CVERecord?id=CVE-2023-29535", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29535", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29535", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29535", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29535", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T14:10:15+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.src", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1809", }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 7.5, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.src", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "Mozilla: Potential Memory Corruption following Garbage Collector compaction", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "zx from qriousec", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29536", cwe: { id: "CWE-617", name: "Reachable Assertion", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186104", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nAn attacker could cause the memory manager to incorrectly free a pointer that addresses attacker-controlled memory, resulting in an assertion, memory corruption, or a potentially exploitable crash.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Invalid free from JavaScript code", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.src", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29536", }, { category: "external", summary: "RHBZ#2186104", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186104", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29536", url: "https://www.cve.org/CVERecord?id=CVE-2023-29536", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29536", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29536", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29536", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29536", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T14:10:15+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.src", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1809", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 8.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.src", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "Mozilla: Invalid free from JavaScript code", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Trung Pham", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29539", cwe: { id: "CWE-159", name: "Improper Handling of Invalid Use of Special Elements", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186105", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nWhen handling the filename directive in the Content-Disposition header, the filename would be truncated if the filename contained a NULL character. This could have led to reflected file download attacks potentially tricking users to install malware.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Content-Disposition filename truncation leads to Reflected File Download", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.src", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29539", }, { category: "external", summary: "RHBZ#2186105", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186105", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29539", url: "https://www.cve.org/CVERecord?id=CVE-2023-29539", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29539", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29539", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29539", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29539", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T14:10:15+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.src", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1809", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 8.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.src", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "Mozilla: Content-Disposition filename truncation leads to Reflected File Download", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Ameen Basha M K", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29541", cwe: { id: "CWE-434", name: "Unrestricted Upload of File with Dangerous Type", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186106", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nFirefox did not properly handle downloads of files ending in `.desktop`, which can be interpreted to run attacker-controlled commands.\r\n\r\n*This bug only affects Firefox for Linux on certain Distributions. Other operating systems are unaffected, and Mozilla is unable to enumerate all affected Linux Distributions.*", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Files with malicious extensions could have been downloaded unsafely on Linux", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.src", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29541", }, { category: "external", summary: "RHBZ#2186106", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186106", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29541", url: "https://www.cve.org/CVERecord?id=CVE-2023-29541", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29541", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29541", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29541", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29541", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T14:10:15+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.src", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1809", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 8.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.src", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "Mozilla: Files with malicious extensions could have been downloaded unsafely on Linux", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "JunYoung Park", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29548", cwe: { id: "CWE-682", name: "Incorrect Calculation", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186110", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nA wrong lowering instruction in the ARM64 Ion compiler resulted in a wrong optimization result.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Incorrect optimization result on ARM64", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.src", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29548", }, { category: "external", summary: "RHBZ#2186110", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186110", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29548", url: "https://www.cve.org/CVERecord?id=CVE-2023-29548", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29548", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29548", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29548", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29548", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T14:10:15+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.src", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1809", }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "NONE", baseScore: 3.4, baseSeverity: "LOW", confidentialityImpact: "NONE", integrityImpact: "LOW", privilegesRequired: "NONE", scope: "CHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:N", version: "3.1", }, products: [ "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.src", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.x86_64", ], }, ], threats: [ { category: "impact", details: "Low", }, ], title: "Mozilla: Incorrect optimization result on ARM64", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Mozilla developers and community", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29550", cwe: { id: "CWE-120", name: "Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186111", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nMozilla developers Andrew Osmond, Sebastian Hengst, Andrew McCreight, and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 111 and Firefox ESR 102.9. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Memory safety bugs fixed in Firefox 112 and Firefox ESR 102.10", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.src", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29550", }, { category: "external", summary: "RHBZ#2186111", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186111", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29550", url: "https://www.cve.org/CVERecord?id=CVE-2023-29550", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29550", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29550", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29550", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29550", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T14:10:15+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.src", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1809", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 8.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.src", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "Mozilla: Memory safety bugs fixed in Firefox 112 and Firefox ESR 102.10", }, ], }
rhsa-2023_1805
Vulnerability from csaf_redhat
Published
2023-04-17 14:03
Modified
2024-12-16 05:26
Summary
Red Hat Security Advisory: thunderbird security update
Notes
Topic
An update for thunderbird is now available for Red Hat Enterprise Linux 8.2 Advanced Update Support, Red Hat Enterprise Linux 8.2 Telecommunications Update Service, and Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Mozilla Thunderbird is a standalone mail and newsgroup client.
This update upgrades Thunderbird to version 102.10.0.
Security Fix(es):
* Thunderbird: Revocation status of S/Mime recipient certificates was not checked (CVE-2023-0547)
* Mozilla: Matrix SDK bundled with Thunderbird vulnerable to denial-of-service attack (CVE-2023-28427)
* Mozilla: Fullscreen notification obscured (CVE-2023-29533)
* Mozilla: Potential Memory Corruption following Garbage Collector compaction (CVE-2023-29535)
* Mozilla: Invalid free from JavaScript code (CVE-2023-29536)
* Mozilla: Memory safety bugs fixed in Firefox 112 and Firefox ESR 102.10 (CVE-2023-29550)
* Mozilla: Memory Corruption in Safe Browsing Code (CVE-2023-1945)
* Thunderbird: Hang when processing certain OpenPGP messages (CVE-2023-29479)
* Mozilla: Content-Disposition filename truncation leads to Reflected File Download (CVE-2023-29539)
* Mozilla: Files with malicious extensions could have been downloaded unsafely on Linux (CVE-2023-29541)
* Mozilla: Incorrect optimization result on ARM64 (CVE-2023-29548)
* MFSA-TMP-2023-0001 Mozilla: Double-free in libwebp (BZ#2186102)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ document: { aggregate_severity: { namespace: "https://access.redhat.com/security/updates/classification/", text: "Important", }, category: "csaf_security_advisory", csaf_version: "2.0", distribution: { text: "Copyright © Red Hat, Inc. All rights reserved.", tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "en", notes: [ { category: "summary", text: "An update for thunderbird is now available for Red Hat Enterprise Linux 8.2 Advanced Update Support, Red Hat Enterprise Linux 8.2 Telecommunications Update Service, and Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", title: "Topic", }, { category: "general", text: "Mozilla Thunderbird is a standalone mail and newsgroup client.\n\nThis update upgrades Thunderbird to version 102.10.0.\n\nSecurity Fix(es):\n\n* Thunderbird: Revocation status of S/Mime recipient certificates was not checked (CVE-2023-0547)\n\n* Mozilla: Matrix SDK bundled with Thunderbird vulnerable to denial-of-service attack (CVE-2023-28427)\n\n* Mozilla: Fullscreen notification obscured (CVE-2023-29533)\n\n* Mozilla: Potential Memory Corruption following Garbage Collector compaction (CVE-2023-29535)\n\n* Mozilla: Invalid free from JavaScript code (CVE-2023-29536)\n\n* Mozilla: Memory safety bugs fixed in Firefox 112 and Firefox ESR 102.10 (CVE-2023-29550)\n\n* Mozilla: Memory Corruption in Safe Browsing Code (CVE-2023-1945)\n\n* Thunderbird: Hang when processing certain OpenPGP messages (CVE-2023-29479)\n\n* Mozilla: Content-Disposition filename truncation leads to Reflected File Download (CVE-2023-29539)\n\n* Mozilla: Files with malicious extensions could have been downloaded unsafely on Linux (CVE-2023-29541)\n\n* Mozilla: Incorrect optimization result on ARM64 (CVE-2023-29548)\n\n* MFSA-TMP-2023-0001 Mozilla: Double-free in libwebp (BZ#2186102)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", title: "Details", }, { category: "legal_disclaimer", text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", title: "Terms of Use", }, ], publisher: { category: "vendor", contact_details: "https://access.redhat.com/security/team/contact/", issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", name: "Red Hat Product Security", namespace: "https://www.redhat.com", }, references: [ { category: "self", summary: "https://access.redhat.com/errata/RHSA-2023:1805", url: "https://access.redhat.com/errata/RHSA-2023:1805", }, { category: "external", summary: "https://access.redhat.com/security/updates/classification/#important", url: "https://access.redhat.com/security/updates/classification/#important", }, { category: "external", summary: "2183278", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2183278", }, { category: "external", summary: "2186101", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186101", }, { category: "external", summary: "2186102", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186102", }, { category: "external", summary: "2186103", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186103", }, { category: "external", summary: "2186104", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186104", }, { category: "external", summary: "2186105", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186105", }, { category: "external", summary: "2186106", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186106", }, { category: "external", summary: "2186109", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186109", }, { category: "external", summary: "2186110", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186110", }, { category: "external", summary: "2186111", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186111", }, { category: "external", summary: "2186734", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186734", }, { category: "external", summary: "2186735", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186735", }, { category: "self", summary: "Canonical URL", url: "https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_1805.json", }, ], title: "Red Hat Security Advisory: thunderbird security update", tracking: { current_release_date: "2024-12-16T05:26:37+00:00", generator: { date: "2024-12-16T05:26:37+00:00", engine: { name: "Red Hat SDEngine", version: "4.2.3", }, }, id: "RHSA-2023:1805", initial_release_date: "2023-04-17T14:03:17+00:00", revision_history: [ { date: "2023-04-17T14:03:17+00:00", number: "1", summary: "Initial version", }, { date: "2023-04-17T14:03:17+00:00", number: "2", summary: "Last updated version", }, { date: "2024-12-16T05:26:37+00:00", number: "3", summary: "Last generated version", }, ], status: "final", version: "3", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_name", name: "Red Hat Enterprise Linux AppStream AUS (v. 8.2)", product: { name: "Red Hat Enterprise Linux AppStream AUS (v. 8.2)", product_id: "AppStream-8.2.0.Z.AUS", product_identification_helper: { cpe: "cpe:/a:redhat:rhel_aus:8.2::appstream", }, }, }, { category: "product_name", name: "Red Hat Enterprise Linux AppStream E4S (v. 8.2)", product: { name: "Red Hat Enterprise Linux AppStream E4S (v. 8.2)", product_id: "AppStream-8.2.0.Z.E4S", product_identification_helper: { cpe: "cpe:/a:redhat:rhel_e4s:8.2::appstream", }, }, }, { category: "product_name", name: "Red Hat Enterprise Linux AppStream TUS (v. 8.2)", product: { name: "Red Hat Enterprise Linux AppStream TUS (v. 8.2)", product_id: "AppStream-8.2.0.Z.TUS", product_identification_helper: { cpe: "cpe:/a:redhat:rhel_tus:8.2::appstream", }, }, }, ], category: "product_family", name: "Red Hat Enterprise Linux", }, { branches: [ { category: "product_version", name: "thunderbird-0:102.10.0-2.el8_2.src", product: { name: "thunderbird-0:102.10.0-2.el8_2.src", product_id: "thunderbird-0:102.10.0-2.el8_2.src", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird@102.10.0-2.el8_2?arch=src", }, }, }, ], category: "architecture", name: "src", }, { branches: [ { category: "product_version", name: "thunderbird-0:102.10.0-2.el8_2.x86_64", product: { name: "thunderbird-0:102.10.0-2.el8_2.x86_64", product_id: "thunderbird-0:102.10.0-2.el8_2.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird@102.10.0-2.el8_2?arch=x86_64", }, }, }, { category: "product_version", name: "thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", product: { name: "thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", product_id: "thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird-debugsource@102.10.0-2.el8_2?arch=x86_64", }, }, }, { category: "product_version", name: "thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", product: { name: "thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", product_id: "thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird-debuginfo@102.10.0-2.el8_2?arch=x86_64", }, }, }, ], category: "architecture", name: "x86_64", }, { branches: [ { category: "product_version", name: "thunderbird-0:102.10.0-2.el8_2.ppc64le", product: { name: "thunderbird-0:102.10.0-2.el8_2.ppc64le", product_id: "thunderbird-0:102.10.0-2.el8_2.ppc64le", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird@102.10.0-2.el8_2?arch=ppc64le", }, }, }, { category: "product_version", name: "thunderbird-debugsource-0:102.10.0-2.el8_2.ppc64le", product: { name: "thunderbird-debugsource-0:102.10.0-2.el8_2.ppc64le", product_id: "thunderbird-debugsource-0:102.10.0-2.el8_2.ppc64le", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird-debugsource@102.10.0-2.el8_2?arch=ppc64le", }, }, }, { category: "product_version", name: "thunderbird-debuginfo-0:102.10.0-2.el8_2.ppc64le", product: { name: "thunderbird-debuginfo-0:102.10.0-2.el8_2.ppc64le", product_id: "thunderbird-debuginfo-0:102.10.0-2.el8_2.ppc64le", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird-debuginfo@102.10.0-2.el8_2?arch=ppc64le", }, }, }, ], category: "architecture", name: "ppc64le", }, ], category: "vendor", name: "Red Hat", }, ], relationships: [ { category: "default_component_of", full_product_name: { name: "thunderbird-0:102.10.0-2.el8_2.src as a component of Red Hat Enterprise Linux AppStream AUS (v. 8.2)", product_id: "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.src", }, product_reference: "thunderbird-0:102.10.0-2.el8_2.src", relates_to_product_reference: "AppStream-8.2.0.Z.AUS", }, { category: "default_component_of", full_product_name: { name: "thunderbird-0:102.10.0-2.el8_2.x86_64 as a component of Red Hat Enterprise Linux AppStream AUS (v. 8.2)", product_id: "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.x86_64", }, product_reference: "thunderbird-0:102.10.0-2.el8_2.x86_64", relates_to_product_reference: "AppStream-8.2.0.Z.AUS", }, { category: "default_component_of", full_product_name: { name: "thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64 as a component of Red Hat Enterprise Linux AppStream AUS (v. 8.2)", product_id: "AppStream-8.2.0.Z.AUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", }, product_reference: "thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", relates_to_product_reference: "AppStream-8.2.0.Z.AUS", }, { category: "default_component_of", full_product_name: { name: "thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64 as a component of Red Hat Enterprise Linux AppStream AUS (v. 8.2)", product_id: "AppStream-8.2.0.Z.AUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", }, product_reference: "thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", relates_to_product_reference: "AppStream-8.2.0.Z.AUS", }, { category: "default_component_of", full_product_name: { name: "thunderbird-0:102.10.0-2.el8_2.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v. 8.2)", product_id: "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.ppc64le", }, product_reference: "thunderbird-0:102.10.0-2.el8_2.ppc64le", relates_to_product_reference: "AppStream-8.2.0.Z.E4S", }, { category: "default_component_of", full_product_name: { name: "thunderbird-0:102.10.0-2.el8_2.src as a component of Red Hat Enterprise Linux AppStream E4S (v. 8.2)", product_id: "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.src", }, product_reference: "thunderbird-0:102.10.0-2.el8_2.src", relates_to_product_reference: "AppStream-8.2.0.Z.E4S", }, { category: "default_component_of", full_product_name: { name: "thunderbird-0:102.10.0-2.el8_2.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v. 8.2)", product_id: "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.x86_64", }, product_reference: "thunderbird-0:102.10.0-2.el8_2.x86_64", relates_to_product_reference: "AppStream-8.2.0.Z.E4S", }, { category: "default_component_of", full_product_name: { name: "thunderbird-debuginfo-0:102.10.0-2.el8_2.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v. 8.2)", product_id: "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.ppc64le", }, product_reference: "thunderbird-debuginfo-0:102.10.0-2.el8_2.ppc64le", relates_to_product_reference: "AppStream-8.2.0.Z.E4S", }, { category: "default_component_of", full_product_name: { name: "thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v. 8.2)", product_id: "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", }, product_reference: "thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", relates_to_product_reference: "AppStream-8.2.0.Z.E4S", }, { category: "default_component_of", full_product_name: { name: "thunderbird-debugsource-0:102.10.0-2.el8_2.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v. 8.2)", product_id: "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.ppc64le", }, product_reference: "thunderbird-debugsource-0:102.10.0-2.el8_2.ppc64le", relates_to_product_reference: "AppStream-8.2.0.Z.E4S", }, { category: "default_component_of", full_product_name: { name: "thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v. 8.2)", product_id: "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", }, product_reference: "thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", relates_to_product_reference: "AppStream-8.2.0.Z.E4S", }, { category: "default_component_of", full_product_name: { name: "thunderbird-0:102.10.0-2.el8_2.src as a component of Red Hat Enterprise Linux AppStream TUS (v. 8.2)", product_id: "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.src", }, product_reference: "thunderbird-0:102.10.0-2.el8_2.src", relates_to_product_reference: "AppStream-8.2.0.Z.TUS", }, { category: "default_component_of", full_product_name: { name: "thunderbird-0:102.10.0-2.el8_2.x86_64 as a component of Red Hat Enterprise Linux AppStream TUS (v. 8.2)", product_id: "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.x86_64", }, product_reference: "thunderbird-0:102.10.0-2.el8_2.x86_64", relates_to_product_reference: "AppStream-8.2.0.Z.TUS", }, { category: "default_component_of", full_product_name: { name: "thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64 as a component of Red Hat Enterprise Linux AppStream TUS (v. 8.2)", product_id: "AppStream-8.2.0.Z.TUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", }, product_reference: "thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", relates_to_product_reference: "AppStream-8.2.0.Z.TUS", }, { category: "default_component_of", full_product_name: { name: "thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64 as a component of Red Hat Enterprise Linux AppStream TUS (v. 8.2)", product_id: "AppStream-8.2.0.Z.TUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", }, product_reference: "thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", relates_to_product_reference: "AppStream-8.2.0.Z.TUS", }, ], }, vulnerabilities: [ { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Paul Menzel", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-0547", cwe: { id: "CWE-356", name: "Product UI does not Warn User of Unsafe Actions", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186734", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nOCSP revocation status of recipient certificates was not checked when sending S/Mime encrypted email, and revoked certificates would be accepted. Thunderbird versions from 68 to 102.9.1 were affected by this bug.", title: "Vulnerability description", }, { category: "summary", text: "Thunderbird: Revocation status of S/Mime recipient certificates was not checked", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-0547", }, { category: "external", summary: "RHBZ#2186734", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186734", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-0547", url: "https://www.cve.org/CVERecord?id=CVE-2023-0547", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-0547", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-0547", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-15/#CVE-2023-0547", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-15/#CVE-2023-0547", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T14:03:17+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1805", }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 7.5, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "Thunderbird: Revocation status of S/Mime recipient certificates was not checked", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Gabriele Svelto", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-1945", cwe: { id: "CWE-119", name: "Improper Restriction of Operations within the Bounds of a Memory Buffer", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186109", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nUnexpected data returned from the Safe Browsing API could have led to memory corruption and a potentially exploitable crash.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Memory Corruption in Safe Browsing Code", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-1945", }, { category: "external", summary: "RHBZ#2186109", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186109", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-1945", url: "https://www.cve.org/CVERecord?id=CVE-2023-1945", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-1945", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-1945", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-1945", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-1945", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T14:03:17+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1805", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "NONE", baseScore: 6.1, baseSeverity: "MEDIUM", confidentialityImpact: "LOW", integrityImpact: "LOW", privilegesRequired: "NONE", scope: "CHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", version: "3.1", }, products: [ "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "Mozilla: Memory Corruption in Safe Browsing Code", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Irvan Kurniawan", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-1999", cwe: { id: "CWE-415", name: "Double Free", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186102", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nA double-free in libwebp could have led to memory corruption and a potentially exploitable crash.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: libwebp: Double-free in libwebp", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-1999", }, { category: "external", summary: "RHBZ#2186102", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186102", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-1999", url: "https://www.cve.org/CVERecord?id=CVE-2023-1999", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-1999", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-1999", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-1999", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-1999", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-15/#CVE-2023-1999", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-15/#CVE-2023-1999", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T14:03:17+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1805", }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 7.5, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "Mozilla: libwebp: Double-free in libwebp", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Matrix Security Team", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-28427", cwe: { id: "CWE-1321", name: "Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')", }, discovery_date: "2023-03-28T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2183278", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nThunderbird users who use the Matrix chat protocol were vulnerable to a denial-of-service attack.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Matrix SDK bundled with Thunderbird vulnerable to denial-of-service attack", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-28427", }, { category: "external", summary: "RHBZ#2183278", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2183278", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-28427", url: "https://www.cve.org/CVERecord?id=CVE-2023-28427", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-28427", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-28427", }, { category: "external", summary: "https://github.com/matrix-org/matrix-js-sdk/security/advisories/GHSA-mwq8-fjpf-c2gr", url: "https://github.com/matrix-org/matrix-js-sdk/security/advisories/GHSA-mwq8-fjpf-c2gr", }, { category: "external", summary: "https://matrix.org/blog/2023/03/28/security-releases-matrix-js-sdk-24-0-0-and-matrix-react-sdk-3-69-0", url: "https://matrix.org/blog/2023/03/28/security-releases-matrix-js-sdk-24-0-0-and-matrix-react-sdk-3-69-0", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-12/#CVE-2023-28427", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-12/#CVE-2023-28427", }, ], release_date: "2023-03-28T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T14:03:17+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1805", }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 7.5, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "Mozilla: Matrix SDK bundled with Thunderbird vulnerable to denial-of-service attack", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Ribose RNP Team", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29479", cwe: { id: "CWE-400", name: "Uncontrolled Resource Consumption", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186735", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nCertain malformed OpenPGP messages could trigger incorrect parsing of PKESK/SKESK packets due to a bug in the Ribose RNP library used by Thunderbird up to version 102.9.1, which would cause the Thunderbird user interface to hang. The issue was discovered using Google's oss-fuzz.", title: "Vulnerability description", }, { category: "summary", text: "Thunderbird: Hang when processing certain OpenPGP messages", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29479", }, { category: "external", summary: "RHBZ#2186735", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186735", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29479", url: "https://www.cve.org/CVERecord?id=CVE-2023-29479", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29479", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29479", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-15/#CVE-2023-29479", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-15/#CVE-2023-29479", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T14:03:17+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1805", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 6.5, baseSeverity: "MEDIUM", confidentialityImpact: "NONE", integrityImpact: "NONE", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", version: "3.1", }, products: [ "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "Thunderbird: Hang when processing certain OpenPGP messages", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Irvan Kurniawan", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29533", cwe: { id: "CWE-425", name: "Direct Request ('Forced Browsing')", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186101", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nA website could have obscured the fullscreen notification by using a combination of `window.open`, fullscreen requests, `window.name` assignments, and `setInterval` calls. This could have led to user confusion and possible spoofing attacks.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Fullscreen notification obscured", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29533", }, { category: "external", summary: "RHBZ#2186101", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186101", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29533", url: "https://www.cve.org/CVERecord?id=CVE-2023-29533", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29533", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29533", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29533", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29533", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T14:03:17+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1805", }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 7.5, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "Mozilla: Fullscreen notification obscured", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Lukas Bernhard", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29535", cwe: { id: "CWE-119", name: "Improper Restriction of Operations within the Bounds of a Memory Buffer", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186103", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nFollowing a Garbage Collector compaction, weak maps may have been accessed before they were correctly traced. This resulted in memory corruption and a potentially exploitable crash.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Potential Memory Corruption following Garbage Collector compaction", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29535", }, { category: "external", summary: "RHBZ#2186103", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186103", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29535", url: "https://www.cve.org/CVERecord?id=CVE-2023-29535", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29535", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29535", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29535", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29535", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T14:03:17+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1805", }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 7.5, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "Mozilla: Potential Memory Corruption following Garbage Collector compaction", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "zx from qriousec", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29536", cwe: { id: "CWE-617", name: "Reachable Assertion", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186104", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nAn attacker could cause the memory manager to incorrectly free a pointer that addresses attacker-controlled memory, resulting in an assertion, memory corruption, or a potentially exploitable crash.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Invalid free from JavaScript code", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29536", }, { category: "external", summary: "RHBZ#2186104", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186104", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29536", url: "https://www.cve.org/CVERecord?id=CVE-2023-29536", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29536", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29536", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29536", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29536", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T14:03:17+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1805", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 8.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "Mozilla: Invalid free from JavaScript code", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Trung Pham", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29539", cwe: { id: "CWE-159", name: "Improper Handling of Invalid Use of Special Elements", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186105", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nWhen handling the filename directive in the Content-Disposition header, the filename would be truncated if the filename contained a NULL character. This could have led to reflected file download attacks potentially tricking users to install malware.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Content-Disposition filename truncation leads to Reflected File Download", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29539", }, { category: "external", summary: "RHBZ#2186105", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186105", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29539", url: "https://www.cve.org/CVERecord?id=CVE-2023-29539", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29539", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29539", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29539", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29539", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T14:03:17+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1805", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 8.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "Mozilla: Content-Disposition filename truncation leads to Reflected File Download", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Ameen Basha M K", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29541", cwe: { id: "CWE-434", name: "Unrestricted Upload of File with Dangerous Type", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186106", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nFirefox did not properly handle downloads of files ending in `.desktop`, which can be interpreted to run attacker-controlled commands.\r\n\r\n*This bug only affects Firefox for Linux on certain Distributions. Other operating systems are unaffected, and Mozilla is unable to enumerate all affected Linux Distributions.*", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Files with malicious extensions could have been downloaded unsafely on Linux", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29541", }, { category: "external", summary: "RHBZ#2186106", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186106", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29541", url: "https://www.cve.org/CVERecord?id=CVE-2023-29541", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29541", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29541", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29541", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29541", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T14:03:17+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1805", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 8.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "Mozilla: Files with malicious extensions could have been downloaded unsafely on Linux", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "JunYoung Park", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29548", cwe: { id: "CWE-682", name: "Incorrect Calculation", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186110", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nA wrong lowering instruction in the ARM64 Ion compiler resulted in a wrong optimization result.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Incorrect optimization result on ARM64", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29548", }, { category: "external", summary: "RHBZ#2186110", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186110", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29548", url: "https://www.cve.org/CVERecord?id=CVE-2023-29548", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29548", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29548", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29548", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29548", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T14:03:17+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1805", }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "NONE", baseScore: 3.4, baseSeverity: "LOW", confidentialityImpact: "NONE", integrityImpact: "LOW", privilegesRequired: "NONE", scope: "CHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:N", version: "3.1", }, products: [ "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", ], }, ], threats: [ { category: "impact", details: "Low", }, ], title: "Mozilla: Incorrect optimization result on ARM64", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Mozilla developers and community", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29550", cwe: { id: "CWE-120", name: "Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186111", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nMozilla developers Andrew Osmond, Sebastian Hengst, Andrew McCreight, and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 111 and Firefox ESR 102.9. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Memory safety bugs fixed in Firefox 112 and Firefox ESR 102.10", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29550", }, { category: "external", summary: "RHBZ#2186111", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186111", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29550", url: "https://www.cve.org/CVERecord?id=CVE-2023-29550", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29550", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29550", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29550", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29550", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T14:03:17+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1805", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 8.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "Mozilla: Memory safety bugs fixed in Firefox 112 and Firefox ESR 102.10", }, ], }
RHSA-2023:1811
Vulnerability from csaf_redhat
Published
2023-04-17 14:15
Modified
2024-12-16 05:26
Summary
Red Hat Security Advisory: thunderbird security update
Notes
Topic
An update for thunderbird is now available for Red Hat Enterprise Linux 8.6 Extended Update Support.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Mozilla Thunderbird is a standalone mail and newsgroup client.
This update upgrades Thunderbird to version 102.10.0.
Security Fix(es):
* Thunderbird: Revocation status of S/Mime recipient certificates was not checked (CVE-2023-0547)
* Mozilla: Matrix SDK bundled with Thunderbird vulnerable to denial-of-service attack (CVE-2023-28427)
* Mozilla: Fullscreen notification obscured (CVE-2023-29533)
* Mozilla: Potential Memory Corruption following Garbage Collector compaction (CVE-2023-29535)
* Mozilla: Invalid free from JavaScript code (CVE-2023-29536)
* Mozilla: Memory safety bugs fixed in Firefox 112 and Firefox ESR 102.10 (CVE-2023-29550)
* Mozilla: Memory Corruption in Safe Browsing Code (CVE-2023-1945)
* Thunderbird: Hang when processing certain OpenPGP messages (CVE-2023-29479)
* Mozilla: Content-Disposition filename truncation leads to Reflected File Download (CVE-2023-29539)
* Mozilla: Files with malicious extensions could have been downloaded unsafely on Linux (CVE-2023-29541)
* Mozilla: Incorrect optimization result on ARM64 (CVE-2023-29548)
* MFSA-TMP-2023-0001 Mozilla: Double-free in libwebp (BZ#2186102)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ document: { aggregate_severity: { namespace: "https://access.redhat.com/security/updates/classification/", text: "Important", }, category: "csaf_security_advisory", csaf_version: "2.0", distribution: { text: "Copyright © Red Hat, Inc. All rights reserved.", tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "en", notes: [ { category: "summary", text: "An update for thunderbird is now available for Red Hat Enterprise Linux 8.6 Extended Update Support.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", title: "Topic", }, { category: "general", text: "Mozilla Thunderbird is a standalone mail and newsgroup client.\n\nThis update upgrades Thunderbird to version 102.10.0.\n\nSecurity Fix(es):\n\n* Thunderbird: Revocation status of S/Mime recipient certificates was not checked (CVE-2023-0547)\n\n* Mozilla: Matrix SDK bundled with Thunderbird vulnerable to denial-of-service attack (CVE-2023-28427)\n\n* Mozilla: Fullscreen notification obscured (CVE-2023-29533)\n\n* Mozilla: Potential Memory Corruption following Garbage Collector compaction (CVE-2023-29535)\n\n* Mozilla: Invalid free from JavaScript code (CVE-2023-29536)\n\n* Mozilla: Memory safety bugs fixed in Firefox 112 and Firefox ESR 102.10 (CVE-2023-29550)\n\n* Mozilla: Memory Corruption in Safe Browsing Code (CVE-2023-1945)\n\n* Thunderbird: Hang when processing certain OpenPGP messages (CVE-2023-29479)\n\n* Mozilla: Content-Disposition filename truncation leads to Reflected File Download (CVE-2023-29539)\n\n* Mozilla: Files with malicious extensions could have been downloaded unsafely on Linux (CVE-2023-29541)\n\n* Mozilla: Incorrect optimization result on ARM64 (CVE-2023-29548)\n\n* MFSA-TMP-2023-0001 Mozilla: Double-free in libwebp (BZ#2186102)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", title: "Details", }, { category: "legal_disclaimer", text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", title: "Terms of Use", }, ], publisher: { category: "vendor", contact_details: "https://access.redhat.com/security/team/contact/", issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", name: "Red Hat Product Security", namespace: "https://www.redhat.com", }, references: [ { category: "self", summary: "https://access.redhat.com/errata/RHSA-2023:1811", url: "https://access.redhat.com/errata/RHSA-2023:1811", }, { category: "external", summary: "https://access.redhat.com/security/updates/classification/#important", url: "https://access.redhat.com/security/updates/classification/#important", }, { category: "external", summary: "2183278", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2183278", }, { category: "external", summary: "2186101", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186101", }, { category: "external", summary: "2186102", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186102", }, { category: "external", summary: "2186103", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186103", }, { category: "external", summary: "2186104", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186104", }, { category: "external", summary: "2186105", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186105", }, { category: "external", summary: "2186106", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186106", }, { category: "external", summary: "2186109", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186109", }, { category: "external", summary: "2186110", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186110", }, { category: "external", summary: "2186111", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186111", }, { category: "external", summary: "2186734", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186734", }, { category: "external", summary: "2186735", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186735", }, { category: "self", summary: "Canonical URL", url: "https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_1811.json", }, ], title: "Red Hat Security Advisory: thunderbird security update", tracking: { current_release_date: "2024-12-16T05:26:55+00:00", generator: { date: "2024-12-16T05:26:55+00:00", engine: { name: "Red Hat SDEngine", version: "4.2.3", }, }, id: "RHSA-2023:1811", initial_release_date: "2023-04-17T14:15:32+00:00", revision_history: [ { date: "2023-04-17T14:15:32+00:00", number: "1", summary: "Initial version", }, { date: "2023-04-17T14:15:32+00:00", number: "2", summary: "Last updated version", }, { date: "2024-12-16T05:26:55+00:00", number: "3", summary: "Last generated version", }, ], status: "final", version: "3", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_name", name: "Red Hat Enterprise Linux AppStream EUS (v.8.6)", product: { name: "Red Hat Enterprise Linux AppStream EUS (v.8.6)", product_id: "AppStream-8.6.0.Z.EUS", product_identification_helper: { cpe: "cpe:/a:redhat:rhel_eus:8.6::appstream", }, }, }, ], category: "product_family", name: "Red Hat Enterprise Linux", }, { branches: [ { category: "product_version", name: "thunderbird-0:102.10.0-2.el8_6.src", product: { name: "thunderbird-0:102.10.0-2.el8_6.src", product_id: "thunderbird-0:102.10.0-2.el8_6.src", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird@102.10.0-2.el8_6?arch=src", }, }, }, ], category: "architecture", name: "src", }, { branches: [ { category: "product_version", name: "thunderbird-0:102.10.0-2.el8_6.aarch64", product: { name: "thunderbird-0:102.10.0-2.el8_6.aarch64", product_id: "thunderbird-0:102.10.0-2.el8_6.aarch64", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird@102.10.0-2.el8_6?arch=aarch64", }, }, }, { category: "product_version", name: "thunderbird-debugsource-0:102.10.0-2.el8_6.aarch64", product: { name: "thunderbird-debugsource-0:102.10.0-2.el8_6.aarch64", product_id: "thunderbird-debugsource-0:102.10.0-2.el8_6.aarch64", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird-debugsource@102.10.0-2.el8_6?arch=aarch64", }, }, }, { category: "product_version", name: "thunderbird-debuginfo-0:102.10.0-2.el8_6.aarch64", product: { name: "thunderbird-debuginfo-0:102.10.0-2.el8_6.aarch64", product_id: "thunderbird-debuginfo-0:102.10.0-2.el8_6.aarch64", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird-debuginfo@102.10.0-2.el8_6?arch=aarch64", }, }, }, ], category: "architecture", name: "aarch64", }, { branches: [ { category: "product_version", name: "thunderbird-0:102.10.0-2.el8_6.ppc64le", product: { name: "thunderbird-0:102.10.0-2.el8_6.ppc64le", product_id: "thunderbird-0:102.10.0-2.el8_6.ppc64le", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird@102.10.0-2.el8_6?arch=ppc64le", }, }, }, { category: "product_version", name: "thunderbird-debugsource-0:102.10.0-2.el8_6.ppc64le", product: { name: "thunderbird-debugsource-0:102.10.0-2.el8_6.ppc64le", product_id: "thunderbird-debugsource-0:102.10.0-2.el8_6.ppc64le", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird-debugsource@102.10.0-2.el8_6?arch=ppc64le", }, }, }, { category: "product_version", name: "thunderbird-debuginfo-0:102.10.0-2.el8_6.ppc64le", product: { name: "thunderbird-debuginfo-0:102.10.0-2.el8_6.ppc64le", product_id: "thunderbird-debuginfo-0:102.10.0-2.el8_6.ppc64le", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird-debuginfo@102.10.0-2.el8_6?arch=ppc64le", }, }, }, ], category: "architecture", name: "ppc64le", }, { branches: [ { category: "product_version", name: "thunderbird-0:102.10.0-2.el8_6.x86_64", product: { name: "thunderbird-0:102.10.0-2.el8_6.x86_64", product_id: "thunderbird-0:102.10.0-2.el8_6.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird@102.10.0-2.el8_6?arch=x86_64", }, }, }, { category: "product_version", name: "thunderbird-debugsource-0:102.10.0-2.el8_6.x86_64", product: { name: "thunderbird-debugsource-0:102.10.0-2.el8_6.x86_64", product_id: "thunderbird-debugsource-0:102.10.0-2.el8_6.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird-debugsource@102.10.0-2.el8_6?arch=x86_64", }, }, }, { category: "product_version", name: "thunderbird-debuginfo-0:102.10.0-2.el8_6.x86_64", product: { name: "thunderbird-debuginfo-0:102.10.0-2.el8_6.x86_64", product_id: "thunderbird-debuginfo-0:102.10.0-2.el8_6.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird-debuginfo@102.10.0-2.el8_6?arch=x86_64", }, }, }, ], category: "architecture", name: "x86_64", }, { branches: [ { category: "product_version", name: "thunderbird-0:102.10.0-2.el8_6.s390x", product: { name: "thunderbird-0:102.10.0-2.el8_6.s390x", product_id: "thunderbird-0:102.10.0-2.el8_6.s390x", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird@102.10.0-2.el8_6?arch=s390x", }, }, }, { category: "product_version", name: "thunderbird-debugsource-0:102.10.0-2.el8_6.s390x", product: { name: "thunderbird-debugsource-0:102.10.0-2.el8_6.s390x", product_id: "thunderbird-debugsource-0:102.10.0-2.el8_6.s390x", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird-debugsource@102.10.0-2.el8_6?arch=s390x", }, }, }, { category: "product_version", name: "thunderbird-debuginfo-0:102.10.0-2.el8_6.s390x", product: { name: "thunderbird-debuginfo-0:102.10.0-2.el8_6.s390x", product_id: "thunderbird-debuginfo-0:102.10.0-2.el8_6.s390x", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird-debuginfo@102.10.0-2.el8_6?arch=s390x", }, }, }, ], category: "architecture", name: "s390x", }, ], category: "vendor", name: "Red Hat", }, ], relationships: [ { category: "default_component_of", full_product_name: { name: "thunderbird-0:102.10.0-2.el8_6.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", product_id: "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.aarch64", }, product_reference: "thunderbird-0:102.10.0-2.el8_6.aarch64", relates_to_product_reference: "AppStream-8.6.0.Z.EUS", }, { category: "default_component_of", full_product_name: { name: "thunderbird-0:102.10.0-2.el8_6.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", product_id: "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.ppc64le", }, product_reference: "thunderbird-0:102.10.0-2.el8_6.ppc64le", relates_to_product_reference: "AppStream-8.6.0.Z.EUS", }, { category: "default_component_of", full_product_name: { name: "thunderbird-0:102.10.0-2.el8_6.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", product_id: "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.s390x", }, product_reference: "thunderbird-0:102.10.0-2.el8_6.s390x", relates_to_product_reference: "AppStream-8.6.0.Z.EUS", }, { category: "default_component_of", full_product_name: { name: "thunderbird-0:102.10.0-2.el8_6.src as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", product_id: "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.src", }, product_reference: "thunderbird-0:102.10.0-2.el8_6.src", relates_to_product_reference: "AppStream-8.6.0.Z.EUS", }, { category: "default_component_of", full_product_name: { name: "thunderbird-0:102.10.0-2.el8_6.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", product_id: "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.x86_64", }, product_reference: "thunderbird-0:102.10.0-2.el8_6.x86_64", relates_to_product_reference: "AppStream-8.6.0.Z.EUS", }, { category: "default_component_of", full_product_name: { name: "thunderbird-debuginfo-0:102.10.0-2.el8_6.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", product_id: "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.aarch64", }, product_reference: "thunderbird-debuginfo-0:102.10.0-2.el8_6.aarch64", relates_to_product_reference: "AppStream-8.6.0.Z.EUS", }, { category: "default_component_of", full_product_name: { name: "thunderbird-debuginfo-0:102.10.0-2.el8_6.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", product_id: "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.ppc64le", }, product_reference: "thunderbird-debuginfo-0:102.10.0-2.el8_6.ppc64le", relates_to_product_reference: "AppStream-8.6.0.Z.EUS", }, { category: "default_component_of", full_product_name: { name: "thunderbird-debuginfo-0:102.10.0-2.el8_6.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", product_id: "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.s390x", }, product_reference: "thunderbird-debuginfo-0:102.10.0-2.el8_6.s390x", relates_to_product_reference: "AppStream-8.6.0.Z.EUS", }, { category: "default_component_of", full_product_name: { name: "thunderbird-debuginfo-0:102.10.0-2.el8_6.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", product_id: "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.x86_64", }, product_reference: "thunderbird-debuginfo-0:102.10.0-2.el8_6.x86_64", relates_to_product_reference: "AppStream-8.6.0.Z.EUS", }, { category: "default_component_of", full_product_name: { name: "thunderbird-debugsource-0:102.10.0-2.el8_6.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", product_id: "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.aarch64", }, product_reference: "thunderbird-debugsource-0:102.10.0-2.el8_6.aarch64", relates_to_product_reference: "AppStream-8.6.0.Z.EUS", }, { category: "default_component_of", full_product_name: { name: "thunderbird-debugsource-0:102.10.0-2.el8_6.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", product_id: "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.ppc64le", }, product_reference: "thunderbird-debugsource-0:102.10.0-2.el8_6.ppc64le", relates_to_product_reference: "AppStream-8.6.0.Z.EUS", }, { category: "default_component_of", full_product_name: { name: "thunderbird-debugsource-0:102.10.0-2.el8_6.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", product_id: "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.s390x", }, product_reference: "thunderbird-debugsource-0:102.10.0-2.el8_6.s390x", relates_to_product_reference: "AppStream-8.6.0.Z.EUS", }, { category: "default_component_of", full_product_name: { name: "thunderbird-debugsource-0:102.10.0-2.el8_6.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", product_id: "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.x86_64", }, product_reference: "thunderbird-debugsource-0:102.10.0-2.el8_6.x86_64", relates_to_product_reference: "AppStream-8.6.0.Z.EUS", }, ], }, vulnerabilities: [ { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Paul Menzel", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-0547", cwe: { id: "CWE-356", name: "Product UI does not Warn User of Unsafe Actions", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186734", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nOCSP revocation status of recipient certificates was not checked when sending S/Mime encrypted email, and revoked certificates would be accepted. Thunderbird versions from 68 to 102.9.1 were affected by this bug.", title: "Vulnerability description", }, { category: "summary", text: "Thunderbird: Revocation status of S/Mime recipient certificates was not checked", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.src", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-0547", }, { category: "external", summary: "RHBZ#2186734", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186734", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-0547", url: "https://www.cve.org/CVERecord?id=CVE-2023-0547", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-0547", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-0547", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-15/#CVE-2023-0547", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-15/#CVE-2023-0547", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T14:15:32+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.src", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1811", }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 7.5, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.src", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "Thunderbird: Revocation status of S/Mime recipient certificates was not checked", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Gabriele Svelto", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-1945", cwe: { id: "CWE-119", name: "Improper Restriction of Operations within the Bounds of a Memory Buffer", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186109", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nUnexpected data returned from the Safe Browsing API could have led to memory corruption and a potentially exploitable crash.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Memory Corruption in Safe Browsing Code", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.src", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-1945", }, { category: "external", summary: "RHBZ#2186109", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186109", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-1945", url: "https://www.cve.org/CVERecord?id=CVE-2023-1945", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-1945", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-1945", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-1945", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-1945", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T14:15:32+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.src", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1811", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "NONE", baseScore: 6.1, baseSeverity: "MEDIUM", confidentialityImpact: "LOW", integrityImpact: "LOW", privilegesRequired: "NONE", scope: "CHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", version: "3.1", }, products: [ "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.src", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "Mozilla: Memory Corruption in Safe Browsing Code", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Irvan Kurniawan", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-1999", cwe: { id: "CWE-415", name: "Double Free", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186102", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nA double-free in libwebp could have led to memory corruption and a potentially exploitable crash.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: libwebp: Double-free in libwebp", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.src", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-1999", }, { category: "external", summary: "RHBZ#2186102", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186102", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-1999", url: "https://www.cve.org/CVERecord?id=CVE-2023-1999", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-1999", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-1999", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-1999", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-1999", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-15/#CVE-2023-1999", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-15/#CVE-2023-1999", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T14:15:32+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.src", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1811", }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 7.5, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.src", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "Mozilla: libwebp: Double-free in libwebp", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Matrix Security Team", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-28427", cwe: { id: "CWE-1321", name: "Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')", }, discovery_date: "2023-03-28T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2183278", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nThunderbird users who use the Matrix chat protocol were vulnerable to a denial-of-service attack.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Matrix SDK bundled with Thunderbird vulnerable to denial-of-service attack", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.src", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-28427", }, { category: "external", summary: "RHBZ#2183278", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2183278", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-28427", url: "https://www.cve.org/CVERecord?id=CVE-2023-28427", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-28427", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-28427", }, { category: "external", summary: "https://github.com/matrix-org/matrix-js-sdk/security/advisories/GHSA-mwq8-fjpf-c2gr", url: "https://github.com/matrix-org/matrix-js-sdk/security/advisories/GHSA-mwq8-fjpf-c2gr", }, { category: "external", summary: "https://matrix.org/blog/2023/03/28/security-releases-matrix-js-sdk-24-0-0-and-matrix-react-sdk-3-69-0", url: "https://matrix.org/blog/2023/03/28/security-releases-matrix-js-sdk-24-0-0-and-matrix-react-sdk-3-69-0", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-12/#CVE-2023-28427", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-12/#CVE-2023-28427", }, ], release_date: "2023-03-28T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T14:15:32+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.src", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1811", }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 7.5, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.src", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "Mozilla: Matrix SDK bundled with Thunderbird vulnerable to denial-of-service attack", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Ribose RNP Team", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29479", cwe: { id: "CWE-400", name: "Uncontrolled Resource Consumption", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186735", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nCertain malformed OpenPGP messages could trigger incorrect parsing of PKESK/SKESK packets due to a bug in the Ribose RNP library used by Thunderbird up to version 102.9.1, which would cause the Thunderbird user interface to hang. The issue was discovered using Google's oss-fuzz.", title: "Vulnerability description", }, { category: "summary", text: "Thunderbird: Hang when processing certain OpenPGP messages", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.src", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29479", }, { category: "external", summary: "RHBZ#2186735", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186735", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29479", url: "https://www.cve.org/CVERecord?id=CVE-2023-29479", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29479", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29479", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-15/#CVE-2023-29479", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-15/#CVE-2023-29479", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T14:15:32+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.src", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1811", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 6.5, baseSeverity: "MEDIUM", confidentialityImpact: "NONE", integrityImpact: "NONE", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", version: "3.1", }, products: [ "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.src", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "Thunderbird: Hang when processing certain OpenPGP messages", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Irvan Kurniawan", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29533", cwe: { id: "CWE-425", name: "Direct Request ('Forced Browsing')", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186101", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nA website could have obscured the fullscreen notification by using a combination of `window.open`, fullscreen requests, `window.name` assignments, and `setInterval` calls. This could have led to user confusion and possible spoofing attacks.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Fullscreen notification obscured", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.src", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29533", }, { category: "external", summary: "RHBZ#2186101", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186101", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29533", url: "https://www.cve.org/CVERecord?id=CVE-2023-29533", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29533", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29533", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29533", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29533", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T14:15:32+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.src", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1811", }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 7.5, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.src", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "Mozilla: Fullscreen notification obscured", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Lukas Bernhard", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29535", cwe: { id: "CWE-119", name: "Improper Restriction of Operations within the Bounds of a Memory Buffer", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186103", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nFollowing a Garbage Collector compaction, weak maps may have been accessed before they were correctly traced. This resulted in memory corruption and a potentially exploitable crash.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Potential Memory Corruption following Garbage Collector compaction", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.src", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29535", }, { category: "external", summary: "RHBZ#2186103", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186103", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29535", url: "https://www.cve.org/CVERecord?id=CVE-2023-29535", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29535", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29535", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29535", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29535", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T14:15:32+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.src", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1811", }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 7.5, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.src", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "Mozilla: Potential Memory Corruption following Garbage Collector compaction", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "zx from qriousec", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29536", cwe: { id: "CWE-617", name: "Reachable Assertion", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186104", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nAn attacker could cause the memory manager to incorrectly free a pointer that addresses attacker-controlled memory, resulting in an assertion, memory corruption, or a potentially exploitable crash.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Invalid free from JavaScript code", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.src", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29536", }, { category: "external", summary: "RHBZ#2186104", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186104", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29536", url: "https://www.cve.org/CVERecord?id=CVE-2023-29536", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29536", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29536", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29536", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29536", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T14:15:32+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.src", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1811", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 8.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.src", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "Mozilla: Invalid free from JavaScript code", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Trung Pham", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29539", cwe: { id: "CWE-159", name: "Improper Handling of Invalid Use of Special Elements", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186105", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nWhen handling the filename directive in the Content-Disposition header, the filename would be truncated if the filename contained a NULL character. This could have led to reflected file download attacks potentially tricking users to install malware.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Content-Disposition filename truncation leads to Reflected File Download", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.src", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29539", }, { category: "external", summary: "RHBZ#2186105", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186105", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29539", url: "https://www.cve.org/CVERecord?id=CVE-2023-29539", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29539", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29539", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29539", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29539", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T14:15:32+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.src", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1811", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 8.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.src", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "Mozilla: Content-Disposition filename truncation leads to Reflected File Download", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Ameen Basha M K", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29541", cwe: { id: "CWE-434", name: "Unrestricted Upload of File with Dangerous Type", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186106", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nFirefox did not properly handle downloads of files ending in `.desktop`, which can be interpreted to run attacker-controlled commands.\r\n\r\n*This bug only affects Firefox for Linux on certain Distributions. Other operating systems are unaffected, and Mozilla is unable to enumerate all affected Linux Distributions.*", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Files with malicious extensions could have been downloaded unsafely on Linux", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.src", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29541", }, { category: "external", summary: "RHBZ#2186106", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186106", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29541", url: "https://www.cve.org/CVERecord?id=CVE-2023-29541", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29541", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29541", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29541", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29541", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T14:15:32+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.src", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1811", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 8.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.src", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "Mozilla: Files with malicious extensions could have been downloaded unsafely on Linux", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "JunYoung Park", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29548", cwe: { id: "CWE-682", name: "Incorrect Calculation", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186110", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nA wrong lowering instruction in the ARM64 Ion compiler resulted in a wrong optimization result.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Incorrect optimization result on ARM64", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.src", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29548", }, { category: "external", summary: "RHBZ#2186110", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186110", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29548", url: "https://www.cve.org/CVERecord?id=CVE-2023-29548", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29548", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29548", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29548", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29548", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T14:15:32+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.src", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1811", }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "NONE", baseScore: 3.4, baseSeverity: "LOW", confidentialityImpact: "NONE", integrityImpact: "LOW", privilegesRequired: "NONE", scope: "CHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:N", version: "3.1", }, products: [ "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.src", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.x86_64", ], }, ], threats: [ { category: "impact", details: "Low", }, ], title: "Mozilla: Incorrect optimization result on ARM64", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Mozilla developers and community", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29550", cwe: { id: "CWE-120", name: "Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186111", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nMozilla developers Andrew Osmond, Sebastian Hengst, Andrew McCreight, and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 111 and Firefox ESR 102.9. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Memory safety bugs fixed in Firefox 112 and Firefox ESR 102.10", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.src", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29550", }, { category: "external", summary: "RHBZ#2186111", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186111", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29550", url: "https://www.cve.org/CVERecord?id=CVE-2023-29550", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29550", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29550", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29550", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29550", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T14:15:32+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.src", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1811", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 8.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.src", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "Mozilla: Memory safety bugs fixed in Firefox 112 and Firefox ESR 102.10", }, ], }
RHSA-2023:1803
Vulnerability from csaf_redhat
Published
2023-04-17 13:56
Modified
2024-12-16 05:27
Summary
Red Hat Security Advisory: thunderbird security update
Notes
Topic
An update for thunderbird is now available for Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Mozilla Thunderbird is a standalone mail and newsgroup client.
This update upgrades Thunderbird to version 102.10.0.
Security Fix(es):
* Thunderbird: Revocation status of S/Mime recipient certificates was not checked (CVE-2023-0547)
* Mozilla: Matrix SDK bundled with Thunderbird vulnerable to denial-of-service attack (CVE-2023-28427)
* Mozilla: Fullscreen notification obscured (CVE-2023-29533)
* Mozilla: Potential Memory Corruption following Garbage Collector compaction (CVE-2023-29535)
* Mozilla: Invalid free from JavaScript code (CVE-2023-29536)
* Mozilla: Memory safety bugs fixed in Firefox 112 and Firefox ESR 102.10 (CVE-2023-29550)
* Mozilla: Memory Corruption in Safe Browsing Code (CVE-2023-1945)
* Thunderbird: Hang when processing certain OpenPGP messages (CVE-2023-29479)
* Mozilla: Content-Disposition filename truncation leads to Reflected File Download (CVE-2023-29539)
* Mozilla: Files with malicious extensions could have been downloaded unsafely on Linux (CVE-2023-29541)
* Mozilla: Incorrect optimization result on ARM64 (CVE-2023-29548)
* MFSA-TMP-2023-0001 Mozilla: Double-free in libwebp (BZ#2186102)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ document: { aggregate_severity: { namespace: "https://access.redhat.com/security/updates/classification/", text: "Important", }, category: "csaf_security_advisory", csaf_version: "2.0", distribution: { text: "Copyright © Red Hat, Inc. All rights reserved.", tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "en", notes: [ { category: "summary", text: "An update for thunderbird is now available for Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", title: "Topic", }, { category: "general", text: "Mozilla Thunderbird is a standalone mail and newsgroup client.\n\nThis update upgrades Thunderbird to version 102.10.0.\n\nSecurity Fix(es):\n\n* Thunderbird: Revocation status of S/Mime recipient certificates was not checked (CVE-2023-0547)\n\n* Mozilla: Matrix SDK bundled with Thunderbird vulnerable to denial-of-service attack (CVE-2023-28427)\n\n* Mozilla: Fullscreen notification obscured (CVE-2023-29533)\n\n* Mozilla: Potential Memory Corruption following Garbage Collector compaction (CVE-2023-29535)\n\n* Mozilla: Invalid free from JavaScript code (CVE-2023-29536)\n\n* Mozilla: Memory safety bugs fixed in Firefox 112 and Firefox ESR 102.10 (CVE-2023-29550)\n\n* Mozilla: Memory Corruption in Safe Browsing Code (CVE-2023-1945)\n\n* Thunderbird: Hang when processing certain OpenPGP messages (CVE-2023-29479)\n\n* Mozilla: Content-Disposition filename truncation leads to Reflected File Download (CVE-2023-29539)\n\n* Mozilla: Files with malicious extensions could have been downloaded unsafely on Linux (CVE-2023-29541)\n\n* Mozilla: Incorrect optimization result on ARM64 (CVE-2023-29548)\n\n* MFSA-TMP-2023-0001 Mozilla: Double-free in libwebp (BZ#2186102)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", title: "Details", }, { category: "legal_disclaimer", text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", title: "Terms of Use", }, ], publisher: { category: "vendor", contact_details: "https://access.redhat.com/security/team/contact/", issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", name: "Red Hat Product Security", namespace: "https://www.redhat.com", }, references: [ { category: "self", summary: "https://access.redhat.com/errata/RHSA-2023:1803", url: "https://access.redhat.com/errata/RHSA-2023:1803", }, { category: "external", summary: "https://access.redhat.com/security/updates/classification/#important", url: "https://access.redhat.com/security/updates/classification/#important", }, { category: "external", summary: "2183278", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2183278", }, { category: "external", summary: "2186101", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186101", }, { category: "external", summary: "2186102", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186102", }, { category: "external", summary: "2186103", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186103", }, { category: "external", summary: "2186104", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186104", }, { category: "external", summary: "2186105", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186105", }, { category: "external", summary: "2186106", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186106", }, { category: "external", summary: "2186109", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186109", }, { category: "external", summary: "2186110", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186110", }, { category: "external", summary: "2186111", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186111", }, { category: "external", summary: "2186734", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186734", }, { category: "external", summary: "2186735", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186735", }, { category: "self", summary: "Canonical URL", url: "https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_1803.json", }, ], title: "Red Hat Security Advisory: thunderbird security update", tracking: { current_release_date: "2024-12-16T05:27:32+00:00", generator: { date: "2024-12-16T05:27:32+00:00", engine: { name: "Red Hat SDEngine", version: "4.2.3", }, }, id: "RHSA-2023:1803", initial_release_date: "2023-04-17T13:56:07+00:00", revision_history: [ { date: "2023-04-17T13:56:07+00:00", number: "1", summary: "Initial version", }, { date: "2023-04-17T13:56:07+00:00", number: "2", summary: "Last updated version", }, { date: "2024-12-16T05:27:32+00:00", number: "3", summary: "Last generated version", }, ], status: "final", version: "3", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_name", name: "Red Hat Enterprise Linux AppStream E4S (v. 8.1)", product: { name: "Red Hat Enterprise Linux AppStream E4S (v. 8.1)", product_id: "AppStream-8.1.0.Z.E4S", product_identification_helper: { cpe: "cpe:/a:redhat:rhel_e4s:8.1::appstream", }, }, }, ], category: "product_family", name: "Red Hat Enterprise Linux", }, { branches: [ { category: "product_version", name: "thunderbird-0:102.10.0-2.el8_1.src", product: { name: "thunderbird-0:102.10.0-2.el8_1.src", product_id: "thunderbird-0:102.10.0-2.el8_1.src", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird@102.10.0-2.el8_1?arch=src", }, }, }, ], category: "architecture", name: "src", }, { branches: [ { category: "product_version", name: "thunderbird-0:102.10.0-2.el8_1.ppc64le", product: { name: "thunderbird-0:102.10.0-2.el8_1.ppc64le", product_id: "thunderbird-0:102.10.0-2.el8_1.ppc64le", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird@102.10.0-2.el8_1?arch=ppc64le", }, }, }, { category: "product_version", name: "thunderbird-debugsource-0:102.10.0-2.el8_1.ppc64le", product: { name: "thunderbird-debugsource-0:102.10.0-2.el8_1.ppc64le", product_id: "thunderbird-debugsource-0:102.10.0-2.el8_1.ppc64le", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird-debugsource@102.10.0-2.el8_1?arch=ppc64le", }, }, }, { category: "product_version", name: "thunderbird-debuginfo-0:102.10.0-2.el8_1.ppc64le", product: { name: "thunderbird-debuginfo-0:102.10.0-2.el8_1.ppc64le", product_id: "thunderbird-debuginfo-0:102.10.0-2.el8_1.ppc64le", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird-debuginfo@102.10.0-2.el8_1?arch=ppc64le", }, }, }, ], category: "architecture", name: "ppc64le", }, { branches: [ { category: "product_version", name: "thunderbird-0:102.10.0-2.el8_1.x86_64", product: { name: "thunderbird-0:102.10.0-2.el8_1.x86_64", product_id: "thunderbird-0:102.10.0-2.el8_1.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird@102.10.0-2.el8_1?arch=x86_64", }, }, }, { category: "product_version", name: "thunderbird-debugsource-0:102.10.0-2.el8_1.x86_64", product: { name: "thunderbird-debugsource-0:102.10.0-2.el8_1.x86_64", product_id: "thunderbird-debugsource-0:102.10.0-2.el8_1.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird-debugsource@102.10.0-2.el8_1?arch=x86_64", }, }, }, { category: "product_version", name: "thunderbird-debuginfo-0:102.10.0-2.el8_1.x86_64", product: { name: "thunderbird-debuginfo-0:102.10.0-2.el8_1.x86_64", product_id: "thunderbird-debuginfo-0:102.10.0-2.el8_1.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird-debuginfo@102.10.0-2.el8_1?arch=x86_64", }, }, }, ], category: "architecture", name: "x86_64", }, ], category: "vendor", name: "Red Hat", }, ], relationships: [ { category: "default_component_of", full_product_name: { name: "thunderbird-0:102.10.0-2.el8_1.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v. 8.1)", product_id: "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.ppc64le", }, product_reference: "thunderbird-0:102.10.0-2.el8_1.ppc64le", relates_to_product_reference: "AppStream-8.1.0.Z.E4S", }, { category: "default_component_of", full_product_name: { name: "thunderbird-0:102.10.0-2.el8_1.src as a component of Red Hat Enterprise Linux AppStream E4S (v. 8.1)", product_id: "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.src", }, product_reference: "thunderbird-0:102.10.0-2.el8_1.src", relates_to_product_reference: "AppStream-8.1.0.Z.E4S", }, { category: "default_component_of", full_product_name: { name: "thunderbird-0:102.10.0-2.el8_1.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v. 8.1)", product_id: "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.x86_64", }, product_reference: "thunderbird-0:102.10.0-2.el8_1.x86_64", relates_to_product_reference: "AppStream-8.1.0.Z.E4S", }, { category: "default_component_of", full_product_name: { name: "thunderbird-debuginfo-0:102.10.0-2.el8_1.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v. 8.1)", product_id: "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.ppc64le", }, product_reference: "thunderbird-debuginfo-0:102.10.0-2.el8_1.ppc64le", relates_to_product_reference: "AppStream-8.1.0.Z.E4S", }, { category: "default_component_of", full_product_name: { name: "thunderbird-debuginfo-0:102.10.0-2.el8_1.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v. 8.1)", product_id: "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.x86_64", }, product_reference: "thunderbird-debuginfo-0:102.10.0-2.el8_1.x86_64", relates_to_product_reference: "AppStream-8.1.0.Z.E4S", }, { category: "default_component_of", full_product_name: { name: "thunderbird-debugsource-0:102.10.0-2.el8_1.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v. 8.1)", product_id: "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.ppc64le", }, product_reference: "thunderbird-debugsource-0:102.10.0-2.el8_1.ppc64le", relates_to_product_reference: "AppStream-8.1.0.Z.E4S", }, { category: "default_component_of", full_product_name: { name: "thunderbird-debugsource-0:102.10.0-2.el8_1.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v. 8.1)", product_id: "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.x86_64", }, product_reference: "thunderbird-debugsource-0:102.10.0-2.el8_1.x86_64", relates_to_product_reference: "AppStream-8.1.0.Z.E4S", }, ], }, vulnerabilities: [ { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Paul Menzel", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-0547", cwe: { id: "CWE-356", name: "Product UI does not Warn User of Unsafe Actions", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186734", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nOCSP revocation status of recipient certificates was not checked when sending S/Mime encrypted email, and revoked certificates would be accepted. Thunderbird versions from 68 to 102.9.1 were affected by this bug.", title: "Vulnerability description", }, { category: "summary", text: "Thunderbird: Revocation status of S/Mime recipient certificates was not checked", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.src", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-0547", }, { category: "external", summary: "RHBZ#2186734", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186734", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-0547", url: "https://www.cve.org/CVERecord?id=CVE-2023-0547", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-0547", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-0547", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-15/#CVE-2023-0547", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-15/#CVE-2023-0547", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T13:56:07+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.src", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1803", }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 7.5, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.src", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "Thunderbird: Revocation status of S/Mime recipient certificates was not checked", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Gabriele Svelto", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-1945", cwe: { id: "CWE-119", name: "Improper Restriction of Operations within the Bounds of a Memory Buffer", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186109", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nUnexpected data returned from the Safe Browsing API could have led to memory corruption and a potentially exploitable crash.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Memory Corruption in Safe Browsing Code", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.src", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-1945", }, { category: "external", summary: "RHBZ#2186109", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186109", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-1945", url: "https://www.cve.org/CVERecord?id=CVE-2023-1945", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-1945", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-1945", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-1945", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-1945", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T13:56:07+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.src", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1803", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "NONE", baseScore: 6.1, baseSeverity: "MEDIUM", confidentialityImpact: "LOW", integrityImpact: "LOW", privilegesRequired: "NONE", scope: "CHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", version: "3.1", }, products: [ "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.src", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "Mozilla: Memory Corruption in Safe Browsing Code", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Irvan Kurniawan", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-1999", cwe: { id: "CWE-415", name: "Double Free", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186102", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nA double-free in libwebp could have led to memory corruption and a potentially exploitable crash.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: libwebp: Double-free in libwebp", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.src", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-1999", }, { category: "external", summary: "RHBZ#2186102", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186102", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-1999", url: "https://www.cve.org/CVERecord?id=CVE-2023-1999", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-1999", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-1999", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-1999", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-1999", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-15/#CVE-2023-1999", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-15/#CVE-2023-1999", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T13:56:07+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.src", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1803", }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 7.5, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.src", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "Mozilla: libwebp: Double-free in libwebp", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Matrix Security Team", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-28427", cwe: { id: "CWE-1321", name: "Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')", }, discovery_date: "2023-03-28T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2183278", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nThunderbird users who use the Matrix chat protocol were vulnerable to a denial-of-service attack.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Matrix SDK bundled with Thunderbird vulnerable to denial-of-service attack", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.src", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-28427", }, { category: "external", summary: "RHBZ#2183278", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2183278", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-28427", url: "https://www.cve.org/CVERecord?id=CVE-2023-28427", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-28427", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-28427", }, { category: "external", summary: "https://github.com/matrix-org/matrix-js-sdk/security/advisories/GHSA-mwq8-fjpf-c2gr", url: "https://github.com/matrix-org/matrix-js-sdk/security/advisories/GHSA-mwq8-fjpf-c2gr", }, { category: "external", summary: "https://matrix.org/blog/2023/03/28/security-releases-matrix-js-sdk-24-0-0-and-matrix-react-sdk-3-69-0", url: "https://matrix.org/blog/2023/03/28/security-releases-matrix-js-sdk-24-0-0-and-matrix-react-sdk-3-69-0", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-12/#CVE-2023-28427", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-12/#CVE-2023-28427", }, ], release_date: "2023-03-28T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T13:56:07+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.src", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1803", }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 7.5, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.src", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "Mozilla: Matrix SDK bundled with Thunderbird vulnerable to denial-of-service attack", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Ribose RNP Team", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29479", cwe: { id: "CWE-400", name: "Uncontrolled Resource Consumption", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186735", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nCertain malformed OpenPGP messages could trigger incorrect parsing of PKESK/SKESK packets due to a bug in the Ribose RNP library used by Thunderbird up to version 102.9.1, which would cause the Thunderbird user interface to hang. The issue was discovered using Google's oss-fuzz.", title: "Vulnerability description", }, { category: "summary", text: "Thunderbird: Hang when processing certain OpenPGP messages", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.src", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29479", }, { category: "external", summary: "RHBZ#2186735", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186735", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29479", url: "https://www.cve.org/CVERecord?id=CVE-2023-29479", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29479", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29479", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-15/#CVE-2023-29479", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-15/#CVE-2023-29479", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T13:56:07+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.src", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1803", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 6.5, baseSeverity: "MEDIUM", confidentialityImpact: "NONE", integrityImpact: "NONE", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", version: "3.1", }, products: [ "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.src", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "Thunderbird: Hang when processing certain OpenPGP messages", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Irvan Kurniawan", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29533", cwe: { id: "CWE-425", name: "Direct Request ('Forced Browsing')", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186101", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nA website could have obscured the fullscreen notification by using a combination of `window.open`, fullscreen requests, `window.name` assignments, and `setInterval` calls. This could have led to user confusion and possible spoofing attacks.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Fullscreen notification obscured", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.src", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29533", }, { category: "external", summary: "RHBZ#2186101", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186101", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29533", url: "https://www.cve.org/CVERecord?id=CVE-2023-29533", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29533", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29533", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29533", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29533", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T13:56:07+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.src", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1803", }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 7.5, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.src", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "Mozilla: Fullscreen notification obscured", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Lukas Bernhard", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29535", cwe: { id: "CWE-119", name: "Improper Restriction of Operations within the Bounds of a Memory Buffer", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186103", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nFollowing a Garbage Collector compaction, weak maps may have been accessed before they were correctly traced. This resulted in memory corruption and a potentially exploitable crash.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Potential Memory Corruption following Garbage Collector compaction", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.src", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29535", }, { category: "external", summary: "RHBZ#2186103", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186103", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29535", url: "https://www.cve.org/CVERecord?id=CVE-2023-29535", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29535", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29535", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29535", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29535", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T13:56:07+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.src", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1803", }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 7.5, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.src", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "Mozilla: Potential Memory Corruption following Garbage Collector compaction", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "zx from qriousec", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29536", cwe: { id: "CWE-617", name: "Reachable Assertion", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186104", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nAn attacker could cause the memory manager to incorrectly free a pointer that addresses attacker-controlled memory, resulting in an assertion, memory corruption, or a potentially exploitable crash.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Invalid free from JavaScript code", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.src", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29536", }, { category: "external", summary: "RHBZ#2186104", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186104", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29536", url: "https://www.cve.org/CVERecord?id=CVE-2023-29536", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29536", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29536", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29536", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29536", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T13:56:07+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.src", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1803", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 8.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.src", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "Mozilla: Invalid free from JavaScript code", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Trung Pham", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29539", cwe: { id: "CWE-159", name: "Improper Handling of Invalid Use of Special Elements", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186105", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nWhen handling the filename directive in the Content-Disposition header, the filename would be truncated if the filename contained a NULL character. This could have led to reflected file download attacks potentially tricking users to install malware.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Content-Disposition filename truncation leads to Reflected File Download", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.src", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29539", }, { category: "external", summary: "RHBZ#2186105", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186105", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29539", url: "https://www.cve.org/CVERecord?id=CVE-2023-29539", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29539", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29539", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29539", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29539", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T13:56:07+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.src", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1803", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 8.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.src", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "Mozilla: Content-Disposition filename truncation leads to Reflected File Download", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Ameen Basha M K", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29541", cwe: { id: "CWE-434", name: "Unrestricted Upload of File with Dangerous Type", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186106", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nFirefox did not properly handle downloads of files ending in `.desktop`, which can be interpreted to run attacker-controlled commands.\r\n\r\n*This bug only affects Firefox for Linux on certain Distributions. Other operating systems are unaffected, and Mozilla is unable to enumerate all affected Linux Distributions.*", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Files with malicious extensions could have been downloaded unsafely on Linux", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.src", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29541", }, { category: "external", summary: "RHBZ#2186106", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186106", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29541", url: "https://www.cve.org/CVERecord?id=CVE-2023-29541", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29541", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29541", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29541", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29541", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T13:56:07+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.src", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1803", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 8.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.src", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "Mozilla: Files with malicious extensions could have been downloaded unsafely on Linux", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "JunYoung Park", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29548", cwe: { id: "CWE-682", name: "Incorrect Calculation", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186110", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nA wrong lowering instruction in the ARM64 Ion compiler resulted in a wrong optimization result.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Incorrect optimization result on ARM64", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.src", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29548", }, { category: "external", summary: "RHBZ#2186110", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186110", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29548", url: "https://www.cve.org/CVERecord?id=CVE-2023-29548", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29548", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29548", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29548", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29548", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T13:56:07+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.src", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1803", }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "NONE", baseScore: 3.4, baseSeverity: "LOW", confidentialityImpact: "NONE", integrityImpact: "LOW", privilegesRequired: "NONE", scope: "CHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:N", version: "3.1", }, products: [ "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.src", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.x86_64", ], }, ], threats: [ { category: "impact", details: "Low", }, ], title: "Mozilla: Incorrect optimization result on ARM64", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Mozilla developers and community", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29550", cwe: { id: "CWE-120", name: "Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186111", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nMozilla developers Andrew Osmond, Sebastian Hengst, Andrew McCreight, and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 111 and Firefox ESR 102.9. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Memory safety bugs fixed in Firefox 112 and Firefox ESR 102.10", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.src", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29550", }, { category: "external", summary: "RHBZ#2186111", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186111", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29550", url: "https://www.cve.org/CVERecord?id=CVE-2023-29550", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29550", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29550", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29550", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29550", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T13:56:07+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.src", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1803", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 8.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.src", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "Mozilla: Memory safety bugs fixed in Firefox 112 and Firefox ESR 102.10", }, ], }
rhsa-2023:1809
Vulnerability from csaf_redhat
Published
2023-04-17 14:10
Modified
2024-12-16 05:27
Summary
Red Hat Security Advisory: thunderbird security update
Notes
Topic
An update for thunderbird is now available for Red Hat Enterprise Linux 9.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Mozilla Thunderbird is a standalone mail and newsgroup client.
This update upgrades Thunderbird to version 102.10.0.
Security Fix(es):
* Thunderbird: Revocation status of S/Mime recipient certificates was not checked (CVE-2023-0547)
* Mozilla: Matrix SDK bundled with Thunderbird vulnerable to denial-of-service attack (CVE-2023-28427)
* Mozilla: Fullscreen notification obscured (CVE-2023-29533)
* Mozilla: Potential Memory Corruption following Garbage Collector compaction (CVE-2023-29535)
* Mozilla: Invalid free from JavaScript code (CVE-2023-29536)
* Mozilla: Memory safety bugs fixed in Firefox 112 and Firefox ESR 102.10 (CVE-2023-29550)
* Mozilla: Memory Corruption in Safe Browsing Code (CVE-2023-1945)
* Thunderbird: Hang when processing certain OpenPGP messages (CVE-2023-29479)
* Mozilla: Content-Disposition filename truncation leads to Reflected File Download (CVE-2023-29539)
* Mozilla: Files with malicious extensions could have been downloaded unsafely on Linux (CVE-2023-29541)
* Mozilla: Incorrect optimization result on ARM64 (CVE-2023-29548)
* MFSA-TMP-2023-0001 Mozilla: Double-free in libwebp (BZ#2186102)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ document: { aggregate_severity: { namespace: "https://access.redhat.com/security/updates/classification/", text: "Important", }, category: "csaf_security_advisory", csaf_version: "2.0", distribution: { text: "Copyright © Red Hat, Inc. All rights reserved.", tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "en", notes: [ { category: "summary", text: "An update for thunderbird is now available for Red Hat Enterprise Linux 9.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", title: "Topic", }, { category: "general", text: "Mozilla Thunderbird is a standalone mail and newsgroup client.\n\nThis update upgrades Thunderbird to version 102.10.0.\n\nSecurity Fix(es):\n\n* Thunderbird: Revocation status of S/Mime recipient certificates was not checked (CVE-2023-0547)\n\n* Mozilla: Matrix SDK bundled with Thunderbird vulnerable to denial-of-service attack (CVE-2023-28427)\n\n* Mozilla: Fullscreen notification obscured (CVE-2023-29533)\n\n* Mozilla: Potential Memory Corruption following Garbage Collector compaction (CVE-2023-29535)\n\n* Mozilla: Invalid free from JavaScript code (CVE-2023-29536)\n\n* Mozilla: Memory safety bugs fixed in Firefox 112 and Firefox ESR 102.10 (CVE-2023-29550)\n\n* Mozilla: Memory Corruption in Safe Browsing Code (CVE-2023-1945)\n\n* Thunderbird: Hang when processing certain OpenPGP messages (CVE-2023-29479)\n\n* Mozilla: Content-Disposition filename truncation leads to Reflected File Download (CVE-2023-29539)\n\n* Mozilla: Files with malicious extensions could have been downloaded unsafely on Linux (CVE-2023-29541)\n\n* Mozilla: Incorrect optimization result on ARM64 (CVE-2023-29548)\n\n* MFSA-TMP-2023-0001 Mozilla: Double-free in libwebp (BZ#2186102)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", title: "Details", }, { category: "legal_disclaimer", text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", title: "Terms of Use", }, ], publisher: { category: "vendor", contact_details: "https://access.redhat.com/security/team/contact/", issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", name: "Red Hat Product Security", namespace: "https://www.redhat.com", }, references: [ { category: "self", summary: "https://access.redhat.com/errata/RHSA-2023:1809", url: "https://access.redhat.com/errata/RHSA-2023:1809", }, { category: "external", summary: "https://access.redhat.com/security/updates/classification/#important", url: "https://access.redhat.com/security/updates/classification/#important", }, { category: "external", summary: "2183278", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2183278", }, { category: "external", summary: "2186101", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186101", }, { category: "external", summary: "2186102", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186102", }, { category: "external", summary: "2186103", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186103", }, { category: "external", summary: "2186104", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186104", }, { category: "external", summary: "2186105", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186105", }, { category: "external", summary: "2186106", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186106", }, { category: "external", summary: "2186109", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186109", }, { category: "external", summary: "2186110", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186110", }, { category: "external", summary: "2186111", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186111", }, { category: "external", summary: "2186734", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186734", }, { category: "external", summary: "2186735", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186735", }, { category: "self", summary: "Canonical URL", url: "https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_1809.json", }, ], title: "Red Hat Security Advisory: thunderbird security update", tracking: { current_release_date: "2024-12-16T05:27:13+00:00", generator: { date: "2024-12-16T05:27:13+00:00", engine: { name: "Red Hat SDEngine", version: "4.2.3", }, }, id: "RHSA-2023:1809", initial_release_date: "2023-04-17T14:10:15+00:00", revision_history: [ { date: "2023-04-17T14:10:15+00:00", number: "1", summary: "Initial version", }, { date: "2023-04-17T14:10:15+00:00", number: "2", summary: "Last updated version", }, { date: "2024-12-16T05:27:13+00:00", number: "3", summary: "Last generated version", }, ], status: "final", version: "3", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_name", name: "Red Hat Enterprise Linux AppStream (v. 9)", product: { name: "Red Hat Enterprise Linux AppStream (v. 9)", product_id: "AppStream-9.1.0.Z.MAIN", product_identification_helper: { cpe: "cpe:/a:redhat:enterprise_linux:9::appstream", }, }, }, ], category: "product_family", name: "Red Hat Enterprise Linux", }, { branches: [ { category: "product_version", name: "thunderbird-0:102.10.0-2.el9_1.src", product: { name: "thunderbird-0:102.10.0-2.el9_1.src", product_id: "thunderbird-0:102.10.0-2.el9_1.src", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird@102.10.0-2.el9_1?arch=src", }, }, }, ], category: "architecture", name: "src", }, { branches: [ { category: "product_version", name: "thunderbird-0:102.10.0-2.el9_1.aarch64", product: { name: "thunderbird-0:102.10.0-2.el9_1.aarch64", product_id: "thunderbird-0:102.10.0-2.el9_1.aarch64", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird@102.10.0-2.el9_1?arch=aarch64", }, }, }, { category: "product_version", name: "thunderbird-debugsource-0:102.10.0-2.el9_1.aarch64", product: { name: "thunderbird-debugsource-0:102.10.0-2.el9_1.aarch64", product_id: "thunderbird-debugsource-0:102.10.0-2.el9_1.aarch64", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird-debugsource@102.10.0-2.el9_1?arch=aarch64", }, }, }, { category: "product_version", name: "thunderbird-debuginfo-0:102.10.0-2.el9_1.aarch64", product: { name: "thunderbird-debuginfo-0:102.10.0-2.el9_1.aarch64", product_id: "thunderbird-debuginfo-0:102.10.0-2.el9_1.aarch64", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird-debuginfo@102.10.0-2.el9_1?arch=aarch64", }, }, }, ], category: "architecture", name: "aarch64", }, { branches: [ { category: "product_version", name: "thunderbird-0:102.10.0-2.el9_1.ppc64le", product: { name: "thunderbird-0:102.10.0-2.el9_1.ppc64le", product_id: "thunderbird-0:102.10.0-2.el9_1.ppc64le", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird@102.10.0-2.el9_1?arch=ppc64le", }, }, }, { category: "product_version", name: "thunderbird-debugsource-0:102.10.0-2.el9_1.ppc64le", product: { name: "thunderbird-debugsource-0:102.10.0-2.el9_1.ppc64le", product_id: "thunderbird-debugsource-0:102.10.0-2.el9_1.ppc64le", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird-debugsource@102.10.0-2.el9_1?arch=ppc64le", }, }, }, { category: "product_version", name: "thunderbird-debuginfo-0:102.10.0-2.el9_1.ppc64le", product: { name: "thunderbird-debuginfo-0:102.10.0-2.el9_1.ppc64le", product_id: "thunderbird-debuginfo-0:102.10.0-2.el9_1.ppc64le", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird-debuginfo@102.10.0-2.el9_1?arch=ppc64le", }, }, }, ], category: "architecture", name: "ppc64le", }, { branches: [ { category: "product_version", name: "thunderbird-0:102.10.0-2.el9_1.x86_64", product: { name: "thunderbird-0:102.10.0-2.el9_1.x86_64", product_id: "thunderbird-0:102.10.0-2.el9_1.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird@102.10.0-2.el9_1?arch=x86_64", }, }, }, { category: "product_version", name: "thunderbird-debugsource-0:102.10.0-2.el9_1.x86_64", product: { name: "thunderbird-debugsource-0:102.10.0-2.el9_1.x86_64", product_id: "thunderbird-debugsource-0:102.10.0-2.el9_1.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird-debugsource@102.10.0-2.el9_1?arch=x86_64", }, }, }, { category: "product_version", name: "thunderbird-debuginfo-0:102.10.0-2.el9_1.x86_64", product: { name: "thunderbird-debuginfo-0:102.10.0-2.el9_1.x86_64", product_id: "thunderbird-debuginfo-0:102.10.0-2.el9_1.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird-debuginfo@102.10.0-2.el9_1?arch=x86_64", }, }, }, ], category: "architecture", name: "x86_64", }, { branches: [ { category: "product_version", name: "thunderbird-0:102.10.0-2.el9_1.s390x", product: { name: "thunderbird-0:102.10.0-2.el9_1.s390x", product_id: "thunderbird-0:102.10.0-2.el9_1.s390x", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird@102.10.0-2.el9_1?arch=s390x", }, }, }, { category: "product_version", name: "thunderbird-debugsource-0:102.10.0-2.el9_1.s390x", product: { name: "thunderbird-debugsource-0:102.10.0-2.el9_1.s390x", product_id: "thunderbird-debugsource-0:102.10.0-2.el9_1.s390x", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird-debugsource@102.10.0-2.el9_1?arch=s390x", }, }, }, { category: "product_version", name: "thunderbird-debuginfo-0:102.10.0-2.el9_1.s390x", product: { name: "thunderbird-debuginfo-0:102.10.0-2.el9_1.s390x", product_id: "thunderbird-debuginfo-0:102.10.0-2.el9_1.s390x", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird-debuginfo@102.10.0-2.el9_1?arch=s390x", }, }, }, ], category: "architecture", name: "s390x", }, ], category: "vendor", name: "Red Hat", }, ], relationships: [ { category: "default_component_of", full_product_name: { name: "thunderbird-0:102.10.0-2.el9_1.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)", product_id: "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.aarch64", }, product_reference: "thunderbird-0:102.10.0-2.el9_1.aarch64", relates_to_product_reference: "AppStream-9.1.0.Z.MAIN", }, { category: "default_component_of", full_product_name: { name: "thunderbird-0:102.10.0-2.el9_1.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)", product_id: "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.ppc64le", }, product_reference: "thunderbird-0:102.10.0-2.el9_1.ppc64le", relates_to_product_reference: "AppStream-9.1.0.Z.MAIN", }, { category: "default_component_of", full_product_name: { name: "thunderbird-0:102.10.0-2.el9_1.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)", product_id: "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.s390x", }, product_reference: "thunderbird-0:102.10.0-2.el9_1.s390x", relates_to_product_reference: "AppStream-9.1.0.Z.MAIN", }, { category: "default_component_of", full_product_name: { name: "thunderbird-0:102.10.0-2.el9_1.src as a component of Red Hat Enterprise Linux AppStream (v. 9)", product_id: "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.src", }, product_reference: "thunderbird-0:102.10.0-2.el9_1.src", relates_to_product_reference: "AppStream-9.1.0.Z.MAIN", }, { category: "default_component_of", full_product_name: { name: "thunderbird-0:102.10.0-2.el9_1.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)", product_id: "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.x86_64", }, product_reference: "thunderbird-0:102.10.0-2.el9_1.x86_64", relates_to_product_reference: "AppStream-9.1.0.Z.MAIN", }, { category: "default_component_of", full_product_name: { name: "thunderbird-debuginfo-0:102.10.0-2.el9_1.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)", product_id: "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.aarch64", }, product_reference: "thunderbird-debuginfo-0:102.10.0-2.el9_1.aarch64", relates_to_product_reference: "AppStream-9.1.0.Z.MAIN", }, { category: "default_component_of", full_product_name: { name: "thunderbird-debuginfo-0:102.10.0-2.el9_1.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)", product_id: "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.ppc64le", }, product_reference: "thunderbird-debuginfo-0:102.10.0-2.el9_1.ppc64le", relates_to_product_reference: "AppStream-9.1.0.Z.MAIN", }, { category: "default_component_of", full_product_name: { name: "thunderbird-debuginfo-0:102.10.0-2.el9_1.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)", product_id: "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.s390x", }, product_reference: "thunderbird-debuginfo-0:102.10.0-2.el9_1.s390x", relates_to_product_reference: "AppStream-9.1.0.Z.MAIN", }, { category: "default_component_of", full_product_name: { name: "thunderbird-debuginfo-0:102.10.0-2.el9_1.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)", product_id: "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.x86_64", }, product_reference: "thunderbird-debuginfo-0:102.10.0-2.el9_1.x86_64", relates_to_product_reference: "AppStream-9.1.0.Z.MAIN", }, { category: "default_component_of", full_product_name: { name: "thunderbird-debugsource-0:102.10.0-2.el9_1.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)", product_id: "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.aarch64", }, product_reference: "thunderbird-debugsource-0:102.10.0-2.el9_1.aarch64", relates_to_product_reference: "AppStream-9.1.0.Z.MAIN", }, { category: "default_component_of", full_product_name: { name: "thunderbird-debugsource-0:102.10.0-2.el9_1.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)", product_id: "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.ppc64le", }, product_reference: "thunderbird-debugsource-0:102.10.0-2.el9_1.ppc64le", relates_to_product_reference: "AppStream-9.1.0.Z.MAIN", }, { category: "default_component_of", full_product_name: { name: "thunderbird-debugsource-0:102.10.0-2.el9_1.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)", product_id: "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.s390x", }, product_reference: "thunderbird-debugsource-0:102.10.0-2.el9_1.s390x", relates_to_product_reference: "AppStream-9.1.0.Z.MAIN", }, { category: "default_component_of", full_product_name: { name: "thunderbird-debugsource-0:102.10.0-2.el9_1.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)", product_id: "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.x86_64", }, product_reference: "thunderbird-debugsource-0:102.10.0-2.el9_1.x86_64", relates_to_product_reference: "AppStream-9.1.0.Z.MAIN", }, ], }, vulnerabilities: [ { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Paul Menzel", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-0547", cwe: { id: "CWE-356", name: "Product UI does not Warn User of Unsafe Actions", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186734", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nOCSP revocation status of recipient certificates was not checked when sending S/Mime encrypted email, and revoked certificates would be accepted. Thunderbird versions from 68 to 102.9.1 were affected by this bug.", title: "Vulnerability description", }, { category: "summary", text: "Thunderbird: Revocation status of S/Mime recipient certificates was not checked", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.src", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-0547", }, { category: "external", summary: "RHBZ#2186734", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186734", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-0547", url: "https://www.cve.org/CVERecord?id=CVE-2023-0547", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-0547", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-0547", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-15/#CVE-2023-0547", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-15/#CVE-2023-0547", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T14:10:15+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.src", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1809", }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 7.5, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.src", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "Thunderbird: Revocation status of S/Mime recipient certificates was not checked", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Gabriele Svelto", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-1945", cwe: { id: "CWE-119", name: "Improper Restriction of Operations within the Bounds of a Memory Buffer", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186109", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nUnexpected data returned from the Safe Browsing API could have led to memory corruption and a potentially exploitable crash.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Memory Corruption in Safe Browsing Code", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.src", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-1945", }, { category: "external", summary: "RHBZ#2186109", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186109", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-1945", url: "https://www.cve.org/CVERecord?id=CVE-2023-1945", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-1945", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-1945", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-1945", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-1945", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T14:10:15+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.src", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1809", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "NONE", baseScore: 6.1, baseSeverity: "MEDIUM", confidentialityImpact: "LOW", integrityImpact: "LOW", privilegesRequired: "NONE", scope: "CHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", version: "3.1", }, products: [ "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.src", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "Mozilla: Memory Corruption in Safe Browsing Code", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Irvan Kurniawan", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-1999", cwe: { id: "CWE-415", name: "Double Free", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186102", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nA double-free in libwebp could have led to memory corruption and a potentially exploitable crash.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: libwebp: Double-free in libwebp", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.src", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-1999", }, { category: "external", summary: "RHBZ#2186102", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186102", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-1999", url: "https://www.cve.org/CVERecord?id=CVE-2023-1999", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-1999", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-1999", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-1999", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-1999", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-15/#CVE-2023-1999", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-15/#CVE-2023-1999", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T14:10:15+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.src", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1809", }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 7.5, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.src", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "Mozilla: libwebp: Double-free in libwebp", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Matrix Security Team", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-28427", cwe: { id: "CWE-1321", name: "Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')", }, discovery_date: "2023-03-28T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2183278", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nThunderbird users who use the Matrix chat protocol were vulnerable to a denial-of-service attack.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Matrix SDK bundled with Thunderbird vulnerable to denial-of-service attack", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.src", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-28427", }, { category: "external", summary: "RHBZ#2183278", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2183278", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-28427", url: "https://www.cve.org/CVERecord?id=CVE-2023-28427", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-28427", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-28427", }, { category: "external", summary: "https://github.com/matrix-org/matrix-js-sdk/security/advisories/GHSA-mwq8-fjpf-c2gr", url: "https://github.com/matrix-org/matrix-js-sdk/security/advisories/GHSA-mwq8-fjpf-c2gr", }, { category: "external", summary: "https://matrix.org/blog/2023/03/28/security-releases-matrix-js-sdk-24-0-0-and-matrix-react-sdk-3-69-0", url: "https://matrix.org/blog/2023/03/28/security-releases-matrix-js-sdk-24-0-0-and-matrix-react-sdk-3-69-0", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-12/#CVE-2023-28427", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-12/#CVE-2023-28427", }, ], release_date: "2023-03-28T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T14:10:15+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.src", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1809", }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 7.5, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.src", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "Mozilla: Matrix SDK bundled with Thunderbird vulnerable to denial-of-service attack", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Ribose RNP Team", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29479", cwe: { id: "CWE-400", name: "Uncontrolled Resource Consumption", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186735", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nCertain malformed OpenPGP messages could trigger incorrect parsing of PKESK/SKESK packets due to a bug in the Ribose RNP library used by Thunderbird up to version 102.9.1, which would cause the Thunderbird user interface to hang. The issue was discovered using Google's oss-fuzz.", title: "Vulnerability description", }, { category: "summary", text: "Thunderbird: Hang when processing certain OpenPGP messages", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.src", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29479", }, { category: "external", summary: "RHBZ#2186735", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186735", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29479", url: "https://www.cve.org/CVERecord?id=CVE-2023-29479", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29479", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29479", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-15/#CVE-2023-29479", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-15/#CVE-2023-29479", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T14:10:15+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.src", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1809", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 6.5, baseSeverity: "MEDIUM", confidentialityImpact: "NONE", integrityImpact: "NONE", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", version: "3.1", }, products: [ "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.src", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "Thunderbird: Hang when processing certain OpenPGP messages", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Irvan Kurniawan", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29533", cwe: { id: "CWE-425", name: "Direct Request ('Forced Browsing')", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186101", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nA website could have obscured the fullscreen notification by using a combination of `window.open`, fullscreen requests, `window.name` assignments, and `setInterval` calls. This could have led to user confusion and possible spoofing attacks.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Fullscreen notification obscured", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.src", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29533", }, { category: "external", summary: "RHBZ#2186101", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186101", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29533", url: "https://www.cve.org/CVERecord?id=CVE-2023-29533", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29533", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29533", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29533", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29533", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T14:10:15+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.src", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1809", }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 7.5, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.src", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "Mozilla: Fullscreen notification obscured", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Lukas Bernhard", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29535", cwe: { id: "CWE-119", name: "Improper Restriction of Operations within the Bounds of a Memory Buffer", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186103", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nFollowing a Garbage Collector compaction, weak maps may have been accessed before they were correctly traced. This resulted in memory corruption and a potentially exploitable crash.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Potential Memory Corruption following Garbage Collector compaction", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.src", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29535", }, { category: "external", summary: "RHBZ#2186103", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186103", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29535", url: "https://www.cve.org/CVERecord?id=CVE-2023-29535", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29535", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29535", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29535", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29535", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T14:10:15+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.src", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1809", }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 7.5, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.src", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "Mozilla: Potential Memory Corruption following Garbage Collector compaction", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "zx from qriousec", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29536", cwe: { id: "CWE-617", name: "Reachable Assertion", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186104", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nAn attacker could cause the memory manager to incorrectly free a pointer that addresses attacker-controlled memory, resulting in an assertion, memory corruption, or a potentially exploitable crash.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Invalid free from JavaScript code", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.src", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29536", }, { category: "external", summary: "RHBZ#2186104", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186104", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29536", url: "https://www.cve.org/CVERecord?id=CVE-2023-29536", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29536", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29536", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29536", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29536", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T14:10:15+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.src", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1809", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 8.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.src", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "Mozilla: Invalid free from JavaScript code", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Trung Pham", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29539", cwe: { id: "CWE-159", name: "Improper Handling of Invalid Use of Special Elements", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186105", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nWhen handling the filename directive in the Content-Disposition header, the filename would be truncated if the filename contained a NULL character. This could have led to reflected file download attacks potentially tricking users to install malware.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Content-Disposition filename truncation leads to Reflected File Download", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.src", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29539", }, { category: "external", summary: "RHBZ#2186105", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186105", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29539", url: "https://www.cve.org/CVERecord?id=CVE-2023-29539", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29539", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29539", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29539", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29539", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T14:10:15+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.src", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1809", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 8.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.src", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "Mozilla: Content-Disposition filename truncation leads to Reflected File Download", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Ameen Basha M K", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29541", cwe: { id: "CWE-434", name: "Unrestricted Upload of File with Dangerous Type", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186106", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nFirefox did not properly handle downloads of files ending in `.desktop`, which can be interpreted to run attacker-controlled commands.\r\n\r\n*This bug only affects Firefox for Linux on certain Distributions. Other operating systems are unaffected, and Mozilla is unable to enumerate all affected Linux Distributions.*", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Files with malicious extensions could have been downloaded unsafely on Linux", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.src", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29541", }, { category: "external", summary: "RHBZ#2186106", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186106", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29541", url: "https://www.cve.org/CVERecord?id=CVE-2023-29541", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29541", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29541", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29541", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29541", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T14:10:15+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.src", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1809", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 8.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.src", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "Mozilla: Files with malicious extensions could have been downloaded unsafely on Linux", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "JunYoung Park", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29548", cwe: { id: "CWE-682", name: "Incorrect Calculation", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186110", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nA wrong lowering instruction in the ARM64 Ion compiler resulted in a wrong optimization result.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Incorrect optimization result on ARM64", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.src", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29548", }, { category: "external", summary: "RHBZ#2186110", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186110", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29548", url: "https://www.cve.org/CVERecord?id=CVE-2023-29548", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29548", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29548", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29548", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29548", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T14:10:15+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.src", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1809", }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "NONE", baseScore: 3.4, baseSeverity: "LOW", confidentialityImpact: "NONE", integrityImpact: "LOW", privilegesRequired: "NONE", scope: "CHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:N", version: "3.1", }, products: [ "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.src", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.x86_64", ], }, ], threats: [ { category: "impact", details: "Low", }, ], title: "Mozilla: Incorrect optimization result on ARM64", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Mozilla developers and community", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29550", cwe: { id: "CWE-120", name: "Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186111", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nMozilla developers Andrew Osmond, Sebastian Hengst, Andrew McCreight, and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 111 and Firefox ESR 102.9. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Memory safety bugs fixed in Firefox 112 and Firefox ESR 102.10", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.src", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29550", }, { category: "external", summary: "RHBZ#2186111", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186111", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29550", url: "https://www.cve.org/CVERecord?id=CVE-2023-29550", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29550", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29550", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29550", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29550", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T14:10:15+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.src", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1809", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 8.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.src", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "Mozilla: Memory safety bugs fixed in Firefox 112 and Firefox ESR 102.10", }, ], }
RHSA-2023:1810
Vulnerability from csaf_redhat
Published
2023-04-17 15:03
Modified
2024-12-16 05:27
Summary
Red Hat Security Advisory: thunderbird security update
Notes
Topic
An update for thunderbird is now available for Red Hat Enterprise Linux 9.0 Extended Update Support.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Mozilla Thunderbird is a standalone mail and newsgroup client.
This update upgrades Thunderbird to version 102.10.0.
Security Fix(es):
* Thunderbird: Revocation status of S/Mime recipient certificates was not checked (CVE-2023-0547)
* Mozilla: Matrix SDK bundled with Thunderbird vulnerable to denial-of-service attack (CVE-2023-28427)
* Mozilla: Fullscreen notification obscured (CVE-2023-29533)
* Mozilla: Potential Memory Corruption following Garbage Collector compaction (CVE-2023-29535)
* Mozilla: Invalid free from JavaScript code (CVE-2023-29536)
* Mozilla: Memory safety bugs fixed in Firefox 112 and Firefox ESR 102.10 (CVE-2023-29550)
* Mozilla: Memory Corruption in Safe Browsing Code (CVE-2023-1945)
* Thunderbird: Hang when processing certain OpenPGP messages (CVE-2023-29479)
* Mozilla: Content-Disposition filename truncation leads to Reflected File Download (CVE-2023-29539)
* Mozilla: Files with malicious extensions could have been downloaded unsafely on Linux (CVE-2023-29541)
* Mozilla: Incorrect optimization result on ARM64 (CVE-2023-29548)
* MFSA-TMP-2023-0001 Mozilla: Double-free in libwebp (BZ#2186102)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ document: { aggregate_severity: { namespace: "https://access.redhat.com/security/updates/classification/", text: "Important", }, category: "csaf_security_advisory", csaf_version: "2.0", distribution: { text: "Copyright © Red Hat, Inc. All rights reserved.", tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "en", notes: [ { category: "summary", text: "An update for thunderbird is now available for Red Hat Enterprise Linux 9.0 Extended Update Support.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", title: "Topic", }, { category: "general", text: "Mozilla Thunderbird is a standalone mail and newsgroup client.\n\nThis update upgrades Thunderbird to version 102.10.0.\n\nSecurity Fix(es):\n\n* Thunderbird: Revocation status of S/Mime recipient certificates was not checked (CVE-2023-0547)\n\n* Mozilla: Matrix SDK bundled with Thunderbird vulnerable to denial-of-service attack (CVE-2023-28427)\n\n* Mozilla: Fullscreen notification obscured (CVE-2023-29533)\n\n* Mozilla: Potential Memory Corruption following Garbage Collector compaction (CVE-2023-29535)\n\n* Mozilla: Invalid free from JavaScript code (CVE-2023-29536)\n\n* Mozilla: Memory safety bugs fixed in Firefox 112 and Firefox ESR 102.10 (CVE-2023-29550)\n\n* Mozilla: Memory Corruption in Safe Browsing Code (CVE-2023-1945)\n\n* Thunderbird: Hang when processing certain OpenPGP messages (CVE-2023-29479)\n\n* Mozilla: Content-Disposition filename truncation leads to Reflected File Download (CVE-2023-29539)\n\n* Mozilla: Files with malicious extensions could have been downloaded unsafely on Linux (CVE-2023-29541)\n\n* Mozilla: Incorrect optimization result on ARM64 (CVE-2023-29548)\n\n* MFSA-TMP-2023-0001 Mozilla: Double-free in libwebp (BZ#2186102)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", title: "Details", }, { category: "legal_disclaimer", text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", title: "Terms of Use", }, ], publisher: { category: "vendor", contact_details: "https://access.redhat.com/security/team/contact/", issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", name: "Red Hat Product Security", namespace: "https://www.redhat.com", }, references: [ { category: "self", summary: "https://access.redhat.com/errata/RHSA-2023:1810", url: "https://access.redhat.com/errata/RHSA-2023:1810", }, { category: "external", summary: "https://access.redhat.com/security/updates/classification/#important", url: "https://access.redhat.com/security/updates/classification/#important", }, { category: "external", summary: "2183278", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2183278", }, { category: "external", summary: "2186101", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186101", }, { category: "external", summary: "2186102", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186102", }, { category: "external", summary: "2186103", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186103", }, { category: "external", summary: "2186104", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186104", }, { category: "external", summary: "2186105", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186105", }, { category: "external", summary: "2186106", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186106", }, { category: "external", summary: "2186109", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186109", }, { category: "external", summary: "2186110", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186110", }, { category: "external", summary: "2186111", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186111", }, { category: "external", summary: "2186734", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186734", }, { category: "external", summary: "2186735", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186735", }, { category: "self", summary: "Canonical URL", url: "https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_1810.json", }, ], title: "Red Hat Security Advisory: thunderbird security update", tracking: { current_release_date: "2024-12-16T05:27:04+00:00", generator: { date: "2024-12-16T05:27:04+00:00", engine: { name: "Red Hat SDEngine", version: "4.2.3", }, }, id: "RHSA-2023:1810", initial_release_date: "2023-04-17T15:03:40+00:00", revision_history: [ { date: "2023-04-17T15:03:40+00:00", number: "1", summary: "Initial version", }, { date: "2023-04-17T15:03:40+00:00", number: "2", summary: "Last updated version", }, { date: "2024-12-16T05:27:04+00:00", number: "3", summary: "Last generated version", }, ], status: "final", version: "3", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_name", name: "Red Hat Enterprise Linux AppStream EUS (v.9.0)", product: { name: "Red Hat Enterprise Linux AppStream EUS (v.9.0)", product_id: "AppStream-9.0.0.Z.EUS", product_identification_helper: { cpe: "cpe:/a:redhat:rhel_eus:9.0::appstream", }, }, }, ], category: "product_family", name: "Red Hat Enterprise Linux", }, { branches: [ { category: "product_version", name: "thunderbird-0:102.10.0-2.el9_0.src", product: { name: "thunderbird-0:102.10.0-2.el9_0.src", product_id: "thunderbird-0:102.10.0-2.el9_0.src", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird@102.10.0-2.el9_0?arch=src", }, }, }, ], category: "architecture", name: "src", }, { branches: [ { category: "product_version", name: "thunderbird-0:102.10.0-2.el9_0.aarch64", product: { name: "thunderbird-0:102.10.0-2.el9_0.aarch64", product_id: "thunderbird-0:102.10.0-2.el9_0.aarch64", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird@102.10.0-2.el9_0?arch=aarch64", }, }, }, { category: "product_version", name: "thunderbird-debugsource-0:102.10.0-2.el9_0.aarch64", product: { name: "thunderbird-debugsource-0:102.10.0-2.el9_0.aarch64", product_id: "thunderbird-debugsource-0:102.10.0-2.el9_0.aarch64", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird-debugsource@102.10.0-2.el9_0?arch=aarch64", }, }, }, { category: "product_version", name: "thunderbird-debuginfo-0:102.10.0-2.el9_0.aarch64", product: { name: "thunderbird-debuginfo-0:102.10.0-2.el9_0.aarch64", product_id: "thunderbird-debuginfo-0:102.10.0-2.el9_0.aarch64", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird-debuginfo@102.10.0-2.el9_0?arch=aarch64", }, }, }, ], category: "architecture", name: "aarch64", }, { branches: [ { category: "product_version", name: "thunderbird-0:102.10.0-2.el9_0.ppc64le", product: { name: "thunderbird-0:102.10.0-2.el9_0.ppc64le", product_id: "thunderbird-0:102.10.0-2.el9_0.ppc64le", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird@102.10.0-2.el9_0?arch=ppc64le", }, }, }, { category: "product_version", name: "thunderbird-debugsource-0:102.10.0-2.el9_0.ppc64le", product: { name: "thunderbird-debugsource-0:102.10.0-2.el9_0.ppc64le", product_id: "thunderbird-debugsource-0:102.10.0-2.el9_0.ppc64le", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird-debugsource@102.10.0-2.el9_0?arch=ppc64le", }, }, }, { category: "product_version", name: "thunderbird-debuginfo-0:102.10.0-2.el9_0.ppc64le", product: { name: "thunderbird-debuginfo-0:102.10.0-2.el9_0.ppc64le", product_id: "thunderbird-debuginfo-0:102.10.0-2.el9_0.ppc64le", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird-debuginfo@102.10.0-2.el9_0?arch=ppc64le", }, }, }, ], category: "architecture", name: "ppc64le", }, { branches: [ { category: "product_version", name: "thunderbird-0:102.10.0-2.el9_0.x86_64", product: { name: "thunderbird-0:102.10.0-2.el9_0.x86_64", product_id: "thunderbird-0:102.10.0-2.el9_0.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird@102.10.0-2.el9_0?arch=x86_64", }, }, }, { category: "product_version", name: "thunderbird-debugsource-0:102.10.0-2.el9_0.x86_64", product: { name: "thunderbird-debugsource-0:102.10.0-2.el9_0.x86_64", product_id: "thunderbird-debugsource-0:102.10.0-2.el9_0.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird-debugsource@102.10.0-2.el9_0?arch=x86_64", }, }, }, { category: "product_version", name: "thunderbird-debuginfo-0:102.10.0-2.el9_0.x86_64", product: { name: "thunderbird-debuginfo-0:102.10.0-2.el9_0.x86_64", product_id: "thunderbird-debuginfo-0:102.10.0-2.el9_0.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird-debuginfo@102.10.0-2.el9_0?arch=x86_64", }, }, }, ], category: "architecture", name: "x86_64", }, { branches: [ { category: "product_version", name: "thunderbird-0:102.10.0-2.el9_0.s390x", product: { name: "thunderbird-0:102.10.0-2.el9_0.s390x", product_id: "thunderbird-0:102.10.0-2.el9_0.s390x", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird@102.10.0-2.el9_0?arch=s390x", }, }, }, { category: "product_version", name: "thunderbird-debugsource-0:102.10.0-2.el9_0.s390x", product: { name: "thunderbird-debugsource-0:102.10.0-2.el9_0.s390x", product_id: "thunderbird-debugsource-0:102.10.0-2.el9_0.s390x", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird-debugsource@102.10.0-2.el9_0?arch=s390x", }, }, }, { category: "product_version", name: "thunderbird-debuginfo-0:102.10.0-2.el9_0.s390x", product: { name: "thunderbird-debuginfo-0:102.10.0-2.el9_0.s390x", product_id: "thunderbird-debuginfo-0:102.10.0-2.el9_0.s390x", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird-debuginfo@102.10.0-2.el9_0?arch=s390x", }, }, }, ], category: "architecture", name: "s390x", }, ], category: "vendor", name: "Red Hat", }, ], relationships: [ { category: "default_component_of", full_product_name: { name: "thunderbird-0:102.10.0-2.el9_0.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.0)", product_id: "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.aarch64", }, product_reference: "thunderbird-0:102.10.0-2.el9_0.aarch64", relates_to_product_reference: "AppStream-9.0.0.Z.EUS", }, { category: "default_component_of", full_product_name: { name: "thunderbird-0:102.10.0-2.el9_0.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.9.0)", product_id: "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.ppc64le", }, product_reference: "thunderbird-0:102.10.0-2.el9_0.ppc64le", relates_to_product_reference: "AppStream-9.0.0.Z.EUS", }, { category: "default_component_of", full_product_name: { name: "thunderbird-0:102.10.0-2.el9_0.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.9.0)", product_id: "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.s390x", }, product_reference: "thunderbird-0:102.10.0-2.el9_0.s390x", relates_to_product_reference: "AppStream-9.0.0.Z.EUS", }, { category: "default_component_of", full_product_name: { name: "thunderbird-0:102.10.0-2.el9_0.src as a component of Red Hat Enterprise Linux AppStream EUS (v.9.0)", product_id: "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.src", }, product_reference: "thunderbird-0:102.10.0-2.el9_0.src", relates_to_product_reference: "AppStream-9.0.0.Z.EUS", }, { category: "default_component_of", full_product_name: { name: "thunderbird-0:102.10.0-2.el9_0.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.0)", product_id: "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.x86_64", }, product_reference: "thunderbird-0:102.10.0-2.el9_0.x86_64", relates_to_product_reference: "AppStream-9.0.0.Z.EUS", }, { category: "default_component_of", full_product_name: { name: "thunderbird-debuginfo-0:102.10.0-2.el9_0.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.0)", product_id: "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.aarch64", }, product_reference: "thunderbird-debuginfo-0:102.10.0-2.el9_0.aarch64", relates_to_product_reference: "AppStream-9.0.0.Z.EUS", }, { category: "default_component_of", full_product_name: { name: "thunderbird-debuginfo-0:102.10.0-2.el9_0.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.9.0)", product_id: "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.ppc64le", }, product_reference: "thunderbird-debuginfo-0:102.10.0-2.el9_0.ppc64le", relates_to_product_reference: "AppStream-9.0.0.Z.EUS", }, { category: "default_component_of", full_product_name: { name: "thunderbird-debuginfo-0:102.10.0-2.el9_0.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.9.0)", product_id: "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.s390x", }, product_reference: "thunderbird-debuginfo-0:102.10.0-2.el9_0.s390x", relates_to_product_reference: "AppStream-9.0.0.Z.EUS", }, { category: "default_component_of", full_product_name: { name: "thunderbird-debuginfo-0:102.10.0-2.el9_0.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.0)", product_id: "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.x86_64", }, product_reference: "thunderbird-debuginfo-0:102.10.0-2.el9_0.x86_64", relates_to_product_reference: "AppStream-9.0.0.Z.EUS", }, { category: "default_component_of", full_product_name: { name: "thunderbird-debugsource-0:102.10.0-2.el9_0.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.0)", product_id: "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.aarch64", }, product_reference: "thunderbird-debugsource-0:102.10.0-2.el9_0.aarch64", relates_to_product_reference: "AppStream-9.0.0.Z.EUS", }, { category: "default_component_of", full_product_name: { name: "thunderbird-debugsource-0:102.10.0-2.el9_0.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.9.0)", product_id: "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.ppc64le", }, product_reference: "thunderbird-debugsource-0:102.10.0-2.el9_0.ppc64le", relates_to_product_reference: "AppStream-9.0.0.Z.EUS", }, { category: "default_component_of", full_product_name: { name: "thunderbird-debugsource-0:102.10.0-2.el9_0.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.9.0)", product_id: "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.s390x", }, product_reference: "thunderbird-debugsource-0:102.10.0-2.el9_0.s390x", relates_to_product_reference: "AppStream-9.0.0.Z.EUS", }, { category: "default_component_of", full_product_name: { name: "thunderbird-debugsource-0:102.10.0-2.el9_0.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.0)", product_id: "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.x86_64", }, product_reference: "thunderbird-debugsource-0:102.10.0-2.el9_0.x86_64", relates_to_product_reference: "AppStream-9.0.0.Z.EUS", }, ], }, vulnerabilities: [ { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Paul Menzel", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-0547", cwe: { id: "CWE-356", name: "Product UI does not Warn User of Unsafe Actions", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186734", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nOCSP revocation status of recipient certificates was not checked when sending S/Mime encrypted email, and revoked certificates would be accepted. Thunderbird versions from 68 to 102.9.1 were affected by this bug.", title: "Vulnerability description", }, { category: "summary", text: "Thunderbird: Revocation status of S/Mime recipient certificates was not checked", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.src", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-0547", }, { category: "external", summary: "RHBZ#2186734", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186734", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-0547", url: "https://www.cve.org/CVERecord?id=CVE-2023-0547", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-0547", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-0547", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-15/#CVE-2023-0547", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-15/#CVE-2023-0547", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T15:03:40+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.src", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1810", }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 7.5, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.src", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "Thunderbird: Revocation status of S/Mime recipient certificates was not checked", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Gabriele Svelto", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-1945", cwe: { id: "CWE-119", name: "Improper Restriction of Operations within the Bounds of a Memory Buffer", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186109", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nUnexpected data returned from the Safe Browsing API could have led to memory corruption and a potentially exploitable crash.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Memory Corruption in Safe Browsing Code", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.src", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-1945", }, { category: "external", summary: "RHBZ#2186109", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186109", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-1945", url: "https://www.cve.org/CVERecord?id=CVE-2023-1945", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-1945", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-1945", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-1945", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-1945", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T15:03:40+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.src", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1810", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "NONE", baseScore: 6.1, baseSeverity: "MEDIUM", confidentialityImpact: "LOW", integrityImpact: "LOW", privilegesRequired: "NONE", scope: "CHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", version: "3.1", }, products: [ "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.src", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "Mozilla: Memory Corruption in Safe Browsing Code", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Irvan Kurniawan", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-1999", cwe: { id: "CWE-415", name: "Double Free", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186102", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nA double-free in libwebp could have led to memory corruption and a potentially exploitable crash.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: libwebp: Double-free in libwebp", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.src", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-1999", }, { category: "external", summary: "RHBZ#2186102", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186102", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-1999", url: "https://www.cve.org/CVERecord?id=CVE-2023-1999", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-1999", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-1999", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-1999", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-1999", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-15/#CVE-2023-1999", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-15/#CVE-2023-1999", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T15:03:40+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.src", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1810", }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 7.5, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.src", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "Mozilla: libwebp: Double-free in libwebp", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Matrix Security Team", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-28427", cwe: { id: "CWE-1321", name: "Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')", }, discovery_date: "2023-03-28T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2183278", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nThunderbird users who use the Matrix chat protocol were vulnerable to a denial-of-service attack.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Matrix SDK bundled with Thunderbird vulnerable to denial-of-service attack", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.src", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-28427", }, { category: "external", summary: "RHBZ#2183278", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2183278", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-28427", url: "https://www.cve.org/CVERecord?id=CVE-2023-28427", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-28427", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-28427", }, { category: "external", summary: "https://github.com/matrix-org/matrix-js-sdk/security/advisories/GHSA-mwq8-fjpf-c2gr", url: "https://github.com/matrix-org/matrix-js-sdk/security/advisories/GHSA-mwq8-fjpf-c2gr", }, { category: "external", summary: "https://matrix.org/blog/2023/03/28/security-releases-matrix-js-sdk-24-0-0-and-matrix-react-sdk-3-69-0", url: "https://matrix.org/blog/2023/03/28/security-releases-matrix-js-sdk-24-0-0-and-matrix-react-sdk-3-69-0", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-12/#CVE-2023-28427", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-12/#CVE-2023-28427", }, ], release_date: "2023-03-28T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T15:03:40+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.src", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1810", }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 7.5, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.src", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "Mozilla: Matrix SDK bundled with Thunderbird vulnerable to denial-of-service attack", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Ribose RNP Team", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29479", cwe: { id: "CWE-400", name: "Uncontrolled Resource Consumption", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186735", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nCertain malformed OpenPGP messages could trigger incorrect parsing of PKESK/SKESK packets due to a bug in the Ribose RNP library used by Thunderbird up to version 102.9.1, which would cause the Thunderbird user interface to hang. The issue was discovered using Google's oss-fuzz.", title: "Vulnerability description", }, { category: "summary", text: "Thunderbird: Hang when processing certain OpenPGP messages", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.src", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29479", }, { category: "external", summary: "RHBZ#2186735", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186735", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29479", url: "https://www.cve.org/CVERecord?id=CVE-2023-29479", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29479", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29479", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-15/#CVE-2023-29479", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-15/#CVE-2023-29479", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T15:03:40+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.src", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1810", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 6.5, baseSeverity: "MEDIUM", confidentialityImpact: "NONE", integrityImpact: "NONE", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", version: "3.1", }, products: [ "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.src", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "Thunderbird: Hang when processing certain OpenPGP messages", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Irvan Kurniawan", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29533", cwe: { id: "CWE-425", name: "Direct Request ('Forced Browsing')", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186101", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nA website could have obscured the fullscreen notification by using a combination of `window.open`, fullscreen requests, `window.name` assignments, and `setInterval` calls. This could have led to user confusion and possible spoofing attacks.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Fullscreen notification obscured", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.src", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29533", }, { category: "external", summary: "RHBZ#2186101", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186101", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29533", url: "https://www.cve.org/CVERecord?id=CVE-2023-29533", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29533", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29533", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29533", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29533", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T15:03:40+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.src", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1810", }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 7.5, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.src", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "Mozilla: Fullscreen notification obscured", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Lukas Bernhard", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29535", cwe: { id: "CWE-119", name: "Improper Restriction of Operations within the Bounds of a Memory Buffer", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186103", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nFollowing a Garbage Collector compaction, weak maps may have been accessed before they were correctly traced. This resulted in memory corruption and a potentially exploitable crash.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Potential Memory Corruption following Garbage Collector compaction", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.src", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29535", }, { category: "external", summary: "RHBZ#2186103", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186103", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29535", url: "https://www.cve.org/CVERecord?id=CVE-2023-29535", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29535", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29535", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29535", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29535", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T15:03:40+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.src", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1810", }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 7.5, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.src", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "Mozilla: Potential Memory Corruption following Garbage Collector compaction", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "zx from qriousec", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29536", cwe: { id: "CWE-617", name: "Reachable Assertion", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186104", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nAn attacker could cause the memory manager to incorrectly free a pointer that addresses attacker-controlled memory, resulting in an assertion, memory corruption, or a potentially exploitable crash.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Invalid free from JavaScript code", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.src", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29536", }, { category: "external", summary: "RHBZ#2186104", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186104", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29536", url: "https://www.cve.org/CVERecord?id=CVE-2023-29536", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29536", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29536", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29536", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29536", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T15:03:40+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.src", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1810", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 8.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.src", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "Mozilla: Invalid free from JavaScript code", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Trung Pham", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29539", cwe: { id: "CWE-159", name: "Improper Handling of Invalid Use of Special Elements", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186105", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nWhen handling the filename directive in the Content-Disposition header, the filename would be truncated if the filename contained a NULL character. This could have led to reflected file download attacks potentially tricking users to install malware.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Content-Disposition filename truncation leads to Reflected File Download", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.src", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29539", }, { category: "external", summary: "RHBZ#2186105", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186105", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29539", url: "https://www.cve.org/CVERecord?id=CVE-2023-29539", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29539", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29539", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29539", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29539", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T15:03:40+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.src", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1810", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 8.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.src", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "Mozilla: Content-Disposition filename truncation leads to Reflected File Download", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Ameen Basha M K", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29541", cwe: { id: "CWE-434", name: "Unrestricted Upload of File with Dangerous Type", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186106", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nFirefox did not properly handle downloads of files ending in `.desktop`, which can be interpreted to run attacker-controlled commands.\r\n\r\n*This bug only affects Firefox for Linux on certain Distributions. Other operating systems are unaffected, and Mozilla is unable to enumerate all affected Linux Distributions.*", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Files with malicious extensions could have been downloaded unsafely on Linux", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.src", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29541", }, { category: "external", summary: "RHBZ#2186106", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186106", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29541", url: "https://www.cve.org/CVERecord?id=CVE-2023-29541", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29541", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29541", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29541", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29541", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T15:03:40+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.src", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1810", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 8.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.src", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "Mozilla: Files with malicious extensions could have been downloaded unsafely on Linux", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "JunYoung Park", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29548", cwe: { id: "CWE-682", name: "Incorrect Calculation", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186110", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nA wrong lowering instruction in the ARM64 Ion compiler resulted in a wrong optimization result.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Incorrect optimization result on ARM64", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.src", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29548", }, { category: "external", summary: "RHBZ#2186110", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186110", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29548", url: "https://www.cve.org/CVERecord?id=CVE-2023-29548", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29548", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29548", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29548", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29548", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T15:03:40+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.src", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1810", }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "NONE", baseScore: 3.4, baseSeverity: "LOW", confidentialityImpact: "NONE", integrityImpact: "LOW", privilegesRequired: "NONE", scope: "CHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:N", version: "3.1", }, products: [ "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.src", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.x86_64", ], }, ], threats: [ { category: "impact", details: "Low", }, ], title: "Mozilla: Incorrect optimization result on ARM64", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Mozilla developers and community", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29550", cwe: { id: "CWE-120", name: "Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186111", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nMozilla developers Andrew Osmond, Sebastian Hengst, Andrew McCreight, and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 111 and Firefox ESR 102.9. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Memory safety bugs fixed in Firefox 112 and Firefox ESR 102.10", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.src", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29550", }, { category: "external", summary: "RHBZ#2186111", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186111", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29550", url: "https://www.cve.org/CVERecord?id=CVE-2023-29550", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29550", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29550", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29550", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29550", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T15:03:40+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.src", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1810", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 8.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.src", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "Mozilla: Memory safety bugs fixed in Firefox 112 and Firefox ESR 102.10", }, ], }
rhsa-2023:1802
Vulnerability from csaf_redhat
Published
2023-04-17 14:01
Modified
2024-12-16 05:27
Summary
Red Hat Security Advisory: thunderbird security update
Notes
Topic
An update for thunderbird is now available for Red Hat Enterprise Linux 8.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Mozilla Thunderbird is a standalone mail and newsgroup client.
This update upgrades Thunderbird to version 102.10.0.
Security Fix(es):
* Thunderbird: Revocation status of S/Mime recipient certificates was not checked (CVE-2023-0547)
* Mozilla: Matrix SDK bundled with Thunderbird vulnerable to denial-of-service attack (CVE-2023-28427)
* Mozilla: Fullscreen notification obscured (CVE-2023-29533)
* Mozilla: Potential Memory Corruption following Garbage Collector compaction (CVE-2023-29535)
* Mozilla: Invalid free from JavaScript code (CVE-2023-29536)
* Mozilla: Memory safety bugs fixed in Firefox 112 and Firefox ESR 102.10 (CVE-2023-29550)
* Mozilla: Memory Corruption in Safe Browsing Code (CVE-2023-1945)
* Thunderbird: Hang when processing certain OpenPGP messages (CVE-2023-29479)
* Mozilla: Content-Disposition filename truncation leads to Reflected File Download (CVE-2023-29539)
* Mozilla: Files with malicious extensions could have been downloaded unsafely on Linux (CVE-2023-29541)
* Mozilla: Incorrect optimization result on ARM64 (CVE-2023-29548)
* MFSA-TMP-2023-0001 Mozilla: Double-free in libwebp (BZ#2186102)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ document: { aggregate_severity: { namespace: "https://access.redhat.com/security/updates/classification/", text: "Important", }, category: "csaf_security_advisory", csaf_version: "2.0", distribution: { text: "Copyright © Red Hat, Inc. All rights reserved.", tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "en", notes: [ { category: "summary", text: "An update for thunderbird is now available for Red Hat Enterprise Linux 8.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", title: "Topic", }, { category: "general", text: "Mozilla Thunderbird is a standalone mail and newsgroup client.\n\nThis update upgrades Thunderbird to version 102.10.0.\n\nSecurity Fix(es):\n\n* Thunderbird: Revocation status of S/Mime recipient certificates was not checked (CVE-2023-0547)\n\n* Mozilla: Matrix SDK bundled with Thunderbird vulnerable to denial-of-service attack (CVE-2023-28427)\n\n* Mozilla: Fullscreen notification obscured (CVE-2023-29533)\n\n* Mozilla: Potential Memory Corruption following Garbage Collector compaction (CVE-2023-29535)\n\n* Mozilla: Invalid free from JavaScript code (CVE-2023-29536)\n\n* Mozilla: Memory safety bugs fixed in Firefox 112 and Firefox ESR 102.10 (CVE-2023-29550)\n\n* Mozilla: Memory Corruption in Safe Browsing Code (CVE-2023-1945)\n\n* Thunderbird: Hang when processing certain OpenPGP messages (CVE-2023-29479)\n\n* Mozilla: Content-Disposition filename truncation leads to Reflected File Download (CVE-2023-29539)\n\n* Mozilla: Files with malicious extensions could have been downloaded unsafely on Linux (CVE-2023-29541)\n\n* Mozilla: Incorrect optimization result on ARM64 (CVE-2023-29548)\n\n* MFSA-TMP-2023-0001 Mozilla: Double-free in libwebp (BZ#2186102)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", title: "Details", }, { category: "legal_disclaimer", text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", title: "Terms of Use", }, ], publisher: { category: "vendor", contact_details: "https://access.redhat.com/security/team/contact/", issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", name: "Red Hat Product Security", namespace: "https://www.redhat.com", }, references: [ { category: "self", summary: "https://access.redhat.com/errata/RHSA-2023:1802", url: "https://access.redhat.com/errata/RHSA-2023:1802", }, { category: "external", summary: "https://access.redhat.com/security/updates/classification/#important", url: "https://access.redhat.com/security/updates/classification/#important", }, { category: "external", summary: "2183278", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2183278", }, { category: "external", summary: "2186101", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186101", }, { category: "external", summary: "2186102", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186102", }, { category: "external", summary: "2186103", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186103", }, { category: "external", summary: "2186104", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186104", }, { category: "external", summary: "2186105", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186105", }, { category: "external", summary: "2186106", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186106", }, { category: "external", summary: "2186109", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186109", }, { category: "external", summary: "2186110", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186110", }, { category: "external", summary: "2186111", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186111", }, { category: "external", summary: "2186734", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186734", }, { category: "external", summary: "2186735", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186735", }, { category: "self", summary: "Canonical URL", url: "https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_1802.json", }, ], title: "Red Hat Security Advisory: thunderbird security update", tracking: { current_release_date: "2024-12-16T05:27:42+00:00", generator: { date: "2024-12-16T05:27:42+00:00", engine: { name: "Red Hat SDEngine", version: "4.2.3", }, }, id: "RHSA-2023:1802", initial_release_date: "2023-04-17T14:01:57+00:00", revision_history: [ { date: "2023-04-17T14:01:57+00:00", number: "1", summary: "Initial version", }, { date: "2023-04-17T14:01:57+00:00", number: "2", summary: "Last updated version", }, { date: "2024-12-16T05:27:42+00:00", number: "3", summary: "Last generated version", }, ], status: "final", version: "3", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_name", name: "Red Hat Enterprise Linux AppStream (v. 8)", product: { name: "Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.7.0.Z.MAIN", product_identification_helper: { cpe: "cpe:/a:redhat:enterprise_linux:8::appstream", }, }, }, ], category: "product_family", name: "Red Hat Enterprise Linux", }, { branches: [ { category: "product_version", name: "thunderbird-0:102.10.0-2.el8_7.src", product: { name: "thunderbird-0:102.10.0-2.el8_7.src", product_id: "thunderbird-0:102.10.0-2.el8_7.src", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird@102.10.0-2.el8_7?arch=src", }, }, }, ], category: "architecture", name: "src", }, { branches: [ { category: "product_version", name: "thunderbird-0:102.10.0-2.el8_7.aarch64", product: { name: "thunderbird-0:102.10.0-2.el8_7.aarch64", product_id: "thunderbird-0:102.10.0-2.el8_7.aarch64", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird@102.10.0-2.el8_7?arch=aarch64", }, }, }, { category: "product_version", name: "thunderbird-debugsource-0:102.10.0-2.el8_7.aarch64", product: { name: "thunderbird-debugsource-0:102.10.0-2.el8_7.aarch64", product_id: "thunderbird-debugsource-0:102.10.0-2.el8_7.aarch64", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird-debugsource@102.10.0-2.el8_7?arch=aarch64", }, }, }, { category: "product_version", name: "thunderbird-debuginfo-0:102.10.0-2.el8_7.aarch64", product: { name: "thunderbird-debuginfo-0:102.10.0-2.el8_7.aarch64", product_id: "thunderbird-debuginfo-0:102.10.0-2.el8_7.aarch64", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird-debuginfo@102.10.0-2.el8_7?arch=aarch64", }, }, }, ], category: "architecture", name: "aarch64", }, { branches: [ { category: "product_version", name: "thunderbird-0:102.10.0-2.el8_7.ppc64le", product: { name: "thunderbird-0:102.10.0-2.el8_7.ppc64le", product_id: "thunderbird-0:102.10.0-2.el8_7.ppc64le", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird@102.10.0-2.el8_7?arch=ppc64le", }, }, }, { category: "product_version", name: "thunderbird-debugsource-0:102.10.0-2.el8_7.ppc64le", product: { name: "thunderbird-debugsource-0:102.10.0-2.el8_7.ppc64le", product_id: "thunderbird-debugsource-0:102.10.0-2.el8_7.ppc64le", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird-debugsource@102.10.0-2.el8_7?arch=ppc64le", }, }, }, { category: "product_version", name: "thunderbird-debuginfo-0:102.10.0-2.el8_7.ppc64le", product: { name: "thunderbird-debuginfo-0:102.10.0-2.el8_7.ppc64le", product_id: "thunderbird-debuginfo-0:102.10.0-2.el8_7.ppc64le", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird-debuginfo@102.10.0-2.el8_7?arch=ppc64le", }, }, }, ], category: "architecture", name: "ppc64le", }, { branches: [ { category: "product_version", name: "thunderbird-0:102.10.0-2.el8_7.x86_64", product: { name: "thunderbird-0:102.10.0-2.el8_7.x86_64", product_id: "thunderbird-0:102.10.0-2.el8_7.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird@102.10.0-2.el8_7?arch=x86_64", }, }, }, { category: "product_version", name: "thunderbird-debugsource-0:102.10.0-2.el8_7.x86_64", product: { name: "thunderbird-debugsource-0:102.10.0-2.el8_7.x86_64", product_id: "thunderbird-debugsource-0:102.10.0-2.el8_7.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird-debugsource@102.10.0-2.el8_7?arch=x86_64", }, }, }, { category: "product_version", name: "thunderbird-debuginfo-0:102.10.0-2.el8_7.x86_64", product: { name: "thunderbird-debuginfo-0:102.10.0-2.el8_7.x86_64", product_id: "thunderbird-debuginfo-0:102.10.0-2.el8_7.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird-debuginfo@102.10.0-2.el8_7?arch=x86_64", }, }, }, ], category: "architecture", name: "x86_64", }, { branches: [ { category: "product_version", name: "thunderbird-0:102.10.0-2.el8_7.s390x", product: { name: "thunderbird-0:102.10.0-2.el8_7.s390x", product_id: "thunderbird-0:102.10.0-2.el8_7.s390x", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird@102.10.0-2.el8_7?arch=s390x", }, }, }, { category: "product_version", name: "thunderbird-debugsource-0:102.10.0-2.el8_7.s390x", product: { name: "thunderbird-debugsource-0:102.10.0-2.el8_7.s390x", product_id: "thunderbird-debugsource-0:102.10.0-2.el8_7.s390x", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird-debugsource@102.10.0-2.el8_7?arch=s390x", }, }, }, { category: "product_version", name: "thunderbird-debuginfo-0:102.10.0-2.el8_7.s390x", product: { name: "thunderbird-debuginfo-0:102.10.0-2.el8_7.s390x", product_id: "thunderbird-debuginfo-0:102.10.0-2.el8_7.s390x", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird-debuginfo@102.10.0-2.el8_7?arch=s390x", }, }, }, ], category: "architecture", name: "s390x", }, ], category: "vendor", name: "Red Hat", }, ], relationships: [ { category: "default_component_of", full_product_name: { name: "thunderbird-0:102.10.0-2.el8_7.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.aarch64", }, product_reference: "thunderbird-0:102.10.0-2.el8_7.aarch64", relates_to_product_reference: "AppStream-8.7.0.Z.MAIN", }, { category: "default_component_of", full_product_name: { name: "thunderbird-0:102.10.0-2.el8_7.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.ppc64le", }, product_reference: "thunderbird-0:102.10.0-2.el8_7.ppc64le", relates_to_product_reference: "AppStream-8.7.0.Z.MAIN", }, { category: "default_component_of", full_product_name: { name: "thunderbird-0:102.10.0-2.el8_7.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.s390x", }, product_reference: "thunderbird-0:102.10.0-2.el8_7.s390x", relates_to_product_reference: "AppStream-8.7.0.Z.MAIN", }, { category: "default_component_of", full_product_name: { name: "thunderbird-0:102.10.0-2.el8_7.src as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.src", }, product_reference: "thunderbird-0:102.10.0-2.el8_7.src", relates_to_product_reference: "AppStream-8.7.0.Z.MAIN", }, { category: "default_component_of", full_product_name: { name: "thunderbird-0:102.10.0-2.el8_7.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.x86_64", }, product_reference: "thunderbird-0:102.10.0-2.el8_7.x86_64", relates_to_product_reference: "AppStream-8.7.0.Z.MAIN", }, { category: "default_component_of", full_product_name: { name: "thunderbird-debuginfo-0:102.10.0-2.el8_7.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.aarch64", }, product_reference: "thunderbird-debuginfo-0:102.10.0-2.el8_7.aarch64", relates_to_product_reference: "AppStream-8.7.0.Z.MAIN", }, { category: "default_component_of", full_product_name: { name: "thunderbird-debuginfo-0:102.10.0-2.el8_7.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.ppc64le", }, product_reference: "thunderbird-debuginfo-0:102.10.0-2.el8_7.ppc64le", relates_to_product_reference: "AppStream-8.7.0.Z.MAIN", }, { category: "default_component_of", full_product_name: { name: "thunderbird-debuginfo-0:102.10.0-2.el8_7.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.s390x", }, product_reference: "thunderbird-debuginfo-0:102.10.0-2.el8_7.s390x", relates_to_product_reference: "AppStream-8.7.0.Z.MAIN", }, { category: "default_component_of", full_product_name: { name: "thunderbird-debuginfo-0:102.10.0-2.el8_7.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.x86_64", }, product_reference: "thunderbird-debuginfo-0:102.10.0-2.el8_7.x86_64", relates_to_product_reference: "AppStream-8.7.0.Z.MAIN", }, { category: "default_component_of", full_product_name: { name: "thunderbird-debugsource-0:102.10.0-2.el8_7.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.aarch64", }, product_reference: "thunderbird-debugsource-0:102.10.0-2.el8_7.aarch64", relates_to_product_reference: "AppStream-8.7.0.Z.MAIN", }, { category: "default_component_of", full_product_name: { name: "thunderbird-debugsource-0:102.10.0-2.el8_7.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.ppc64le", }, product_reference: "thunderbird-debugsource-0:102.10.0-2.el8_7.ppc64le", relates_to_product_reference: "AppStream-8.7.0.Z.MAIN", }, { category: "default_component_of", full_product_name: { name: "thunderbird-debugsource-0:102.10.0-2.el8_7.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.s390x", }, product_reference: "thunderbird-debugsource-0:102.10.0-2.el8_7.s390x", relates_to_product_reference: "AppStream-8.7.0.Z.MAIN", }, { category: "default_component_of", full_product_name: { name: "thunderbird-debugsource-0:102.10.0-2.el8_7.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.x86_64", }, product_reference: "thunderbird-debugsource-0:102.10.0-2.el8_7.x86_64", relates_to_product_reference: "AppStream-8.7.0.Z.MAIN", }, ], }, vulnerabilities: [ { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Paul Menzel", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-0547", cwe: { id: "CWE-356", name: "Product UI does not Warn User of Unsafe Actions", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186734", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nOCSP revocation status of recipient certificates was not checked when sending S/Mime encrypted email, and revoked certificates would be accepted. Thunderbird versions from 68 to 102.9.1 were affected by this bug.", title: "Vulnerability description", }, { category: "summary", text: "Thunderbird: Revocation status of S/Mime recipient certificates was not checked", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.src", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-0547", }, { category: "external", summary: "RHBZ#2186734", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186734", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-0547", url: "https://www.cve.org/CVERecord?id=CVE-2023-0547", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-0547", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-0547", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-15/#CVE-2023-0547", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-15/#CVE-2023-0547", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T14:01:57+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.src", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1802", }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 7.5, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.src", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "Thunderbird: Revocation status of S/Mime recipient certificates was not checked", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Gabriele Svelto", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-1945", cwe: { id: "CWE-119", name: "Improper Restriction of Operations within the Bounds of a Memory Buffer", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186109", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nUnexpected data returned from the Safe Browsing API could have led to memory corruption and a potentially exploitable crash.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Memory Corruption in Safe Browsing Code", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.src", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-1945", }, { category: "external", summary: "RHBZ#2186109", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186109", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-1945", url: "https://www.cve.org/CVERecord?id=CVE-2023-1945", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-1945", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-1945", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-1945", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-1945", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T14:01:57+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.src", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1802", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "NONE", baseScore: 6.1, baseSeverity: "MEDIUM", confidentialityImpact: "LOW", integrityImpact: "LOW", privilegesRequired: "NONE", scope: "CHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", version: "3.1", }, products: [ "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.src", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "Mozilla: Memory Corruption in Safe Browsing Code", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Irvan Kurniawan", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-1999", cwe: { id: "CWE-415", name: "Double Free", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186102", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nA double-free in libwebp could have led to memory corruption and a potentially exploitable crash.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: libwebp: Double-free in libwebp", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.src", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-1999", }, { category: "external", summary: "RHBZ#2186102", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186102", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-1999", url: "https://www.cve.org/CVERecord?id=CVE-2023-1999", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-1999", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-1999", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-1999", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-1999", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-15/#CVE-2023-1999", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-15/#CVE-2023-1999", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T14:01:57+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.src", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1802", }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 7.5, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.src", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "Mozilla: libwebp: Double-free in libwebp", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Matrix Security Team", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-28427", cwe: { id: "CWE-1321", name: "Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')", }, discovery_date: "2023-03-28T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2183278", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nThunderbird users who use the Matrix chat protocol were vulnerable to a denial-of-service attack.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Matrix SDK bundled with Thunderbird vulnerable to denial-of-service attack", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.src", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-28427", }, { category: "external", summary: "RHBZ#2183278", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2183278", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-28427", url: "https://www.cve.org/CVERecord?id=CVE-2023-28427", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-28427", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-28427", }, { category: "external", summary: "https://github.com/matrix-org/matrix-js-sdk/security/advisories/GHSA-mwq8-fjpf-c2gr", url: "https://github.com/matrix-org/matrix-js-sdk/security/advisories/GHSA-mwq8-fjpf-c2gr", }, { category: "external", summary: "https://matrix.org/blog/2023/03/28/security-releases-matrix-js-sdk-24-0-0-and-matrix-react-sdk-3-69-0", url: "https://matrix.org/blog/2023/03/28/security-releases-matrix-js-sdk-24-0-0-and-matrix-react-sdk-3-69-0", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-12/#CVE-2023-28427", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-12/#CVE-2023-28427", }, ], release_date: "2023-03-28T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T14:01:57+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.src", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1802", }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 7.5, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.src", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "Mozilla: Matrix SDK bundled with Thunderbird vulnerable to denial-of-service attack", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Ribose RNP Team", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29479", cwe: { id: "CWE-400", name: "Uncontrolled Resource Consumption", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186735", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nCertain malformed OpenPGP messages could trigger incorrect parsing of PKESK/SKESK packets due to a bug in the Ribose RNP library used by Thunderbird up to version 102.9.1, which would cause the Thunderbird user interface to hang. The issue was discovered using Google's oss-fuzz.", title: "Vulnerability description", }, { category: "summary", text: "Thunderbird: Hang when processing certain OpenPGP messages", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.src", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29479", }, { category: "external", summary: "RHBZ#2186735", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186735", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29479", url: "https://www.cve.org/CVERecord?id=CVE-2023-29479", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29479", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29479", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-15/#CVE-2023-29479", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-15/#CVE-2023-29479", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T14:01:57+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.src", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1802", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 6.5, baseSeverity: "MEDIUM", confidentialityImpact: "NONE", integrityImpact: "NONE", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", version: "3.1", }, products: [ "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.src", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "Thunderbird: Hang when processing certain OpenPGP messages", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Irvan Kurniawan", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29533", cwe: { id: "CWE-425", name: "Direct Request ('Forced Browsing')", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186101", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nA website could have obscured the fullscreen notification by using a combination of `window.open`, fullscreen requests, `window.name` assignments, and `setInterval` calls. This could have led to user confusion and possible spoofing attacks.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Fullscreen notification obscured", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.src", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29533", }, { category: "external", summary: "RHBZ#2186101", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186101", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29533", url: "https://www.cve.org/CVERecord?id=CVE-2023-29533", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29533", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29533", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29533", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29533", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T14:01:57+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.src", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1802", }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 7.5, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.src", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "Mozilla: Fullscreen notification obscured", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Lukas Bernhard", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29535", cwe: { id: "CWE-119", name: "Improper Restriction of Operations within the Bounds of a Memory Buffer", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186103", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nFollowing a Garbage Collector compaction, weak maps may have been accessed before they were correctly traced. This resulted in memory corruption and a potentially exploitable crash.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Potential Memory Corruption following Garbage Collector compaction", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.src", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29535", }, { category: "external", summary: "RHBZ#2186103", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186103", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29535", url: "https://www.cve.org/CVERecord?id=CVE-2023-29535", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29535", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29535", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29535", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29535", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T14:01:57+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.src", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1802", }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 7.5, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.src", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "Mozilla: Potential Memory Corruption following Garbage Collector compaction", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "zx from qriousec", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29536", cwe: { id: "CWE-617", name: "Reachable Assertion", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186104", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nAn attacker could cause the memory manager to incorrectly free a pointer that addresses attacker-controlled memory, resulting in an assertion, memory corruption, or a potentially exploitable crash.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Invalid free from JavaScript code", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.src", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29536", }, { category: "external", summary: "RHBZ#2186104", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186104", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29536", url: "https://www.cve.org/CVERecord?id=CVE-2023-29536", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29536", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29536", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29536", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29536", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T14:01:57+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.src", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1802", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 8.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.src", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "Mozilla: Invalid free from JavaScript code", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Trung Pham", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29539", cwe: { id: "CWE-159", name: "Improper Handling of Invalid Use of Special Elements", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186105", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nWhen handling the filename directive in the Content-Disposition header, the filename would be truncated if the filename contained a NULL character. This could have led to reflected file download attacks potentially tricking users to install malware.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Content-Disposition filename truncation leads to Reflected File Download", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.src", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29539", }, { category: "external", summary: "RHBZ#2186105", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186105", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29539", url: "https://www.cve.org/CVERecord?id=CVE-2023-29539", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29539", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29539", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29539", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29539", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T14:01:57+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.src", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1802", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 8.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.src", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "Mozilla: Content-Disposition filename truncation leads to Reflected File Download", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Ameen Basha M K", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29541", cwe: { id: "CWE-434", name: "Unrestricted Upload of File with Dangerous Type", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186106", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nFirefox did not properly handle downloads of files ending in `.desktop`, which can be interpreted to run attacker-controlled commands.\r\n\r\n*This bug only affects Firefox for Linux on certain Distributions. Other operating systems are unaffected, and Mozilla is unable to enumerate all affected Linux Distributions.*", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Files with malicious extensions could have been downloaded unsafely on Linux", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.src", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29541", }, { category: "external", summary: "RHBZ#2186106", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186106", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29541", url: "https://www.cve.org/CVERecord?id=CVE-2023-29541", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29541", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29541", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29541", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29541", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T14:01:57+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.src", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1802", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 8.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.src", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "Mozilla: Files with malicious extensions could have been downloaded unsafely on Linux", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "JunYoung Park", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29548", cwe: { id: "CWE-682", name: "Incorrect Calculation", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186110", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nA wrong lowering instruction in the ARM64 Ion compiler resulted in a wrong optimization result.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Incorrect optimization result on ARM64", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.src", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29548", }, { category: "external", summary: "RHBZ#2186110", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186110", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29548", url: "https://www.cve.org/CVERecord?id=CVE-2023-29548", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29548", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29548", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29548", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29548", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T14:01:57+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.src", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1802", }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "NONE", baseScore: 3.4, baseSeverity: "LOW", confidentialityImpact: "NONE", integrityImpact: "LOW", privilegesRequired: "NONE", scope: "CHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:N", version: "3.1", }, products: [ "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.src", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.x86_64", ], }, ], threats: [ { category: "impact", details: "Low", }, ], title: "Mozilla: Incorrect optimization result on ARM64", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Mozilla developers and community", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29550", cwe: { id: "CWE-120", name: "Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186111", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nMozilla developers Andrew Osmond, Sebastian Hengst, Andrew McCreight, and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 111 and Firefox ESR 102.9. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Memory safety bugs fixed in Firefox 112 and Firefox ESR 102.10", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.src", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29550", }, { category: "external", summary: "RHBZ#2186111", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186111", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29550", url: "https://www.cve.org/CVERecord?id=CVE-2023-29550", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29550", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29550", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29550", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29550", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T14:01:57+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.src", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1802", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 8.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.src", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "Mozilla: Memory safety bugs fixed in Firefox 112 and Firefox ESR 102.10", }, ], }
rhsa-2023:1811
Vulnerability from csaf_redhat
Published
2023-04-17 14:15
Modified
2024-12-16 05:26
Summary
Red Hat Security Advisory: thunderbird security update
Notes
Topic
An update for thunderbird is now available for Red Hat Enterprise Linux 8.6 Extended Update Support.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Mozilla Thunderbird is a standalone mail and newsgroup client.
This update upgrades Thunderbird to version 102.10.0.
Security Fix(es):
* Thunderbird: Revocation status of S/Mime recipient certificates was not checked (CVE-2023-0547)
* Mozilla: Matrix SDK bundled with Thunderbird vulnerable to denial-of-service attack (CVE-2023-28427)
* Mozilla: Fullscreen notification obscured (CVE-2023-29533)
* Mozilla: Potential Memory Corruption following Garbage Collector compaction (CVE-2023-29535)
* Mozilla: Invalid free from JavaScript code (CVE-2023-29536)
* Mozilla: Memory safety bugs fixed in Firefox 112 and Firefox ESR 102.10 (CVE-2023-29550)
* Mozilla: Memory Corruption in Safe Browsing Code (CVE-2023-1945)
* Thunderbird: Hang when processing certain OpenPGP messages (CVE-2023-29479)
* Mozilla: Content-Disposition filename truncation leads to Reflected File Download (CVE-2023-29539)
* Mozilla: Files with malicious extensions could have been downloaded unsafely on Linux (CVE-2023-29541)
* Mozilla: Incorrect optimization result on ARM64 (CVE-2023-29548)
* MFSA-TMP-2023-0001 Mozilla: Double-free in libwebp (BZ#2186102)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ document: { aggregate_severity: { namespace: "https://access.redhat.com/security/updates/classification/", text: "Important", }, category: "csaf_security_advisory", csaf_version: "2.0", distribution: { text: "Copyright © Red Hat, Inc. All rights reserved.", tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "en", notes: [ { category: "summary", text: "An update for thunderbird is now available for Red Hat Enterprise Linux 8.6 Extended Update Support.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", title: "Topic", }, { category: "general", text: "Mozilla Thunderbird is a standalone mail and newsgroup client.\n\nThis update upgrades Thunderbird to version 102.10.0.\n\nSecurity Fix(es):\n\n* Thunderbird: Revocation status of S/Mime recipient certificates was not checked (CVE-2023-0547)\n\n* Mozilla: Matrix SDK bundled with Thunderbird vulnerable to denial-of-service attack (CVE-2023-28427)\n\n* Mozilla: Fullscreen notification obscured (CVE-2023-29533)\n\n* Mozilla: Potential Memory Corruption following Garbage Collector compaction (CVE-2023-29535)\n\n* Mozilla: Invalid free from JavaScript code (CVE-2023-29536)\n\n* Mozilla: Memory safety bugs fixed in Firefox 112 and Firefox ESR 102.10 (CVE-2023-29550)\n\n* Mozilla: Memory Corruption in Safe Browsing Code (CVE-2023-1945)\n\n* Thunderbird: Hang when processing certain OpenPGP messages (CVE-2023-29479)\n\n* Mozilla: Content-Disposition filename truncation leads to Reflected File Download (CVE-2023-29539)\n\n* Mozilla: Files with malicious extensions could have been downloaded unsafely on Linux (CVE-2023-29541)\n\n* Mozilla: Incorrect optimization result on ARM64 (CVE-2023-29548)\n\n* MFSA-TMP-2023-0001 Mozilla: Double-free in libwebp (BZ#2186102)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", title: "Details", }, { category: "legal_disclaimer", text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", title: "Terms of Use", }, ], publisher: { category: "vendor", contact_details: "https://access.redhat.com/security/team/contact/", issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", name: "Red Hat Product Security", namespace: "https://www.redhat.com", }, references: [ { category: "self", summary: "https://access.redhat.com/errata/RHSA-2023:1811", url: "https://access.redhat.com/errata/RHSA-2023:1811", }, { category: "external", summary: "https://access.redhat.com/security/updates/classification/#important", url: "https://access.redhat.com/security/updates/classification/#important", }, { category: "external", summary: "2183278", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2183278", }, { category: "external", summary: "2186101", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186101", }, { category: "external", summary: "2186102", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186102", }, { category: "external", summary: "2186103", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186103", }, { category: "external", summary: "2186104", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186104", }, { category: "external", summary: "2186105", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186105", }, { category: "external", summary: "2186106", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186106", }, { category: "external", summary: "2186109", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186109", }, { category: "external", summary: "2186110", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186110", }, { category: "external", summary: "2186111", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186111", }, { category: "external", summary: "2186734", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186734", }, { category: "external", summary: "2186735", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186735", }, { category: "self", summary: "Canonical URL", url: "https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_1811.json", }, ], title: "Red Hat Security Advisory: thunderbird security update", tracking: { current_release_date: "2024-12-16T05:26:55+00:00", generator: { date: "2024-12-16T05:26:55+00:00", engine: { name: "Red Hat SDEngine", version: "4.2.3", }, }, id: "RHSA-2023:1811", initial_release_date: "2023-04-17T14:15:32+00:00", revision_history: [ { date: "2023-04-17T14:15:32+00:00", number: "1", summary: "Initial version", }, { date: "2023-04-17T14:15:32+00:00", number: "2", summary: "Last updated version", }, { date: "2024-12-16T05:26:55+00:00", number: "3", summary: "Last generated version", }, ], status: "final", version: "3", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_name", name: "Red Hat Enterprise Linux AppStream EUS (v.8.6)", product: { name: "Red Hat Enterprise Linux AppStream EUS (v.8.6)", product_id: "AppStream-8.6.0.Z.EUS", product_identification_helper: { cpe: "cpe:/a:redhat:rhel_eus:8.6::appstream", }, }, }, ], category: "product_family", name: "Red Hat Enterprise Linux", }, { branches: [ { category: "product_version", name: "thunderbird-0:102.10.0-2.el8_6.src", product: { name: "thunderbird-0:102.10.0-2.el8_6.src", product_id: "thunderbird-0:102.10.0-2.el8_6.src", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird@102.10.0-2.el8_6?arch=src", }, }, }, ], category: "architecture", name: "src", }, { branches: [ { category: "product_version", name: "thunderbird-0:102.10.0-2.el8_6.aarch64", product: { name: "thunderbird-0:102.10.0-2.el8_6.aarch64", product_id: "thunderbird-0:102.10.0-2.el8_6.aarch64", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird@102.10.0-2.el8_6?arch=aarch64", }, }, }, { category: "product_version", name: "thunderbird-debugsource-0:102.10.0-2.el8_6.aarch64", product: { name: "thunderbird-debugsource-0:102.10.0-2.el8_6.aarch64", product_id: "thunderbird-debugsource-0:102.10.0-2.el8_6.aarch64", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird-debugsource@102.10.0-2.el8_6?arch=aarch64", }, }, }, { category: "product_version", name: "thunderbird-debuginfo-0:102.10.0-2.el8_6.aarch64", product: { name: "thunderbird-debuginfo-0:102.10.0-2.el8_6.aarch64", product_id: "thunderbird-debuginfo-0:102.10.0-2.el8_6.aarch64", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird-debuginfo@102.10.0-2.el8_6?arch=aarch64", }, }, }, ], category: "architecture", name: "aarch64", }, { branches: [ { category: "product_version", name: "thunderbird-0:102.10.0-2.el8_6.ppc64le", product: { name: "thunderbird-0:102.10.0-2.el8_6.ppc64le", product_id: "thunderbird-0:102.10.0-2.el8_6.ppc64le", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird@102.10.0-2.el8_6?arch=ppc64le", }, }, }, { category: "product_version", name: "thunderbird-debugsource-0:102.10.0-2.el8_6.ppc64le", product: { name: "thunderbird-debugsource-0:102.10.0-2.el8_6.ppc64le", product_id: "thunderbird-debugsource-0:102.10.0-2.el8_6.ppc64le", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird-debugsource@102.10.0-2.el8_6?arch=ppc64le", }, }, }, { category: "product_version", name: "thunderbird-debuginfo-0:102.10.0-2.el8_6.ppc64le", product: { name: "thunderbird-debuginfo-0:102.10.0-2.el8_6.ppc64le", product_id: "thunderbird-debuginfo-0:102.10.0-2.el8_6.ppc64le", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird-debuginfo@102.10.0-2.el8_6?arch=ppc64le", }, }, }, ], category: "architecture", name: "ppc64le", }, { branches: [ { category: "product_version", name: "thunderbird-0:102.10.0-2.el8_6.x86_64", product: { name: "thunderbird-0:102.10.0-2.el8_6.x86_64", product_id: "thunderbird-0:102.10.0-2.el8_6.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird@102.10.0-2.el8_6?arch=x86_64", }, }, }, { category: "product_version", name: "thunderbird-debugsource-0:102.10.0-2.el8_6.x86_64", product: { name: "thunderbird-debugsource-0:102.10.0-2.el8_6.x86_64", product_id: "thunderbird-debugsource-0:102.10.0-2.el8_6.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird-debugsource@102.10.0-2.el8_6?arch=x86_64", }, }, }, { category: "product_version", name: "thunderbird-debuginfo-0:102.10.0-2.el8_6.x86_64", product: { name: "thunderbird-debuginfo-0:102.10.0-2.el8_6.x86_64", product_id: "thunderbird-debuginfo-0:102.10.0-2.el8_6.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird-debuginfo@102.10.0-2.el8_6?arch=x86_64", }, }, }, ], category: "architecture", name: "x86_64", }, { branches: [ { category: "product_version", name: "thunderbird-0:102.10.0-2.el8_6.s390x", product: { name: "thunderbird-0:102.10.0-2.el8_6.s390x", product_id: "thunderbird-0:102.10.0-2.el8_6.s390x", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird@102.10.0-2.el8_6?arch=s390x", }, }, }, { category: "product_version", name: "thunderbird-debugsource-0:102.10.0-2.el8_6.s390x", product: { name: "thunderbird-debugsource-0:102.10.0-2.el8_6.s390x", product_id: "thunderbird-debugsource-0:102.10.0-2.el8_6.s390x", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird-debugsource@102.10.0-2.el8_6?arch=s390x", }, }, }, { category: "product_version", name: "thunderbird-debuginfo-0:102.10.0-2.el8_6.s390x", product: { name: "thunderbird-debuginfo-0:102.10.0-2.el8_6.s390x", product_id: "thunderbird-debuginfo-0:102.10.0-2.el8_6.s390x", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird-debuginfo@102.10.0-2.el8_6?arch=s390x", }, }, }, ], category: "architecture", name: "s390x", }, ], category: "vendor", name: "Red Hat", }, ], relationships: [ { category: "default_component_of", full_product_name: { name: "thunderbird-0:102.10.0-2.el8_6.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", product_id: "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.aarch64", }, product_reference: "thunderbird-0:102.10.0-2.el8_6.aarch64", relates_to_product_reference: "AppStream-8.6.0.Z.EUS", }, { category: "default_component_of", full_product_name: { name: "thunderbird-0:102.10.0-2.el8_6.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", product_id: "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.ppc64le", }, product_reference: "thunderbird-0:102.10.0-2.el8_6.ppc64le", relates_to_product_reference: "AppStream-8.6.0.Z.EUS", }, { category: "default_component_of", full_product_name: { name: "thunderbird-0:102.10.0-2.el8_6.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", product_id: "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.s390x", }, product_reference: "thunderbird-0:102.10.0-2.el8_6.s390x", relates_to_product_reference: "AppStream-8.6.0.Z.EUS", }, { category: "default_component_of", full_product_name: { name: "thunderbird-0:102.10.0-2.el8_6.src as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", product_id: "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.src", }, product_reference: "thunderbird-0:102.10.0-2.el8_6.src", relates_to_product_reference: "AppStream-8.6.0.Z.EUS", }, { category: "default_component_of", full_product_name: { name: "thunderbird-0:102.10.0-2.el8_6.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", product_id: "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.x86_64", }, product_reference: "thunderbird-0:102.10.0-2.el8_6.x86_64", relates_to_product_reference: "AppStream-8.6.0.Z.EUS", }, { category: "default_component_of", full_product_name: { name: "thunderbird-debuginfo-0:102.10.0-2.el8_6.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", product_id: "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.aarch64", }, product_reference: "thunderbird-debuginfo-0:102.10.0-2.el8_6.aarch64", relates_to_product_reference: "AppStream-8.6.0.Z.EUS", }, { category: "default_component_of", full_product_name: { name: "thunderbird-debuginfo-0:102.10.0-2.el8_6.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", product_id: "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.ppc64le", }, product_reference: "thunderbird-debuginfo-0:102.10.0-2.el8_6.ppc64le", relates_to_product_reference: "AppStream-8.6.0.Z.EUS", }, { category: "default_component_of", full_product_name: { name: "thunderbird-debuginfo-0:102.10.0-2.el8_6.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", product_id: "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.s390x", }, product_reference: "thunderbird-debuginfo-0:102.10.0-2.el8_6.s390x", relates_to_product_reference: "AppStream-8.6.0.Z.EUS", }, { category: "default_component_of", full_product_name: { name: "thunderbird-debuginfo-0:102.10.0-2.el8_6.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", product_id: "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.x86_64", }, product_reference: "thunderbird-debuginfo-0:102.10.0-2.el8_6.x86_64", relates_to_product_reference: "AppStream-8.6.0.Z.EUS", }, { category: "default_component_of", full_product_name: { name: "thunderbird-debugsource-0:102.10.0-2.el8_6.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", product_id: "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.aarch64", }, product_reference: "thunderbird-debugsource-0:102.10.0-2.el8_6.aarch64", relates_to_product_reference: "AppStream-8.6.0.Z.EUS", }, { category: "default_component_of", full_product_name: { name: "thunderbird-debugsource-0:102.10.0-2.el8_6.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", product_id: "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.ppc64le", }, product_reference: "thunderbird-debugsource-0:102.10.0-2.el8_6.ppc64le", relates_to_product_reference: "AppStream-8.6.0.Z.EUS", }, { category: "default_component_of", full_product_name: { name: "thunderbird-debugsource-0:102.10.0-2.el8_6.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", product_id: "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.s390x", }, product_reference: "thunderbird-debugsource-0:102.10.0-2.el8_6.s390x", relates_to_product_reference: "AppStream-8.6.0.Z.EUS", }, { category: "default_component_of", full_product_name: { name: "thunderbird-debugsource-0:102.10.0-2.el8_6.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", product_id: "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.x86_64", }, product_reference: "thunderbird-debugsource-0:102.10.0-2.el8_6.x86_64", relates_to_product_reference: "AppStream-8.6.0.Z.EUS", }, ], }, vulnerabilities: [ { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Paul Menzel", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-0547", cwe: { id: "CWE-356", name: "Product UI does not Warn User of Unsafe Actions", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186734", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nOCSP revocation status of recipient certificates was not checked when sending S/Mime encrypted email, and revoked certificates would be accepted. Thunderbird versions from 68 to 102.9.1 were affected by this bug.", title: "Vulnerability description", }, { category: "summary", text: "Thunderbird: Revocation status of S/Mime recipient certificates was not checked", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.src", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-0547", }, { category: "external", summary: "RHBZ#2186734", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186734", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-0547", url: "https://www.cve.org/CVERecord?id=CVE-2023-0547", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-0547", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-0547", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-15/#CVE-2023-0547", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-15/#CVE-2023-0547", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T14:15:32+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.src", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1811", }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 7.5, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.src", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "Thunderbird: Revocation status of S/Mime recipient certificates was not checked", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Gabriele Svelto", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-1945", cwe: { id: "CWE-119", name: "Improper Restriction of Operations within the Bounds of a Memory Buffer", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186109", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nUnexpected data returned from the Safe Browsing API could have led to memory corruption and a potentially exploitable crash.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Memory Corruption in Safe Browsing Code", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.src", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-1945", }, { category: "external", summary: "RHBZ#2186109", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186109", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-1945", url: "https://www.cve.org/CVERecord?id=CVE-2023-1945", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-1945", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-1945", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-1945", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-1945", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T14:15:32+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.src", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1811", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "NONE", baseScore: 6.1, baseSeverity: "MEDIUM", confidentialityImpact: "LOW", integrityImpact: "LOW", privilegesRequired: "NONE", scope: "CHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", version: "3.1", }, products: [ "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.src", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "Mozilla: Memory Corruption in Safe Browsing Code", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Irvan Kurniawan", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-1999", cwe: { id: "CWE-415", name: "Double Free", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186102", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nA double-free in libwebp could have led to memory corruption and a potentially exploitable crash.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: libwebp: Double-free in libwebp", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.src", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-1999", }, { category: "external", summary: "RHBZ#2186102", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186102", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-1999", url: "https://www.cve.org/CVERecord?id=CVE-2023-1999", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-1999", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-1999", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-1999", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-1999", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-15/#CVE-2023-1999", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-15/#CVE-2023-1999", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T14:15:32+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.src", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1811", }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 7.5, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.src", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "Mozilla: libwebp: Double-free in libwebp", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Matrix Security Team", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-28427", cwe: { id: "CWE-1321", name: "Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')", }, discovery_date: "2023-03-28T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2183278", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nThunderbird users who use the Matrix chat protocol were vulnerable to a denial-of-service attack.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Matrix SDK bundled with Thunderbird vulnerable to denial-of-service attack", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.src", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-28427", }, { category: "external", summary: "RHBZ#2183278", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2183278", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-28427", url: "https://www.cve.org/CVERecord?id=CVE-2023-28427", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-28427", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-28427", }, { category: "external", summary: "https://github.com/matrix-org/matrix-js-sdk/security/advisories/GHSA-mwq8-fjpf-c2gr", url: "https://github.com/matrix-org/matrix-js-sdk/security/advisories/GHSA-mwq8-fjpf-c2gr", }, { category: "external", summary: "https://matrix.org/blog/2023/03/28/security-releases-matrix-js-sdk-24-0-0-and-matrix-react-sdk-3-69-0", url: "https://matrix.org/blog/2023/03/28/security-releases-matrix-js-sdk-24-0-0-and-matrix-react-sdk-3-69-0", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-12/#CVE-2023-28427", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-12/#CVE-2023-28427", }, ], release_date: "2023-03-28T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T14:15:32+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.src", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1811", }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 7.5, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.src", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "Mozilla: Matrix SDK bundled with Thunderbird vulnerable to denial-of-service attack", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Ribose RNP Team", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29479", cwe: { id: "CWE-400", name: "Uncontrolled Resource Consumption", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186735", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nCertain malformed OpenPGP messages could trigger incorrect parsing of PKESK/SKESK packets due to a bug in the Ribose RNP library used by Thunderbird up to version 102.9.1, which would cause the Thunderbird user interface to hang. The issue was discovered using Google's oss-fuzz.", title: "Vulnerability description", }, { category: "summary", text: "Thunderbird: Hang when processing certain OpenPGP messages", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.src", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29479", }, { category: "external", summary: "RHBZ#2186735", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186735", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29479", url: "https://www.cve.org/CVERecord?id=CVE-2023-29479", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29479", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29479", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-15/#CVE-2023-29479", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-15/#CVE-2023-29479", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T14:15:32+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.src", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1811", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 6.5, baseSeverity: "MEDIUM", confidentialityImpact: "NONE", integrityImpact: "NONE", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", version: "3.1", }, products: [ "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.src", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "Thunderbird: Hang when processing certain OpenPGP messages", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Irvan Kurniawan", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29533", cwe: { id: "CWE-425", name: "Direct Request ('Forced Browsing')", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186101", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nA website could have obscured the fullscreen notification by using a combination of `window.open`, fullscreen requests, `window.name` assignments, and `setInterval` calls. This could have led to user confusion and possible spoofing attacks.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Fullscreen notification obscured", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.src", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29533", }, { category: "external", summary: "RHBZ#2186101", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186101", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29533", url: "https://www.cve.org/CVERecord?id=CVE-2023-29533", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29533", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29533", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29533", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29533", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T14:15:32+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.src", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1811", }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 7.5, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.src", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "Mozilla: Fullscreen notification obscured", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Lukas Bernhard", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29535", cwe: { id: "CWE-119", name: "Improper Restriction of Operations within the Bounds of a Memory Buffer", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186103", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nFollowing a Garbage Collector compaction, weak maps may have been accessed before they were correctly traced. This resulted in memory corruption and a potentially exploitable crash.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Potential Memory Corruption following Garbage Collector compaction", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.src", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29535", }, { category: "external", summary: "RHBZ#2186103", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186103", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29535", url: "https://www.cve.org/CVERecord?id=CVE-2023-29535", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29535", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29535", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29535", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29535", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T14:15:32+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.src", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1811", }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 7.5, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.src", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "Mozilla: Potential Memory Corruption following Garbage Collector compaction", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "zx from qriousec", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29536", cwe: { id: "CWE-617", name: "Reachable Assertion", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186104", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nAn attacker could cause the memory manager to incorrectly free a pointer that addresses attacker-controlled memory, resulting in an assertion, memory corruption, or a potentially exploitable crash.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Invalid free from JavaScript code", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.src", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29536", }, { category: "external", summary: "RHBZ#2186104", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186104", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29536", url: "https://www.cve.org/CVERecord?id=CVE-2023-29536", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29536", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29536", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29536", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29536", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T14:15:32+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.src", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1811", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 8.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.src", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "Mozilla: Invalid free from JavaScript code", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Trung Pham", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29539", cwe: { id: "CWE-159", name: "Improper Handling of Invalid Use of Special Elements", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186105", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nWhen handling the filename directive in the Content-Disposition header, the filename would be truncated if the filename contained a NULL character. This could have led to reflected file download attacks potentially tricking users to install malware.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Content-Disposition filename truncation leads to Reflected File Download", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.src", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29539", }, { category: "external", summary: "RHBZ#2186105", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186105", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29539", url: "https://www.cve.org/CVERecord?id=CVE-2023-29539", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29539", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29539", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29539", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29539", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T14:15:32+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.src", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1811", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 8.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.src", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "Mozilla: Content-Disposition filename truncation leads to Reflected File Download", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Ameen Basha M K", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29541", cwe: { id: "CWE-434", name: "Unrestricted Upload of File with Dangerous Type", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186106", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nFirefox did not properly handle downloads of files ending in `.desktop`, which can be interpreted to run attacker-controlled commands.\r\n\r\n*This bug only affects Firefox for Linux on certain Distributions. Other operating systems are unaffected, and Mozilla is unable to enumerate all affected Linux Distributions.*", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Files with malicious extensions could have been downloaded unsafely on Linux", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.src", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29541", }, { category: "external", summary: "RHBZ#2186106", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186106", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29541", url: "https://www.cve.org/CVERecord?id=CVE-2023-29541", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29541", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29541", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29541", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29541", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T14:15:32+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.src", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1811", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 8.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.src", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "Mozilla: Files with malicious extensions could have been downloaded unsafely on Linux", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "JunYoung Park", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29548", cwe: { id: "CWE-682", name: "Incorrect Calculation", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186110", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nA wrong lowering instruction in the ARM64 Ion compiler resulted in a wrong optimization result.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Incorrect optimization result on ARM64", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.src", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29548", }, { category: "external", summary: "RHBZ#2186110", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186110", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29548", url: "https://www.cve.org/CVERecord?id=CVE-2023-29548", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29548", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29548", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29548", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29548", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T14:15:32+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.src", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1811", }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "NONE", baseScore: 3.4, baseSeverity: "LOW", confidentialityImpact: "NONE", integrityImpact: "LOW", privilegesRequired: "NONE", scope: "CHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:N", version: "3.1", }, products: [ "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.src", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.x86_64", ], }, ], threats: [ { category: "impact", details: "Low", }, ], title: "Mozilla: Incorrect optimization result on ARM64", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Mozilla developers and community", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29550", cwe: { id: "CWE-120", name: "Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186111", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nMozilla developers Andrew Osmond, Sebastian Hengst, Andrew McCreight, and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 111 and Firefox ESR 102.9. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Memory safety bugs fixed in Firefox 112 and Firefox ESR 102.10", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.src", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29550", }, { category: "external", summary: "RHBZ#2186111", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186111", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29550", url: "https://www.cve.org/CVERecord?id=CVE-2023-29550", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29550", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29550", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29550", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29550", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T14:15:32+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.src", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1811", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 8.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.src", "AppStream-8.6.0.Z.EUS:thunderbird-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.s390x", "AppStream-8.6.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_6.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "Mozilla: Memory safety bugs fixed in Firefox 112 and Firefox ESR 102.10", }, ], }
rhsa-2023:1804
Vulnerability from csaf_redhat
Published
2023-04-17 14:04
Modified
2024-12-16 05:26
Summary
Red Hat Security Advisory: thunderbird security update
Notes
Topic
An update for thunderbird is now available for Red Hat Enterprise Linux 8.4 Extended Update Support.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Mozilla Thunderbird is a standalone mail and newsgroup client.
This update upgrades Thunderbird to version 102.10.0.
Security Fix(es):
* Thunderbird: Revocation status of S/Mime recipient certificates was not checked (CVE-2023-0547)
* Mozilla: Matrix SDK bundled with Thunderbird vulnerable to denial-of-service attack (CVE-2023-28427)
* Mozilla: Fullscreen notification obscured (CVE-2023-29533)
* Mozilla: Potential Memory Corruption following Garbage Collector compaction (CVE-2023-29535)
* Mozilla: Invalid free from JavaScript code (CVE-2023-29536)
* Mozilla: Memory safety bugs fixed in Firefox 112 and Firefox ESR 102.10 (CVE-2023-29550)
* Mozilla: Memory Corruption in Safe Browsing Code (CVE-2023-1945)
* Thunderbird: Hang when processing certain OpenPGP messages (CVE-2023-29479)
* Mozilla: Content-Disposition filename truncation leads to Reflected File Download (CVE-2023-29539)
* Mozilla: Files with malicious extensions could have been downloaded unsafely on Linux (CVE-2023-29541)
* Mozilla: Incorrect optimization result on ARM64 (CVE-2023-29548)
* MFSA-TMP-2023-0001 Mozilla: Double-free in libwebp (BZ#2186102)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ document: { aggregate_severity: { namespace: "https://access.redhat.com/security/updates/classification/", text: "Important", }, category: "csaf_security_advisory", csaf_version: "2.0", distribution: { text: "Copyright © Red Hat, Inc. All rights reserved.", tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "en", notes: [ { category: "summary", text: "An update for thunderbird is now available for Red Hat Enterprise Linux 8.4 Extended Update Support.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", title: "Topic", }, { category: "general", text: "Mozilla Thunderbird is a standalone mail and newsgroup client.\n\nThis update upgrades Thunderbird to version 102.10.0.\n\nSecurity Fix(es):\n\n* Thunderbird: Revocation status of S/Mime recipient certificates was not checked (CVE-2023-0547)\n\n* Mozilla: Matrix SDK bundled with Thunderbird vulnerable to denial-of-service attack (CVE-2023-28427)\n\n* Mozilla: Fullscreen notification obscured (CVE-2023-29533)\n\n* Mozilla: Potential Memory Corruption following Garbage Collector compaction (CVE-2023-29535)\n\n* Mozilla: Invalid free from JavaScript code (CVE-2023-29536)\n\n* Mozilla: Memory safety bugs fixed in Firefox 112 and Firefox ESR 102.10 (CVE-2023-29550)\n\n* Mozilla: Memory Corruption in Safe Browsing Code (CVE-2023-1945)\n\n* Thunderbird: Hang when processing certain OpenPGP messages (CVE-2023-29479)\n\n* Mozilla: Content-Disposition filename truncation leads to Reflected File Download (CVE-2023-29539)\n\n* Mozilla: Files with malicious extensions could have been downloaded unsafely on Linux (CVE-2023-29541)\n\n* Mozilla: Incorrect optimization result on ARM64 (CVE-2023-29548)\n\n* MFSA-TMP-2023-0001 Mozilla: Double-free in libwebp (BZ#2186102)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", title: "Details", }, { category: "legal_disclaimer", text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", title: "Terms of Use", }, ], publisher: { category: "vendor", contact_details: "https://access.redhat.com/security/team/contact/", issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", name: "Red Hat Product Security", namespace: "https://www.redhat.com", }, references: [ { category: "self", summary: "https://access.redhat.com/errata/RHSA-2023:1804", url: "https://access.redhat.com/errata/RHSA-2023:1804", }, { category: "external", summary: "https://access.redhat.com/security/updates/classification/#important", url: "https://access.redhat.com/security/updates/classification/#important", }, { category: "external", summary: "2183278", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2183278", }, { category: "external", summary: "2186101", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186101", }, { category: "external", summary: "2186102", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186102", }, { category: "external", summary: "2186103", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186103", }, { category: "external", summary: "2186104", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186104", }, { category: "external", summary: "2186105", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186105", }, { category: "external", summary: "2186106", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186106", }, { category: "external", summary: "2186109", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186109", }, { category: "external", summary: "2186110", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186110", }, { category: "external", summary: "2186111", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186111", }, { category: "external", summary: "2186734", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186734", }, { category: "external", summary: "2186735", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186735", }, { category: "self", summary: "Canonical URL", url: "https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_1804.json", }, ], title: "Red Hat Security Advisory: thunderbird security update", tracking: { current_release_date: "2024-12-16T05:26:46+00:00", generator: { date: "2024-12-16T05:26:46+00:00", engine: { name: "Red Hat SDEngine", version: "4.2.3", }, }, id: "RHSA-2023:1804", initial_release_date: "2023-04-17T14:04:25+00:00", revision_history: [ { date: "2023-04-17T14:04:25+00:00", number: "1", summary: "Initial version", }, { date: "2023-04-17T14:04:25+00:00", number: "2", summary: "Last updated version", }, { date: "2024-12-16T05:26:46+00:00", number: "3", summary: "Last generated version", }, ], status: "final", version: "3", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_name", name: "Red Hat Enterprise Linux AppStream EUS (v.8.4)", product: { name: "Red Hat Enterprise Linux AppStream EUS (v.8.4)", product_id: "AppStream-8.4.0.Z.EUS", product_identification_helper: { cpe: "cpe:/a:redhat:rhel_eus:8.4::appstream", }, }, }, ], category: "product_family", name: "Red Hat Enterprise Linux", }, { branches: [ { category: "product_version", name: "thunderbird-0:102.10.0-2.el8_4.src", product: { name: "thunderbird-0:102.10.0-2.el8_4.src", product_id: "thunderbird-0:102.10.0-2.el8_4.src", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird@102.10.0-2.el8_4?arch=src", }, }, }, ], category: "architecture", name: "src", }, { branches: [ { category: "product_version", name: "thunderbird-0:102.10.0-2.el8_4.aarch64", product: { name: "thunderbird-0:102.10.0-2.el8_4.aarch64", product_id: "thunderbird-0:102.10.0-2.el8_4.aarch64", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird@102.10.0-2.el8_4?arch=aarch64", }, }, }, { category: "product_version", name: "thunderbird-debugsource-0:102.10.0-2.el8_4.aarch64", product: { name: "thunderbird-debugsource-0:102.10.0-2.el8_4.aarch64", product_id: "thunderbird-debugsource-0:102.10.0-2.el8_4.aarch64", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird-debugsource@102.10.0-2.el8_4?arch=aarch64", }, }, }, { category: "product_version", name: "thunderbird-debuginfo-0:102.10.0-2.el8_4.aarch64", product: { name: "thunderbird-debuginfo-0:102.10.0-2.el8_4.aarch64", product_id: "thunderbird-debuginfo-0:102.10.0-2.el8_4.aarch64", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird-debuginfo@102.10.0-2.el8_4?arch=aarch64", }, }, }, ], category: "architecture", name: "aarch64", }, { branches: [ { category: "product_version", name: "thunderbird-0:102.10.0-2.el8_4.ppc64le", product: { name: "thunderbird-0:102.10.0-2.el8_4.ppc64le", product_id: "thunderbird-0:102.10.0-2.el8_4.ppc64le", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird@102.10.0-2.el8_4?arch=ppc64le", }, }, }, { category: "product_version", name: "thunderbird-debugsource-0:102.10.0-2.el8_4.ppc64le", product: { name: "thunderbird-debugsource-0:102.10.0-2.el8_4.ppc64le", product_id: "thunderbird-debugsource-0:102.10.0-2.el8_4.ppc64le", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird-debugsource@102.10.0-2.el8_4?arch=ppc64le", }, }, }, { category: "product_version", name: "thunderbird-debuginfo-0:102.10.0-2.el8_4.ppc64le", product: { name: "thunderbird-debuginfo-0:102.10.0-2.el8_4.ppc64le", product_id: "thunderbird-debuginfo-0:102.10.0-2.el8_4.ppc64le", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird-debuginfo@102.10.0-2.el8_4?arch=ppc64le", }, }, }, ], category: "architecture", name: "ppc64le", }, { branches: [ { category: "product_version", name: "thunderbird-0:102.10.0-2.el8_4.x86_64", product: { name: "thunderbird-0:102.10.0-2.el8_4.x86_64", product_id: "thunderbird-0:102.10.0-2.el8_4.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird@102.10.0-2.el8_4?arch=x86_64", }, }, }, { category: "product_version", name: "thunderbird-debugsource-0:102.10.0-2.el8_4.x86_64", product: { name: "thunderbird-debugsource-0:102.10.0-2.el8_4.x86_64", product_id: "thunderbird-debugsource-0:102.10.0-2.el8_4.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird-debugsource@102.10.0-2.el8_4?arch=x86_64", }, }, }, { category: "product_version", name: "thunderbird-debuginfo-0:102.10.0-2.el8_4.x86_64", product: { name: "thunderbird-debuginfo-0:102.10.0-2.el8_4.x86_64", product_id: "thunderbird-debuginfo-0:102.10.0-2.el8_4.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird-debuginfo@102.10.0-2.el8_4?arch=x86_64", }, }, }, ], category: "architecture", name: "x86_64", }, { branches: [ { category: "product_version", name: "thunderbird-0:102.10.0-2.el8_4.s390x", product: { name: "thunderbird-0:102.10.0-2.el8_4.s390x", product_id: "thunderbird-0:102.10.0-2.el8_4.s390x", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird@102.10.0-2.el8_4?arch=s390x", }, }, }, { category: "product_version", name: "thunderbird-debugsource-0:102.10.0-2.el8_4.s390x", product: { name: "thunderbird-debugsource-0:102.10.0-2.el8_4.s390x", product_id: "thunderbird-debugsource-0:102.10.0-2.el8_4.s390x", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird-debugsource@102.10.0-2.el8_4?arch=s390x", }, }, }, { category: "product_version", name: "thunderbird-debuginfo-0:102.10.0-2.el8_4.s390x", product: { name: "thunderbird-debuginfo-0:102.10.0-2.el8_4.s390x", product_id: "thunderbird-debuginfo-0:102.10.0-2.el8_4.s390x", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird-debuginfo@102.10.0-2.el8_4?arch=s390x", }, }, }, ], category: "architecture", name: "s390x", }, ], category: "vendor", name: "Red Hat", }, ], relationships: [ { category: "default_component_of", full_product_name: { name: "thunderbird-0:102.10.0-2.el8_4.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", product_id: "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.aarch64", }, product_reference: "thunderbird-0:102.10.0-2.el8_4.aarch64", relates_to_product_reference: "AppStream-8.4.0.Z.EUS", }, { category: "default_component_of", full_product_name: { name: "thunderbird-0:102.10.0-2.el8_4.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", product_id: "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.ppc64le", }, product_reference: "thunderbird-0:102.10.0-2.el8_4.ppc64le", relates_to_product_reference: "AppStream-8.4.0.Z.EUS", }, { category: "default_component_of", full_product_name: { name: "thunderbird-0:102.10.0-2.el8_4.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", product_id: "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.s390x", }, product_reference: "thunderbird-0:102.10.0-2.el8_4.s390x", relates_to_product_reference: "AppStream-8.4.0.Z.EUS", }, { category: "default_component_of", full_product_name: { name: "thunderbird-0:102.10.0-2.el8_4.src as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", product_id: "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.src", }, product_reference: "thunderbird-0:102.10.0-2.el8_4.src", relates_to_product_reference: "AppStream-8.4.0.Z.EUS", }, { category: "default_component_of", full_product_name: { name: "thunderbird-0:102.10.0-2.el8_4.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", product_id: "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.x86_64", }, product_reference: "thunderbird-0:102.10.0-2.el8_4.x86_64", relates_to_product_reference: "AppStream-8.4.0.Z.EUS", }, { category: "default_component_of", full_product_name: { name: "thunderbird-debuginfo-0:102.10.0-2.el8_4.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", product_id: "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.aarch64", }, product_reference: "thunderbird-debuginfo-0:102.10.0-2.el8_4.aarch64", relates_to_product_reference: "AppStream-8.4.0.Z.EUS", }, { category: "default_component_of", full_product_name: { name: "thunderbird-debuginfo-0:102.10.0-2.el8_4.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", product_id: "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.ppc64le", }, product_reference: "thunderbird-debuginfo-0:102.10.0-2.el8_4.ppc64le", relates_to_product_reference: "AppStream-8.4.0.Z.EUS", }, { category: "default_component_of", full_product_name: { name: "thunderbird-debuginfo-0:102.10.0-2.el8_4.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", product_id: "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.s390x", }, product_reference: "thunderbird-debuginfo-0:102.10.0-2.el8_4.s390x", relates_to_product_reference: "AppStream-8.4.0.Z.EUS", }, { category: "default_component_of", full_product_name: { name: "thunderbird-debuginfo-0:102.10.0-2.el8_4.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", product_id: "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.x86_64", }, product_reference: "thunderbird-debuginfo-0:102.10.0-2.el8_4.x86_64", relates_to_product_reference: "AppStream-8.4.0.Z.EUS", }, { category: "default_component_of", full_product_name: { name: "thunderbird-debugsource-0:102.10.0-2.el8_4.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", product_id: "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.aarch64", }, product_reference: "thunderbird-debugsource-0:102.10.0-2.el8_4.aarch64", relates_to_product_reference: "AppStream-8.4.0.Z.EUS", }, { category: "default_component_of", full_product_name: { name: "thunderbird-debugsource-0:102.10.0-2.el8_4.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", product_id: "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.ppc64le", }, product_reference: "thunderbird-debugsource-0:102.10.0-2.el8_4.ppc64le", relates_to_product_reference: "AppStream-8.4.0.Z.EUS", }, { category: "default_component_of", full_product_name: { name: "thunderbird-debugsource-0:102.10.0-2.el8_4.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", product_id: "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.s390x", }, product_reference: "thunderbird-debugsource-0:102.10.0-2.el8_4.s390x", relates_to_product_reference: "AppStream-8.4.0.Z.EUS", }, { category: "default_component_of", full_product_name: { name: "thunderbird-debugsource-0:102.10.0-2.el8_4.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", product_id: "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.x86_64", }, product_reference: "thunderbird-debugsource-0:102.10.0-2.el8_4.x86_64", relates_to_product_reference: "AppStream-8.4.0.Z.EUS", }, ], }, vulnerabilities: [ { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Paul Menzel", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-0547", cwe: { id: "CWE-356", name: "Product UI does not Warn User of Unsafe Actions", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186734", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nOCSP revocation status of recipient certificates was not checked when sending S/Mime encrypted email, and revoked certificates would be accepted. Thunderbird versions from 68 to 102.9.1 were affected by this bug.", title: "Vulnerability description", }, { category: "summary", text: "Thunderbird: Revocation status of S/Mime recipient certificates was not checked", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.src", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-0547", }, { category: "external", summary: "RHBZ#2186734", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186734", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-0547", url: "https://www.cve.org/CVERecord?id=CVE-2023-0547", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-0547", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-0547", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-15/#CVE-2023-0547", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-15/#CVE-2023-0547", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T14:04:25+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.src", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1804", }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 7.5, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.src", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "Thunderbird: Revocation status of S/Mime recipient certificates was not checked", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Gabriele Svelto", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-1945", cwe: { id: "CWE-119", name: "Improper Restriction of Operations within the Bounds of a Memory Buffer", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186109", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nUnexpected data returned from the Safe Browsing API could have led to memory corruption and a potentially exploitable crash.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Memory Corruption in Safe Browsing Code", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.src", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-1945", }, { category: "external", summary: "RHBZ#2186109", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186109", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-1945", url: "https://www.cve.org/CVERecord?id=CVE-2023-1945", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-1945", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-1945", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-1945", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-1945", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T14:04:25+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.src", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1804", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "NONE", baseScore: 6.1, baseSeverity: "MEDIUM", confidentialityImpact: "LOW", integrityImpact: "LOW", privilegesRequired: "NONE", scope: "CHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", version: "3.1", }, products: [ "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.src", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "Mozilla: Memory Corruption in Safe Browsing Code", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Irvan Kurniawan", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-1999", cwe: { id: "CWE-415", name: "Double Free", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186102", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nA double-free in libwebp could have led to memory corruption and a potentially exploitable crash.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: libwebp: Double-free in libwebp", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.src", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-1999", }, { category: "external", summary: "RHBZ#2186102", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186102", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-1999", url: "https://www.cve.org/CVERecord?id=CVE-2023-1999", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-1999", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-1999", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-1999", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-1999", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-15/#CVE-2023-1999", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-15/#CVE-2023-1999", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T14:04:25+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.src", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1804", }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 7.5, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.src", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "Mozilla: libwebp: Double-free in libwebp", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Matrix Security Team", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-28427", cwe: { id: "CWE-1321", name: "Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')", }, discovery_date: "2023-03-28T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2183278", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nThunderbird users who use the Matrix chat protocol were vulnerable to a denial-of-service attack.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Matrix SDK bundled with Thunderbird vulnerable to denial-of-service attack", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.src", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-28427", }, { category: "external", summary: "RHBZ#2183278", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2183278", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-28427", url: "https://www.cve.org/CVERecord?id=CVE-2023-28427", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-28427", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-28427", }, { category: "external", summary: "https://github.com/matrix-org/matrix-js-sdk/security/advisories/GHSA-mwq8-fjpf-c2gr", url: "https://github.com/matrix-org/matrix-js-sdk/security/advisories/GHSA-mwq8-fjpf-c2gr", }, { category: "external", summary: "https://matrix.org/blog/2023/03/28/security-releases-matrix-js-sdk-24-0-0-and-matrix-react-sdk-3-69-0", url: "https://matrix.org/blog/2023/03/28/security-releases-matrix-js-sdk-24-0-0-and-matrix-react-sdk-3-69-0", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-12/#CVE-2023-28427", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-12/#CVE-2023-28427", }, ], release_date: "2023-03-28T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T14:04:25+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.src", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1804", }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 7.5, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.src", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "Mozilla: Matrix SDK bundled with Thunderbird vulnerable to denial-of-service attack", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Ribose RNP Team", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29479", cwe: { id: "CWE-400", name: "Uncontrolled Resource Consumption", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186735", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nCertain malformed OpenPGP messages could trigger incorrect parsing of PKESK/SKESK packets due to a bug in the Ribose RNP library used by Thunderbird up to version 102.9.1, which would cause the Thunderbird user interface to hang. The issue was discovered using Google's oss-fuzz.", title: "Vulnerability description", }, { category: "summary", text: "Thunderbird: Hang when processing certain OpenPGP messages", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.src", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29479", }, { category: "external", summary: "RHBZ#2186735", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186735", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29479", url: "https://www.cve.org/CVERecord?id=CVE-2023-29479", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29479", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29479", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-15/#CVE-2023-29479", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-15/#CVE-2023-29479", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T14:04:25+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.src", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1804", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 6.5, baseSeverity: "MEDIUM", confidentialityImpact: "NONE", integrityImpact: "NONE", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", version: "3.1", }, products: [ "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.src", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "Thunderbird: Hang when processing certain OpenPGP messages", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Irvan Kurniawan", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29533", cwe: { id: "CWE-425", name: "Direct Request ('Forced Browsing')", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186101", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nA website could have obscured the fullscreen notification by using a combination of `window.open`, fullscreen requests, `window.name` assignments, and `setInterval` calls. This could have led to user confusion and possible spoofing attacks.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Fullscreen notification obscured", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.src", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29533", }, { category: "external", summary: "RHBZ#2186101", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186101", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29533", url: "https://www.cve.org/CVERecord?id=CVE-2023-29533", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29533", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29533", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29533", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29533", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T14:04:25+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.src", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1804", }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 7.5, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.src", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "Mozilla: Fullscreen notification obscured", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Lukas Bernhard", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29535", cwe: { id: "CWE-119", name: "Improper Restriction of Operations within the Bounds of a Memory Buffer", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186103", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nFollowing a Garbage Collector compaction, weak maps may have been accessed before they were correctly traced. This resulted in memory corruption and a potentially exploitable crash.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Potential Memory Corruption following Garbage Collector compaction", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.src", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29535", }, { category: "external", summary: "RHBZ#2186103", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186103", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29535", url: "https://www.cve.org/CVERecord?id=CVE-2023-29535", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29535", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29535", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29535", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29535", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T14:04:25+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.src", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1804", }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 7.5, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.src", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "Mozilla: Potential Memory Corruption following Garbage Collector compaction", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "zx from qriousec", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29536", cwe: { id: "CWE-617", name: "Reachable Assertion", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186104", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nAn attacker could cause the memory manager to incorrectly free a pointer that addresses attacker-controlled memory, resulting in an assertion, memory corruption, or a potentially exploitable crash.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Invalid free from JavaScript code", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.src", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29536", }, { category: "external", summary: "RHBZ#2186104", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186104", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29536", url: "https://www.cve.org/CVERecord?id=CVE-2023-29536", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29536", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29536", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29536", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29536", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T14:04:25+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.src", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1804", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 8.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.src", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "Mozilla: Invalid free from JavaScript code", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Trung Pham", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29539", cwe: { id: "CWE-159", name: "Improper Handling of Invalid Use of Special Elements", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186105", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nWhen handling the filename directive in the Content-Disposition header, the filename would be truncated if the filename contained a NULL character. This could have led to reflected file download attacks potentially tricking users to install malware.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Content-Disposition filename truncation leads to Reflected File Download", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.src", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29539", }, { category: "external", summary: "RHBZ#2186105", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186105", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29539", url: "https://www.cve.org/CVERecord?id=CVE-2023-29539", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29539", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29539", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29539", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29539", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T14:04:25+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.src", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1804", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 8.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.src", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "Mozilla: Content-Disposition filename truncation leads to Reflected File Download", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Ameen Basha M K", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29541", cwe: { id: "CWE-434", name: "Unrestricted Upload of File with Dangerous Type", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186106", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nFirefox did not properly handle downloads of files ending in `.desktop`, which can be interpreted to run attacker-controlled commands.\r\n\r\n*This bug only affects Firefox for Linux on certain Distributions. Other operating systems are unaffected, and Mozilla is unable to enumerate all affected Linux Distributions.*", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Files with malicious extensions could have been downloaded unsafely on Linux", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.src", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29541", }, { category: "external", summary: "RHBZ#2186106", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186106", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29541", url: "https://www.cve.org/CVERecord?id=CVE-2023-29541", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29541", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29541", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29541", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29541", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T14:04:25+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.src", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1804", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 8.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.src", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "Mozilla: Files with malicious extensions could have been downloaded unsafely on Linux", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "JunYoung Park", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29548", cwe: { id: "CWE-682", name: "Incorrect Calculation", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186110", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nA wrong lowering instruction in the ARM64 Ion compiler resulted in a wrong optimization result.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Incorrect optimization result on ARM64", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.src", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29548", }, { category: "external", summary: "RHBZ#2186110", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186110", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29548", url: "https://www.cve.org/CVERecord?id=CVE-2023-29548", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29548", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29548", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29548", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29548", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T14:04:25+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.src", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1804", }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "NONE", baseScore: 3.4, baseSeverity: "LOW", confidentialityImpact: "NONE", integrityImpact: "LOW", privilegesRequired: "NONE", scope: "CHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:N", version: "3.1", }, products: [ "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.src", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.x86_64", ], }, ], threats: [ { category: "impact", details: "Low", }, ], title: "Mozilla: Incorrect optimization result on ARM64", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Mozilla developers and community", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29550", cwe: { id: "CWE-120", name: "Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186111", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nMozilla developers Andrew Osmond, Sebastian Hengst, Andrew McCreight, and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 111 and Firefox ESR 102.9. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Memory safety bugs fixed in Firefox 112 and Firefox ESR 102.10", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.src", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29550", }, { category: "external", summary: "RHBZ#2186111", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186111", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29550", url: "https://www.cve.org/CVERecord?id=CVE-2023-29550", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29550", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29550", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29550", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29550", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T14:04:25+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.src", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1804", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 8.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.src", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "Mozilla: Memory safety bugs fixed in Firefox 112 and Firefox ESR 102.10", }, ], }
rhsa-2023_1803
Vulnerability from csaf_redhat
Published
2023-04-17 13:56
Modified
2024-12-16 05:27
Summary
Red Hat Security Advisory: thunderbird security update
Notes
Topic
An update for thunderbird is now available for Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Mozilla Thunderbird is a standalone mail and newsgroup client.
This update upgrades Thunderbird to version 102.10.0.
Security Fix(es):
* Thunderbird: Revocation status of S/Mime recipient certificates was not checked (CVE-2023-0547)
* Mozilla: Matrix SDK bundled with Thunderbird vulnerable to denial-of-service attack (CVE-2023-28427)
* Mozilla: Fullscreen notification obscured (CVE-2023-29533)
* Mozilla: Potential Memory Corruption following Garbage Collector compaction (CVE-2023-29535)
* Mozilla: Invalid free from JavaScript code (CVE-2023-29536)
* Mozilla: Memory safety bugs fixed in Firefox 112 and Firefox ESR 102.10 (CVE-2023-29550)
* Mozilla: Memory Corruption in Safe Browsing Code (CVE-2023-1945)
* Thunderbird: Hang when processing certain OpenPGP messages (CVE-2023-29479)
* Mozilla: Content-Disposition filename truncation leads to Reflected File Download (CVE-2023-29539)
* Mozilla: Files with malicious extensions could have been downloaded unsafely on Linux (CVE-2023-29541)
* Mozilla: Incorrect optimization result on ARM64 (CVE-2023-29548)
* MFSA-TMP-2023-0001 Mozilla: Double-free in libwebp (BZ#2186102)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ document: { aggregate_severity: { namespace: "https://access.redhat.com/security/updates/classification/", text: "Important", }, category: "csaf_security_advisory", csaf_version: "2.0", distribution: { text: "Copyright © Red Hat, Inc. All rights reserved.", tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "en", notes: [ { category: "summary", text: "An update for thunderbird is now available for Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", title: "Topic", }, { category: "general", text: "Mozilla Thunderbird is a standalone mail and newsgroup client.\n\nThis update upgrades Thunderbird to version 102.10.0.\n\nSecurity Fix(es):\n\n* Thunderbird: Revocation status of S/Mime recipient certificates was not checked (CVE-2023-0547)\n\n* Mozilla: Matrix SDK bundled with Thunderbird vulnerable to denial-of-service attack (CVE-2023-28427)\n\n* Mozilla: Fullscreen notification obscured (CVE-2023-29533)\n\n* Mozilla: Potential Memory Corruption following Garbage Collector compaction (CVE-2023-29535)\n\n* Mozilla: Invalid free from JavaScript code (CVE-2023-29536)\n\n* Mozilla: Memory safety bugs fixed in Firefox 112 and Firefox ESR 102.10 (CVE-2023-29550)\n\n* Mozilla: Memory Corruption in Safe Browsing Code (CVE-2023-1945)\n\n* Thunderbird: Hang when processing certain OpenPGP messages (CVE-2023-29479)\n\n* Mozilla: Content-Disposition filename truncation leads to Reflected File Download (CVE-2023-29539)\n\n* Mozilla: Files with malicious extensions could have been downloaded unsafely on Linux (CVE-2023-29541)\n\n* Mozilla: Incorrect optimization result on ARM64 (CVE-2023-29548)\n\n* MFSA-TMP-2023-0001 Mozilla: Double-free in libwebp (BZ#2186102)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", title: "Details", }, { category: "legal_disclaimer", text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", title: "Terms of Use", }, ], publisher: { category: "vendor", contact_details: "https://access.redhat.com/security/team/contact/", issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", name: "Red Hat Product Security", namespace: "https://www.redhat.com", }, references: [ { category: "self", summary: "https://access.redhat.com/errata/RHSA-2023:1803", url: "https://access.redhat.com/errata/RHSA-2023:1803", }, { category: "external", summary: "https://access.redhat.com/security/updates/classification/#important", url: "https://access.redhat.com/security/updates/classification/#important", }, { category: "external", summary: "2183278", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2183278", }, { category: "external", summary: "2186101", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186101", }, { category: "external", summary: "2186102", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186102", }, { category: "external", summary: "2186103", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186103", }, { category: "external", summary: "2186104", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186104", }, { category: "external", summary: "2186105", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186105", }, { category: "external", summary: "2186106", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186106", }, { category: "external", summary: "2186109", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186109", }, { category: "external", summary: "2186110", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186110", }, { category: "external", summary: "2186111", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186111", }, { category: "external", summary: "2186734", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186734", }, { category: "external", summary: "2186735", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186735", }, { category: "self", summary: "Canonical URL", url: "https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_1803.json", }, ], title: "Red Hat Security Advisory: thunderbird security update", tracking: { current_release_date: "2024-12-16T05:27:32+00:00", generator: { date: "2024-12-16T05:27:32+00:00", engine: { name: "Red Hat SDEngine", version: "4.2.3", }, }, id: "RHSA-2023:1803", initial_release_date: "2023-04-17T13:56:07+00:00", revision_history: [ { date: "2023-04-17T13:56:07+00:00", number: "1", summary: "Initial version", }, { date: "2023-04-17T13:56:07+00:00", number: "2", summary: "Last updated version", }, { date: "2024-12-16T05:27:32+00:00", number: "3", summary: "Last generated version", }, ], status: "final", version: "3", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_name", name: "Red Hat Enterprise Linux AppStream E4S (v. 8.1)", product: { name: "Red Hat Enterprise Linux AppStream E4S (v. 8.1)", product_id: "AppStream-8.1.0.Z.E4S", product_identification_helper: { cpe: "cpe:/a:redhat:rhel_e4s:8.1::appstream", }, }, }, ], category: "product_family", name: "Red Hat Enterprise Linux", }, { branches: [ { category: "product_version", name: "thunderbird-0:102.10.0-2.el8_1.src", product: { name: "thunderbird-0:102.10.0-2.el8_1.src", product_id: "thunderbird-0:102.10.0-2.el8_1.src", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird@102.10.0-2.el8_1?arch=src", }, }, }, ], category: "architecture", name: "src", }, { branches: [ { category: "product_version", name: "thunderbird-0:102.10.0-2.el8_1.ppc64le", product: { name: "thunderbird-0:102.10.0-2.el8_1.ppc64le", product_id: "thunderbird-0:102.10.0-2.el8_1.ppc64le", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird@102.10.0-2.el8_1?arch=ppc64le", }, }, }, { category: "product_version", name: "thunderbird-debugsource-0:102.10.0-2.el8_1.ppc64le", product: { name: "thunderbird-debugsource-0:102.10.0-2.el8_1.ppc64le", product_id: "thunderbird-debugsource-0:102.10.0-2.el8_1.ppc64le", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird-debugsource@102.10.0-2.el8_1?arch=ppc64le", }, }, }, { category: "product_version", name: "thunderbird-debuginfo-0:102.10.0-2.el8_1.ppc64le", product: { name: "thunderbird-debuginfo-0:102.10.0-2.el8_1.ppc64le", product_id: "thunderbird-debuginfo-0:102.10.0-2.el8_1.ppc64le", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird-debuginfo@102.10.0-2.el8_1?arch=ppc64le", }, }, }, ], category: "architecture", name: "ppc64le", }, { branches: [ { category: "product_version", name: "thunderbird-0:102.10.0-2.el8_1.x86_64", product: { name: "thunderbird-0:102.10.0-2.el8_1.x86_64", product_id: "thunderbird-0:102.10.0-2.el8_1.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird@102.10.0-2.el8_1?arch=x86_64", }, }, }, { category: "product_version", name: "thunderbird-debugsource-0:102.10.0-2.el8_1.x86_64", product: { name: "thunderbird-debugsource-0:102.10.0-2.el8_1.x86_64", product_id: "thunderbird-debugsource-0:102.10.0-2.el8_1.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird-debugsource@102.10.0-2.el8_1?arch=x86_64", }, }, }, { category: "product_version", name: "thunderbird-debuginfo-0:102.10.0-2.el8_1.x86_64", product: { name: "thunderbird-debuginfo-0:102.10.0-2.el8_1.x86_64", product_id: "thunderbird-debuginfo-0:102.10.0-2.el8_1.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird-debuginfo@102.10.0-2.el8_1?arch=x86_64", }, }, }, ], category: "architecture", name: "x86_64", }, ], category: "vendor", name: "Red Hat", }, ], relationships: [ { category: "default_component_of", full_product_name: { name: "thunderbird-0:102.10.0-2.el8_1.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v. 8.1)", product_id: "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.ppc64le", }, product_reference: "thunderbird-0:102.10.0-2.el8_1.ppc64le", relates_to_product_reference: "AppStream-8.1.0.Z.E4S", }, { category: "default_component_of", full_product_name: { name: "thunderbird-0:102.10.0-2.el8_1.src as a component of Red Hat Enterprise Linux AppStream E4S (v. 8.1)", product_id: "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.src", }, product_reference: "thunderbird-0:102.10.0-2.el8_1.src", relates_to_product_reference: "AppStream-8.1.0.Z.E4S", }, { category: "default_component_of", full_product_name: { name: "thunderbird-0:102.10.0-2.el8_1.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v. 8.1)", product_id: "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.x86_64", }, product_reference: "thunderbird-0:102.10.0-2.el8_1.x86_64", relates_to_product_reference: "AppStream-8.1.0.Z.E4S", }, { category: "default_component_of", full_product_name: { name: "thunderbird-debuginfo-0:102.10.0-2.el8_1.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v. 8.1)", product_id: "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.ppc64le", }, product_reference: "thunderbird-debuginfo-0:102.10.0-2.el8_1.ppc64le", relates_to_product_reference: "AppStream-8.1.0.Z.E4S", }, { category: "default_component_of", full_product_name: { name: "thunderbird-debuginfo-0:102.10.0-2.el8_1.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v. 8.1)", product_id: "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.x86_64", }, product_reference: "thunderbird-debuginfo-0:102.10.0-2.el8_1.x86_64", relates_to_product_reference: "AppStream-8.1.0.Z.E4S", }, { category: "default_component_of", full_product_name: { name: "thunderbird-debugsource-0:102.10.0-2.el8_1.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v. 8.1)", product_id: "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.ppc64le", }, product_reference: "thunderbird-debugsource-0:102.10.0-2.el8_1.ppc64le", relates_to_product_reference: "AppStream-8.1.0.Z.E4S", }, { category: "default_component_of", full_product_name: { name: "thunderbird-debugsource-0:102.10.0-2.el8_1.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v. 8.1)", product_id: "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.x86_64", }, product_reference: "thunderbird-debugsource-0:102.10.0-2.el8_1.x86_64", relates_to_product_reference: "AppStream-8.1.0.Z.E4S", }, ], }, vulnerabilities: [ { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Paul Menzel", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-0547", cwe: { id: "CWE-356", name: "Product UI does not Warn User of Unsafe Actions", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186734", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nOCSP revocation status of recipient certificates was not checked when sending S/Mime encrypted email, and revoked certificates would be accepted. Thunderbird versions from 68 to 102.9.1 were affected by this bug.", title: "Vulnerability description", }, { category: "summary", text: "Thunderbird: Revocation status of S/Mime recipient certificates was not checked", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.src", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-0547", }, { category: "external", summary: "RHBZ#2186734", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186734", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-0547", url: "https://www.cve.org/CVERecord?id=CVE-2023-0547", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-0547", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-0547", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-15/#CVE-2023-0547", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-15/#CVE-2023-0547", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T13:56:07+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.src", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1803", }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 7.5, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.src", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "Thunderbird: Revocation status of S/Mime recipient certificates was not checked", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Gabriele Svelto", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-1945", cwe: { id: "CWE-119", name: "Improper Restriction of Operations within the Bounds of a Memory Buffer", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186109", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nUnexpected data returned from the Safe Browsing API could have led to memory corruption and a potentially exploitable crash.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Memory Corruption in Safe Browsing Code", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.src", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-1945", }, { category: "external", summary: "RHBZ#2186109", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186109", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-1945", url: "https://www.cve.org/CVERecord?id=CVE-2023-1945", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-1945", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-1945", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-1945", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-1945", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T13:56:07+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.src", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1803", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "NONE", baseScore: 6.1, baseSeverity: "MEDIUM", confidentialityImpact: "LOW", integrityImpact: "LOW", privilegesRequired: "NONE", scope: "CHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", version: "3.1", }, products: [ "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.src", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "Mozilla: Memory Corruption in Safe Browsing Code", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Irvan Kurniawan", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-1999", cwe: { id: "CWE-415", name: "Double Free", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186102", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nA double-free in libwebp could have led to memory corruption and a potentially exploitable crash.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: libwebp: Double-free in libwebp", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.src", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-1999", }, { category: "external", summary: "RHBZ#2186102", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186102", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-1999", url: "https://www.cve.org/CVERecord?id=CVE-2023-1999", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-1999", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-1999", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-1999", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-1999", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-15/#CVE-2023-1999", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-15/#CVE-2023-1999", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T13:56:07+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.src", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1803", }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 7.5, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.src", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "Mozilla: libwebp: Double-free in libwebp", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Matrix Security Team", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-28427", cwe: { id: "CWE-1321", name: "Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')", }, discovery_date: "2023-03-28T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2183278", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nThunderbird users who use the Matrix chat protocol were vulnerable to a denial-of-service attack.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Matrix SDK bundled with Thunderbird vulnerable to denial-of-service attack", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.src", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-28427", }, { category: "external", summary: "RHBZ#2183278", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2183278", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-28427", url: "https://www.cve.org/CVERecord?id=CVE-2023-28427", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-28427", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-28427", }, { category: "external", summary: "https://github.com/matrix-org/matrix-js-sdk/security/advisories/GHSA-mwq8-fjpf-c2gr", url: "https://github.com/matrix-org/matrix-js-sdk/security/advisories/GHSA-mwq8-fjpf-c2gr", }, { category: "external", summary: "https://matrix.org/blog/2023/03/28/security-releases-matrix-js-sdk-24-0-0-and-matrix-react-sdk-3-69-0", url: "https://matrix.org/blog/2023/03/28/security-releases-matrix-js-sdk-24-0-0-and-matrix-react-sdk-3-69-0", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-12/#CVE-2023-28427", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-12/#CVE-2023-28427", }, ], release_date: "2023-03-28T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T13:56:07+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.src", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1803", }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 7.5, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.src", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "Mozilla: Matrix SDK bundled with Thunderbird vulnerable to denial-of-service attack", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Ribose RNP Team", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29479", cwe: { id: "CWE-400", name: "Uncontrolled Resource Consumption", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186735", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nCertain malformed OpenPGP messages could trigger incorrect parsing of PKESK/SKESK packets due to a bug in the Ribose RNP library used by Thunderbird up to version 102.9.1, which would cause the Thunderbird user interface to hang. The issue was discovered using Google's oss-fuzz.", title: "Vulnerability description", }, { category: "summary", text: "Thunderbird: Hang when processing certain OpenPGP messages", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.src", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29479", }, { category: "external", summary: "RHBZ#2186735", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186735", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29479", url: "https://www.cve.org/CVERecord?id=CVE-2023-29479", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29479", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29479", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-15/#CVE-2023-29479", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-15/#CVE-2023-29479", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T13:56:07+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.src", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1803", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 6.5, baseSeverity: "MEDIUM", confidentialityImpact: "NONE", integrityImpact: "NONE", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", version: "3.1", }, products: [ "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.src", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "Thunderbird: Hang when processing certain OpenPGP messages", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Irvan Kurniawan", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29533", cwe: { id: "CWE-425", name: "Direct Request ('Forced Browsing')", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186101", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nA website could have obscured the fullscreen notification by using a combination of `window.open`, fullscreen requests, `window.name` assignments, and `setInterval` calls. This could have led to user confusion and possible spoofing attacks.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Fullscreen notification obscured", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.src", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29533", }, { category: "external", summary: "RHBZ#2186101", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186101", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29533", url: "https://www.cve.org/CVERecord?id=CVE-2023-29533", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29533", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29533", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29533", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29533", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T13:56:07+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.src", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1803", }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 7.5, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.src", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "Mozilla: Fullscreen notification obscured", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Lukas Bernhard", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29535", cwe: { id: "CWE-119", name: "Improper Restriction of Operations within the Bounds of a Memory Buffer", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186103", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nFollowing a Garbage Collector compaction, weak maps may have been accessed before they were correctly traced. This resulted in memory corruption and a potentially exploitable crash.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Potential Memory Corruption following Garbage Collector compaction", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.src", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29535", }, { category: "external", summary: "RHBZ#2186103", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186103", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29535", url: "https://www.cve.org/CVERecord?id=CVE-2023-29535", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29535", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29535", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29535", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29535", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T13:56:07+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.src", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1803", }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 7.5, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.src", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "Mozilla: Potential Memory Corruption following Garbage Collector compaction", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "zx from qriousec", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29536", cwe: { id: "CWE-617", name: "Reachable Assertion", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186104", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nAn attacker could cause the memory manager to incorrectly free a pointer that addresses attacker-controlled memory, resulting in an assertion, memory corruption, or a potentially exploitable crash.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Invalid free from JavaScript code", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.src", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29536", }, { category: "external", summary: "RHBZ#2186104", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186104", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29536", url: "https://www.cve.org/CVERecord?id=CVE-2023-29536", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29536", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29536", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29536", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29536", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T13:56:07+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.src", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1803", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 8.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.src", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "Mozilla: Invalid free from JavaScript code", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Trung Pham", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29539", cwe: { id: "CWE-159", name: "Improper Handling of Invalid Use of Special Elements", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186105", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nWhen handling the filename directive in the Content-Disposition header, the filename would be truncated if the filename contained a NULL character. This could have led to reflected file download attacks potentially tricking users to install malware.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Content-Disposition filename truncation leads to Reflected File Download", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.src", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29539", }, { category: "external", summary: "RHBZ#2186105", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186105", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29539", url: "https://www.cve.org/CVERecord?id=CVE-2023-29539", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29539", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29539", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29539", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29539", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T13:56:07+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.src", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1803", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 8.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.src", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "Mozilla: Content-Disposition filename truncation leads to Reflected File Download", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Ameen Basha M K", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29541", cwe: { id: "CWE-434", name: "Unrestricted Upload of File with Dangerous Type", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186106", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nFirefox did not properly handle downloads of files ending in `.desktop`, which can be interpreted to run attacker-controlled commands.\r\n\r\n*This bug only affects Firefox for Linux on certain Distributions. Other operating systems are unaffected, and Mozilla is unable to enumerate all affected Linux Distributions.*", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Files with malicious extensions could have been downloaded unsafely on Linux", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.src", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29541", }, { category: "external", summary: "RHBZ#2186106", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186106", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29541", url: "https://www.cve.org/CVERecord?id=CVE-2023-29541", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29541", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29541", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29541", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29541", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T13:56:07+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.src", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1803", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 8.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.src", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "Mozilla: Files with malicious extensions could have been downloaded unsafely on Linux", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "JunYoung Park", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29548", cwe: { id: "CWE-682", name: "Incorrect Calculation", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186110", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nA wrong lowering instruction in the ARM64 Ion compiler resulted in a wrong optimization result.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Incorrect optimization result on ARM64", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.src", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29548", }, { category: "external", summary: "RHBZ#2186110", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186110", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29548", url: "https://www.cve.org/CVERecord?id=CVE-2023-29548", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29548", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29548", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29548", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29548", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T13:56:07+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.src", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1803", }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "NONE", baseScore: 3.4, baseSeverity: "LOW", confidentialityImpact: "NONE", integrityImpact: "LOW", privilegesRequired: "NONE", scope: "CHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:N", version: "3.1", }, products: [ "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.src", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.x86_64", ], }, ], threats: [ { category: "impact", details: "Low", }, ], title: "Mozilla: Incorrect optimization result on ARM64", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Mozilla developers and community", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29550", cwe: { id: "CWE-120", name: "Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186111", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nMozilla developers Andrew Osmond, Sebastian Hengst, Andrew McCreight, and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 111 and Firefox ESR 102.9. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Memory safety bugs fixed in Firefox 112 and Firefox ESR 102.10", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.src", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29550", }, { category: "external", summary: "RHBZ#2186111", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186111", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29550", url: "https://www.cve.org/CVERecord?id=CVE-2023-29550", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29550", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29550", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29550", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29550", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T13:56:07+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.src", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1803", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 8.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.src", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "Mozilla: Memory safety bugs fixed in Firefox 112 and Firefox ESR 102.10", }, ], }
rhsa-2023_1809
Vulnerability from csaf_redhat
Published
2023-04-17 14:10
Modified
2024-12-16 05:27
Summary
Red Hat Security Advisory: thunderbird security update
Notes
Topic
An update for thunderbird is now available for Red Hat Enterprise Linux 9.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Mozilla Thunderbird is a standalone mail and newsgroup client.
This update upgrades Thunderbird to version 102.10.0.
Security Fix(es):
* Thunderbird: Revocation status of S/Mime recipient certificates was not checked (CVE-2023-0547)
* Mozilla: Matrix SDK bundled with Thunderbird vulnerable to denial-of-service attack (CVE-2023-28427)
* Mozilla: Fullscreen notification obscured (CVE-2023-29533)
* Mozilla: Potential Memory Corruption following Garbage Collector compaction (CVE-2023-29535)
* Mozilla: Invalid free from JavaScript code (CVE-2023-29536)
* Mozilla: Memory safety bugs fixed in Firefox 112 and Firefox ESR 102.10 (CVE-2023-29550)
* Mozilla: Memory Corruption in Safe Browsing Code (CVE-2023-1945)
* Thunderbird: Hang when processing certain OpenPGP messages (CVE-2023-29479)
* Mozilla: Content-Disposition filename truncation leads to Reflected File Download (CVE-2023-29539)
* Mozilla: Files with malicious extensions could have been downloaded unsafely on Linux (CVE-2023-29541)
* Mozilla: Incorrect optimization result on ARM64 (CVE-2023-29548)
* MFSA-TMP-2023-0001 Mozilla: Double-free in libwebp (BZ#2186102)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ document: { aggregate_severity: { namespace: "https://access.redhat.com/security/updates/classification/", text: "Important", }, category: "csaf_security_advisory", csaf_version: "2.0", distribution: { text: "Copyright © Red Hat, Inc. All rights reserved.", tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "en", notes: [ { category: "summary", text: "An update for thunderbird is now available for Red Hat Enterprise Linux 9.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", title: "Topic", }, { category: "general", text: "Mozilla Thunderbird is a standalone mail and newsgroup client.\n\nThis update upgrades Thunderbird to version 102.10.0.\n\nSecurity Fix(es):\n\n* Thunderbird: Revocation status of S/Mime recipient certificates was not checked (CVE-2023-0547)\n\n* Mozilla: Matrix SDK bundled with Thunderbird vulnerable to denial-of-service attack (CVE-2023-28427)\n\n* Mozilla: Fullscreen notification obscured (CVE-2023-29533)\n\n* Mozilla: Potential Memory Corruption following Garbage Collector compaction (CVE-2023-29535)\n\n* Mozilla: Invalid free from JavaScript code (CVE-2023-29536)\n\n* Mozilla: Memory safety bugs fixed in Firefox 112 and Firefox ESR 102.10 (CVE-2023-29550)\n\n* Mozilla: Memory Corruption in Safe Browsing Code (CVE-2023-1945)\n\n* Thunderbird: Hang when processing certain OpenPGP messages (CVE-2023-29479)\n\n* Mozilla: Content-Disposition filename truncation leads to Reflected File Download (CVE-2023-29539)\n\n* Mozilla: Files with malicious extensions could have been downloaded unsafely on Linux (CVE-2023-29541)\n\n* Mozilla: Incorrect optimization result on ARM64 (CVE-2023-29548)\n\n* MFSA-TMP-2023-0001 Mozilla: Double-free in libwebp (BZ#2186102)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", title: "Details", }, { category: "legal_disclaimer", text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", title: "Terms of Use", }, ], publisher: { category: "vendor", contact_details: "https://access.redhat.com/security/team/contact/", issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", name: "Red Hat Product Security", namespace: "https://www.redhat.com", }, references: [ { category: "self", summary: "https://access.redhat.com/errata/RHSA-2023:1809", url: "https://access.redhat.com/errata/RHSA-2023:1809", }, { category: "external", summary: "https://access.redhat.com/security/updates/classification/#important", url: "https://access.redhat.com/security/updates/classification/#important", }, { category: "external", summary: "2183278", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2183278", }, { category: "external", summary: "2186101", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186101", }, { category: "external", summary: "2186102", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186102", }, { category: "external", summary: "2186103", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186103", }, { category: "external", summary: "2186104", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186104", }, { category: "external", summary: "2186105", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186105", }, { category: "external", summary: "2186106", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186106", }, { category: "external", summary: "2186109", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186109", }, { category: "external", summary: "2186110", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186110", }, { category: "external", summary: "2186111", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186111", }, { category: "external", summary: "2186734", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186734", }, { category: "external", summary: "2186735", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186735", }, { category: "self", summary: "Canonical URL", url: "https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_1809.json", }, ], title: "Red Hat Security Advisory: thunderbird security update", tracking: { current_release_date: "2024-12-16T05:27:13+00:00", generator: { date: "2024-12-16T05:27:13+00:00", engine: { name: "Red Hat SDEngine", version: "4.2.3", }, }, id: "RHSA-2023:1809", initial_release_date: "2023-04-17T14:10:15+00:00", revision_history: [ { date: "2023-04-17T14:10:15+00:00", number: "1", summary: "Initial version", }, { date: "2023-04-17T14:10:15+00:00", number: "2", summary: "Last updated version", }, { date: "2024-12-16T05:27:13+00:00", number: "3", summary: "Last generated version", }, ], status: "final", version: "3", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_name", name: "Red Hat Enterprise Linux AppStream (v. 9)", product: { name: "Red Hat Enterprise Linux AppStream (v. 9)", product_id: "AppStream-9.1.0.Z.MAIN", product_identification_helper: { cpe: "cpe:/a:redhat:enterprise_linux:9::appstream", }, }, }, ], category: "product_family", name: "Red Hat Enterprise Linux", }, { branches: [ { category: "product_version", name: "thunderbird-0:102.10.0-2.el9_1.src", product: { name: "thunderbird-0:102.10.0-2.el9_1.src", product_id: "thunderbird-0:102.10.0-2.el9_1.src", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird@102.10.0-2.el9_1?arch=src", }, }, }, ], category: "architecture", name: "src", }, { branches: [ { category: "product_version", name: "thunderbird-0:102.10.0-2.el9_1.aarch64", product: { name: "thunderbird-0:102.10.0-2.el9_1.aarch64", product_id: "thunderbird-0:102.10.0-2.el9_1.aarch64", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird@102.10.0-2.el9_1?arch=aarch64", }, }, }, { category: "product_version", name: "thunderbird-debugsource-0:102.10.0-2.el9_1.aarch64", product: { name: "thunderbird-debugsource-0:102.10.0-2.el9_1.aarch64", product_id: "thunderbird-debugsource-0:102.10.0-2.el9_1.aarch64", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird-debugsource@102.10.0-2.el9_1?arch=aarch64", }, }, }, { category: "product_version", name: "thunderbird-debuginfo-0:102.10.0-2.el9_1.aarch64", product: { name: "thunderbird-debuginfo-0:102.10.0-2.el9_1.aarch64", product_id: "thunderbird-debuginfo-0:102.10.0-2.el9_1.aarch64", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird-debuginfo@102.10.0-2.el9_1?arch=aarch64", }, }, }, ], category: "architecture", name: "aarch64", }, { branches: [ { category: "product_version", name: "thunderbird-0:102.10.0-2.el9_1.ppc64le", product: { name: "thunderbird-0:102.10.0-2.el9_1.ppc64le", product_id: "thunderbird-0:102.10.0-2.el9_1.ppc64le", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird@102.10.0-2.el9_1?arch=ppc64le", }, }, }, { category: "product_version", name: "thunderbird-debugsource-0:102.10.0-2.el9_1.ppc64le", product: { name: "thunderbird-debugsource-0:102.10.0-2.el9_1.ppc64le", product_id: "thunderbird-debugsource-0:102.10.0-2.el9_1.ppc64le", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird-debugsource@102.10.0-2.el9_1?arch=ppc64le", }, }, }, { category: "product_version", name: "thunderbird-debuginfo-0:102.10.0-2.el9_1.ppc64le", product: { name: "thunderbird-debuginfo-0:102.10.0-2.el9_1.ppc64le", product_id: "thunderbird-debuginfo-0:102.10.0-2.el9_1.ppc64le", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird-debuginfo@102.10.0-2.el9_1?arch=ppc64le", }, }, }, ], category: "architecture", name: "ppc64le", }, { branches: [ { category: "product_version", name: "thunderbird-0:102.10.0-2.el9_1.x86_64", product: { name: "thunderbird-0:102.10.0-2.el9_1.x86_64", product_id: "thunderbird-0:102.10.0-2.el9_1.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird@102.10.0-2.el9_1?arch=x86_64", }, }, }, { category: "product_version", name: "thunderbird-debugsource-0:102.10.0-2.el9_1.x86_64", product: { name: "thunderbird-debugsource-0:102.10.0-2.el9_1.x86_64", product_id: "thunderbird-debugsource-0:102.10.0-2.el9_1.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird-debugsource@102.10.0-2.el9_1?arch=x86_64", }, }, }, { category: "product_version", name: "thunderbird-debuginfo-0:102.10.0-2.el9_1.x86_64", product: { name: "thunderbird-debuginfo-0:102.10.0-2.el9_1.x86_64", product_id: "thunderbird-debuginfo-0:102.10.0-2.el9_1.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird-debuginfo@102.10.0-2.el9_1?arch=x86_64", }, }, }, ], category: "architecture", name: "x86_64", }, { branches: [ { category: "product_version", name: "thunderbird-0:102.10.0-2.el9_1.s390x", product: { name: "thunderbird-0:102.10.0-2.el9_1.s390x", product_id: "thunderbird-0:102.10.0-2.el9_1.s390x", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird@102.10.0-2.el9_1?arch=s390x", }, }, }, { category: "product_version", name: "thunderbird-debugsource-0:102.10.0-2.el9_1.s390x", product: { name: "thunderbird-debugsource-0:102.10.0-2.el9_1.s390x", product_id: "thunderbird-debugsource-0:102.10.0-2.el9_1.s390x", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird-debugsource@102.10.0-2.el9_1?arch=s390x", }, }, }, { category: "product_version", name: "thunderbird-debuginfo-0:102.10.0-2.el9_1.s390x", product: { name: "thunderbird-debuginfo-0:102.10.0-2.el9_1.s390x", product_id: "thunderbird-debuginfo-0:102.10.0-2.el9_1.s390x", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird-debuginfo@102.10.0-2.el9_1?arch=s390x", }, }, }, ], category: "architecture", name: "s390x", }, ], category: "vendor", name: "Red Hat", }, ], relationships: [ { category: "default_component_of", full_product_name: { name: "thunderbird-0:102.10.0-2.el9_1.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)", product_id: "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.aarch64", }, product_reference: "thunderbird-0:102.10.0-2.el9_1.aarch64", relates_to_product_reference: "AppStream-9.1.0.Z.MAIN", }, { category: "default_component_of", full_product_name: { name: "thunderbird-0:102.10.0-2.el9_1.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)", product_id: "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.ppc64le", }, product_reference: "thunderbird-0:102.10.0-2.el9_1.ppc64le", relates_to_product_reference: "AppStream-9.1.0.Z.MAIN", }, { category: "default_component_of", full_product_name: { name: "thunderbird-0:102.10.0-2.el9_1.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)", product_id: "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.s390x", }, product_reference: "thunderbird-0:102.10.0-2.el9_1.s390x", relates_to_product_reference: "AppStream-9.1.0.Z.MAIN", }, { category: "default_component_of", full_product_name: { name: "thunderbird-0:102.10.0-2.el9_1.src as a component of Red Hat Enterprise Linux AppStream (v. 9)", product_id: "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.src", }, product_reference: "thunderbird-0:102.10.0-2.el9_1.src", relates_to_product_reference: "AppStream-9.1.0.Z.MAIN", }, { category: "default_component_of", full_product_name: { name: "thunderbird-0:102.10.0-2.el9_1.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)", product_id: "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.x86_64", }, product_reference: "thunderbird-0:102.10.0-2.el9_1.x86_64", relates_to_product_reference: "AppStream-9.1.0.Z.MAIN", }, { category: "default_component_of", full_product_name: { name: "thunderbird-debuginfo-0:102.10.0-2.el9_1.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)", product_id: "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.aarch64", }, product_reference: "thunderbird-debuginfo-0:102.10.0-2.el9_1.aarch64", relates_to_product_reference: "AppStream-9.1.0.Z.MAIN", }, { category: "default_component_of", full_product_name: { name: "thunderbird-debuginfo-0:102.10.0-2.el9_1.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)", product_id: "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.ppc64le", }, product_reference: "thunderbird-debuginfo-0:102.10.0-2.el9_1.ppc64le", relates_to_product_reference: "AppStream-9.1.0.Z.MAIN", }, { category: "default_component_of", full_product_name: { name: "thunderbird-debuginfo-0:102.10.0-2.el9_1.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)", product_id: "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.s390x", }, product_reference: "thunderbird-debuginfo-0:102.10.0-2.el9_1.s390x", relates_to_product_reference: "AppStream-9.1.0.Z.MAIN", }, { category: "default_component_of", full_product_name: { name: "thunderbird-debuginfo-0:102.10.0-2.el9_1.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)", product_id: "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.x86_64", }, product_reference: "thunderbird-debuginfo-0:102.10.0-2.el9_1.x86_64", relates_to_product_reference: "AppStream-9.1.0.Z.MAIN", }, { category: "default_component_of", full_product_name: { name: "thunderbird-debugsource-0:102.10.0-2.el9_1.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)", product_id: "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.aarch64", }, product_reference: "thunderbird-debugsource-0:102.10.0-2.el9_1.aarch64", relates_to_product_reference: "AppStream-9.1.0.Z.MAIN", }, { category: "default_component_of", full_product_name: { name: "thunderbird-debugsource-0:102.10.0-2.el9_1.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)", product_id: "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.ppc64le", }, product_reference: "thunderbird-debugsource-0:102.10.0-2.el9_1.ppc64le", relates_to_product_reference: "AppStream-9.1.0.Z.MAIN", }, { category: "default_component_of", full_product_name: { name: "thunderbird-debugsource-0:102.10.0-2.el9_1.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)", product_id: "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.s390x", }, product_reference: "thunderbird-debugsource-0:102.10.0-2.el9_1.s390x", relates_to_product_reference: "AppStream-9.1.0.Z.MAIN", }, { category: "default_component_of", full_product_name: { name: "thunderbird-debugsource-0:102.10.0-2.el9_1.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)", product_id: "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.x86_64", }, product_reference: "thunderbird-debugsource-0:102.10.0-2.el9_1.x86_64", relates_to_product_reference: "AppStream-9.1.0.Z.MAIN", }, ], }, vulnerabilities: [ { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Paul Menzel", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-0547", cwe: { id: "CWE-356", name: "Product UI does not Warn User of Unsafe Actions", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186734", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nOCSP revocation status of recipient certificates was not checked when sending S/Mime encrypted email, and revoked certificates would be accepted. Thunderbird versions from 68 to 102.9.1 were affected by this bug.", title: "Vulnerability description", }, { category: "summary", text: "Thunderbird: Revocation status of S/Mime recipient certificates was not checked", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.src", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-0547", }, { category: "external", summary: "RHBZ#2186734", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186734", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-0547", url: "https://www.cve.org/CVERecord?id=CVE-2023-0547", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-0547", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-0547", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-15/#CVE-2023-0547", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-15/#CVE-2023-0547", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T14:10:15+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.src", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1809", }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 7.5, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.src", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "Thunderbird: Revocation status of S/Mime recipient certificates was not checked", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Gabriele Svelto", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-1945", cwe: { id: "CWE-119", name: "Improper Restriction of Operations within the Bounds of a Memory Buffer", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186109", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nUnexpected data returned from the Safe Browsing API could have led to memory corruption and a potentially exploitable crash.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Memory Corruption in Safe Browsing Code", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.src", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-1945", }, { category: "external", summary: "RHBZ#2186109", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186109", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-1945", url: "https://www.cve.org/CVERecord?id=CVE-2023-1945", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-1945", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-1945", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-1945", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-1945", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T14:10:15+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.src", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1809", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "NONE", baseScore: 6.1, baseSeverity: "MEDIUM", confidentialityImpact: "LOW", integrityImpact: "LOW", privilegesRequired: "NONE", scope: "CHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", version: "3.1", }, products: [ "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.src", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "Mozilla: Memory Corruption in Safe Browsing Code", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Irvan Kurniawan", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-1999", cwe: { id: "CWE-415", name: "Double Free", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186102", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nA double-free in libwebp could have led to memory corruption and a potentially exploitable crash.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: libwebp: Double-free in libwebp", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.src", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-1999", }, { category: "external", summary: "RHBZ#2186102", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186102", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-1999", url: "https://www.cve.org/CVERecord?id=CVE-2023-1999", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-1999", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-1999", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-1999", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-1999", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-15/#CVE-2023-1999", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-15/#CVE-2023-1999", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T14:10:15+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.src", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1809", }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 7.5, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.src", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "Mozilla: libwebp: Double-free in libwebp", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Matrix Security Team", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-28427", cwe: { id: "CWE-1321", name: "Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')", }, discovery_date: "2023-03-28T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2183278", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nThunderbird users who use the Matrix chat protocol were vulnerable to a denial-of-service attack.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Matrix SDK bundled with Thunderbird vulnerable to denial-of-service attack", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.src", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-28427", }, { category: "external", summary: "RHBZ#2183278", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2183278", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-28427", url: "https://www.cve.org/CVERecord?id=CVE-2023-28427", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-28427", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-28427", }, { category: "external", summary: "https://github.com/matrix-org/matrix-js-sdk/security/advisories/GHSA-mwq8-fjpf-c2gr", url: "https://github.com/matrix-org/matrix-js-sdk/security/advisories/GHSA-mwq8-fjpf-c2gr", }, { category: "external", summary: "https://matrix.org/blog/2023/03/28/security-releases-matrix-js-sdk-24-0-0-and-matrix-react-sdk-3-69-0", url: "https://matrix.org/blog/2023/03/28/security-releases-matrix-js-sdk-24-0-0-and-matrix-react-sdk-3-69-0", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-12/#CVE-2023-28427", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-12/#CVE-2023-28427", }, ], release_date: "2023-03-28T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T14:10:15+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.src", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1809", }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 7.5, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.src", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "Mozilla: Matrix SDK bundled with Thunderbird vulnerable to denial-of-service attack", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Ribose RNP Team", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29479", cwe: { id: "CWE-400", name: "Uncontrolled Resource Consumption", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186735", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nCertain malformed OpenPGP messages could trigger incorrect parsing of PKESK/SKESK packets due to a bug in the Ribose RNP library used by Thunderbird up to version 102.9.1, which would cause the Thunderbird user interface to hang. The issue was discovered using Google's oss-fuzz.", title: "Vulnerability description", }, { category: "summary", text: "Thunderbird: Hang when processing certain OpenPGP messages", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.src", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29479", }, { category: "external", summary: "RHBZ#2186735", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186735", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29479", url: "https://www.cve.org/CVERecord?id=CVE-2023-29479", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29479", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29479", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-15/#CVE-2023-29479", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-15/#CVE-2023-29479", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T14:10:15+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.src", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1809", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 6.5, baseSeverity: "MEDIUM", confidentialityImpact: "NONE", integrityImpact: "NONE", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", version: "3.1", }, products: [ "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.src", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "Thunderbird: Hang when processing certain OpenPGP messages", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Irvan Kurniawan", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29533", cwe: { id: "CWE-425", name: "Direct Request ('Forced Browsing')", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186101", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nA website could have obscured the fullscreen notification by using a combination of `window.open`, fullscreen requests, `window.name` assignments, and `setInterval` calls. This could have led to user confusion and possible spoofing attacks.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Fullscreen notification obscured", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.src", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29533", }, { category: "external", summary: "RHBZ#2186101", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186101", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29533", url: "https://www.cve.org/CVERecord?id=CVE-2023-29533", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29533", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29533", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29533", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29533", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T14:10:15+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.src", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1809", }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 7.5, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.src", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "Mozilla: Fullscreen notification obscured", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Lukas Bernhard", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29535", cwe: { id: "CWE-119", name: "Improper Restriction of Operations within the Bounds of a Memory Buffer", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186103", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nFollowing a Garbage Collector compaction, weak maps may have been accessed before they were correctly traced. This resulted in memory corruption and a potentially exploitable crash.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Potential Memory Corruption following Garbage Collector compaction", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.src", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29535", }, { category: "external", summary: "RHBZ#2186103", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186103", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29535", url: "https://www.cve.org/CVERecord?id=CVE-2023-29535", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29535", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29535", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29535", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29535", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T14:10:15+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.src", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1809", }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 7.5, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.src", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "Mozilla: Potential Memory Corruption following Garbage Collector compaction", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "zx from qriousec", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29536", cwe: { id: "CWE-617", name: "Reachable Assertion", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186104", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nAn attacker could cause the memory manager to incorrectly free a pointer that addresses attacker-controlled memory, resulting in an assertion, memory corruption, or a potentially exploitable crash.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Invalid free from JavaScript code", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.src", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29536", }, { category: "external", summary: "RHBZ#2186104", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186104", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29536", url: "https://www.cve.org/CVERecord?id=CVE-2023-29536", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29536", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29536", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29536", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29536", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T14:10:15+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.src", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1809", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 8.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.src", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "Mozilla: Invalid free from JavaScript code", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Trung Pham", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29539", cwe: { id: "CWE-159", name: "Improper Handling of Invalid Use of Special Elements", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186105", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nWhen handling the filename directive in the Content-Disposition header, the filename would be truncated if the filename contained a NULL character. This could have led to reflected file download attacks potentially tricking users to install malware.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Content-Disposition filename truncation leads to Reflected File Download", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.src", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29539", }, { category: "external", summary: "RHBZ#2186105", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186105", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29539", url: "https://www.cve.org/CVERecord?id=CVE-2023-29539", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29539", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29539", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29539", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29539", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T14:10:15+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.src", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1809", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 8.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.src", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "Mozilla: Content-Disposition filename truncation leads to Reflected File Download", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Ameen Basha M K", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29541", cwe: { id: "CWE-434", name: "Unrestricted Upload of File with Dangerous Type", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186106", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nFirefox did not properly handle downloads of files ending in `.desktop`, which can be interpreted to run attacker-controlled commands.\r\n\r\n*This bug only affects Firefox for Linux on certain Distributions. Other operating systems are unaffected, and Mozilla is unable to enumerate all affected Linux Distributions.*", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Files with malicious extensions could have been downloaded unsafely on Linux", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.src", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29541", }, { category: "external", summary: "RHBZ#2186106", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186106", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29541", url: "https://www.cve.org/CVERecord?id=CVE-2023-29541", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29541", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29541", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29541", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29541", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T14:10:15+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.src", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1809", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 8.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.src", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "Mozilla: Files with malicious extensions could have been downloaded unsafely on Linux", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "JunYoung Park", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29548", cwe: { id: "CWE-682", name: "Incorrect Calculation", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186110", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nA wrong lowering instruction in the ARM64 Ion compiler resulted in a wrong optimization result.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Incorrect optimization result on ARM64", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.src", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29548", }, { category: "external", summary: "RHBZ#2186110", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186110", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29548", url: "https://www.cve.org/CVERecord?id=CVE-2023-29548", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29548", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29548", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29548", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29548", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T14:10:15+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.src", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1809", }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "NONE", baseScore: 3.4, baseSeverity: "LOW", confidentialityImpact: "NONE", integrityImpact: "LOW", privilegesRequired: "NONE", scope: "CHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:N", version: "3.1", }, products: [ "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.src", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.x86_64", ], }, ], threats: [ { category: "impact", details: "Low", }, ], title: "Mozilla: Incorrect optimization result on ARM64", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Mozilla developers and community", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29550", cwe: { id: "CWE-120", name: "Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186111", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nMozilla developers Andrew Osmond, Sebastian Hengst, Andrew McCreight, and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 111 and Firefox ESR 102.9. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Memory safety bugs fixed in Firefox 112 and Firefox ESR 102.10", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.src", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29550", }, { category: "external", summary: "RHBZ#2186111", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186111", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29550", url: "https://www.cve.org/CVERecord?id=CVE-2023-29550", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29550", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29550", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29550", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29550", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T14:10:15+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.src", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1809", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 8.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.src", "AppStream-9.1.0.Z.MAIN:thunderbird-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el9_1.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "Mozilla: Memory safety bugs fixed in Firefox 112 and Firefox ESR 102.10", }, ], }
rhsa-2023_1802
Vulnerability from csaf_redhat
Published
2023-04-17 14:01
Modified
2024-12-16 05:27
Summary
Red Hat Security Advisory: thunderbird security update
Notes
Topic
An update for thunderbird is now available for Red Hat Enterprise Linux 8.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Mozilla Thunderbird is a standalone mail and newsgroup client.
This update upgrades Thunderbird to version 102.10.0.
Security Fix(es):
* Thunderbird: Revocation status of S/Mime recipient certificates was not checked (CVE-2023-0547)
* Mozilla: Matrix SDK bundled with Thunderbird vulnerable to denial-of-service attack (CVE-2023-28427)
* Mozilla: Fullscreen notification obscured (CVE-2023-29533)
* Mozilla: Potential Memory Corruption following Garbage Collector compaction (CVE-2023-29535)
* Mozilla: Invalid free from JavaScript code (CVE-2023-29536)
* Mozilla: Memory safety bugs fixed in Firefox 112 and Firefox ESR 102.10 (CVE-2023-29550)
* Mozilla: Memory Corruption in Safe Browsing Code (CVE-2023-1945)
* Thunderbird: Hang when processing certain OpenPGP messages (CVE-2023-29479)
* Mozilla: Content-Disposition filename truncation leads to Reflected File Download (CVE-2023-29539)
* Mozilla: Files with malicious extensions could have been downloaded unsafely on Linux (CVE-2023-29541)
* Mozilla: Incorrect optimization result on ARM64 (CVE-2023-29548)
* MFSA-TMP-2023-0001 Mozilla: Double-free in libwebp (BZ#2186102)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ document: { aggregate_severity: { namespace: "https://access.redhat.com/security/updates/classification/", text: "Important", }, category: "csaf_security_advisory", csaf_version: "2.0", distribution: { text: "Copyright © Red Hat, Inc. All rights reserved.", tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "en", notes: [ { category: "summary", text: "An update for thunderbird is now available for Red Hat Enterprise Linux 8.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", title: "Topic", }, { category: "general", text: "Mozilla Thunderbird is a standalone mail and newsgroup client.\n\nThis update upgrades Thunderbird to version 102.10.0.\n\nSecurity Fix(es):\n\n* Thunderbird: Revocation status of S/Mime recipient certificates was not checked (CVE-2023-0547)\n\n* Mozilla: Matrix SDK bundled with Thunderbird vulnerable to denial-of-service attack (CVE-2023-28427)\n\n* Mozilla: Fullscreen notification obscured (CVE-2023-29533)\n\n* Mozilla: Potential Memory Corruption following Garbage Collector compaction (CVE-2023-29535)\n\n* Mozilla: Invalid free from JavaScript code (CVE-2023-29536)\n\n* Mozilla: Memory safety bugs fixed in Firefox 112 and Firefox ESR 102.10 (CVE-2023-29550)\n\n* Mozilla: Memory Corruption in Safe Browsing Code (CVE-2023-1945)\n\n* Thunderbird: Hang when processing certain OpenPGP messages (CVE-2023-29479)\n\n* Mozilla: Content-Disposition filename truncation leads to Reflected File Download (CVE-2023-29539)\n\n* Mozilla: Files with malicious extensions could have been downloaded unsafely on Linux (CVE-2023-29541)\n\n* Mozilla: Incorrect optimization result on ARM64 (CVE-2023-29548)\n\n* MFSA-TMP-2023-0001 Mozilla: Double-free in libwebp (BZ#2186102)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", title: "Details", }, { category: "legal_disclaimer", text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", title: "Terms of Use", }, ], publisher: { category: "vendor", contact_details: "https://access.redhat.com/security/team/contact/", issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", name: "Red Hat Product Security", namespace: "https://www.redhat.com", }, references: [ { category: "self", summary: "https://access.redhat.com/errata/RHSA-2023:1802", url: "https://access.redhat.com/errata/RHSA-2023:1802", }, { category: "external", summary: "https://access.redhat.com/security/updates/classification/#important", url: "https://access.redhat.com/security/updates/classification/#important", }, { category: "external", summary: "2183278", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2183278", }, { category: "external", summary: "2186101", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186101", }, { category: "external", summary: "2186102", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186102", }, { category: "external", summary: "2186103", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186103", }, { category: "external", summary: "2186104", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186104", }, { category: "external", summary: "2186105", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186105", }, { category: "external", summary: "2186106", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186106", }, { category: "external", summary: "2186109", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186109", }, { category: "external", summary: "2186110", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186110", }, { category: "external", summary: "2186111", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186111", }, { category: "external", summary: "2186734", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186734", }, { category: "external", summary: "2186735", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186735", }, { category: "self", summary: "Canonical URL", url: "https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_1802.json", }, ], title: "Red Hat Security Advisory: thunderbird security update", tracking: { current_release_date: "2024-12-16T05:27:42+00:00", generator: { date: "2024-12-16T05:27:42+00:00", engine: { name: "Red Hat SDEngine", version: "4.2.3", }, }, id: "RHSA-2023:1802", initial_release_date: "2023-04-17T14:01:57+00:00", revision_history: [ { date: "2023-04-17T14:01:57+00:00", number: "1", summary: "Initial version", }, { date: "2023-04-17T14:01:57+00:00", number: "2", summary: "Last updated version", }, { date: "2024-12-16T05:27:42+00:00", number: "3", summary: "Last generated version", }, ], status: "final", version: "3", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_name", name: "Red Hat Enterprise Linux AppStream (v. 8)", product: { name: "Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.7.0.Z.MAIN", product_identification_helper: { cpe: "cpe:/a:redhat:enterprise_linux:8::appstream", }, }, }, ], category: "product_family", name: "Red Hat Enterprise Linux", }, { branches: [ { category: "product_version", name: "thunderbird-0:102.10.0-2.el8_7.src", product: { name: "thunderbird-0:102.10.0-2.el8_7.src", product_id: "thunderbird-0:102.10.0-2.el8_7.src", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird@102.10.0-2.el8_7?arch=src", }, }, }, ], category: "architecture", name: "src", }, { branches: [ { category: "product_version", name: "thunderbird-0:102.10.0-2.el8_7.aarch64", product: { name: "thunderbird-0:102.10.0-2.el8_7.aarch64", product_id: "thunderbird-0:102.10.0-2.el8_7.aarch64", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird@102.10.0-2.el8_7?arch=aarch64", }, }, }, { category: "product_version", name: "thunderbird-debugsource-0:102.10.0-2.el8_7.aarch64", product: { name: "thunderbird-debugsource-0:102.10.0-2.el8_7.aarch64", product_id: "thunderbird-debugsource-0:102.10.0-2.el8_7.aarch64", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird-debugsource@102.10.0-2.el8_7?arch=aarch64", }, }, }, { category: "product_version", name: "thunderbird-debuginfo-0:102.10.0-2.el8_7.aarch64", product: { name: "thunderbird-debuginfo-0:102.10.0-2.el8_7.aarch64", product_id: "thunderbird-debuginfo-0:102.10.0-2.el8_7.aarch64", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird-debuginfo@102.10.0-2.el8_7?arch=aarch64", }, }, }, ], category: "architecture", name: "aarch64", }, { branches: [ { category: "product_version", name: "thunderbird-0:102.10.0-2.el8_7.ppc64le", product: { name: "thunderbird-0:102.10.0-2.el8_7.ppc64le", product_id: "thunderbird-0:102.10.0-2.el8_7.ppc64le", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird@102.10.0-2.el8_7?arch=ppc64le", }, }, }, { category: "product_version", name: "thunderbird-debugsource-0:102.10.0-2.el8_7.ppc64le", product: { name: "thunderbird-debugsource-0:102.10.0-2.el8_7.ppc64le", product_id: "thunderbird-debugsource-0:102.10.0-2.el8_7.ppc64le", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird-debugsource@102.10.0-2.el8_7?arch=ppc64le", }, }, }, { category: "product_version", name: "thunderbird-debuginfo-0:102.10.0-2.el8_7.ppc64le", product: { name: "thunderbird-debuginfo-0:102.10.0-2.el8_7.ppc64le", product_id: "thunderbird-debuginfo-0:102.10.0-2.el8_7.ppc64le", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird-debuginfo@102.10.0-2.el8_7?arch=ppc64le", }, }, }, ], category: "architecture", name: "ppc64le", }, { branches: [ { category: "product_version", name: "thunderbird-0:102.10.0-2.el8_7.x86_64", product: { name: "thunderbird-0:102.10.0-2.el8_7.x86_64", product_id: "thunderbird-0:102.10.0-2.el8_7.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird@102.10.0-2.el8_7?arch=x86_64", }, }, }, { category: "product_version", name: "thunderbird-debugsource-0:102.10.0-2.el8_7.x86_64", product: { name: "thunderbird-debugsource-0:102.10.0-2.el8_7.x86_64", product_id: "thunderbird-debugsource-0:102.10.0-2.el8_7.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird-debugsource@102.10.0-2.el8_7?arch=x86_64", }, }, }, { category: "product_version", name: "thunderbird-debuginfo-0:102.10.0-2.el8_7.x86_64", product: { name: "thunderbird-debuginfo-0:102.10.0-2.el8_7.x86_64", product_id: "thunderbird-debuginfo-0:102.10.0-2.el8_7.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird-debuginfo@102.10.0-2.el8_7?arch=x86_64", }, }, }, ], category: "architecture", name: "x86_64", }, { branches: [ { category: "product_version", name: "thunderbird-0:102.10.0-2.el8_7.s390x", product: { name: "thunderbird-0:102.10.0-2.el8_7.s390x", product_id: "thunderbird-0:102.10.0-2.el8_7.s390x", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird@102.10.0-2.el8_7?arch=s390x", }, }, }, { category: "product_version", name: "thunderbird-debugsource-0:102.10.0-2.el8_7.s390x", product: { name: "thunderbird-debugsource-0:102.10.0-2.el8_7.s390x", product_id: "thunderbird-debugsource-0:102.10.0-2.el8_7.s390x", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird-debugsource@102.10.0-2.el8_7?arch=s390x", }, }, }, { category: "product_version", name: "thunderbird-debuginfo-0:102.10.0-2.el8_7.s390x", product: { name: "thunderbird-debuginfo-0:102.10.0-2.el8_7.s390x", product_id: "thunderbird-debuginfo-0:102.10.0-2.el8_7.s390x", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird-debuginfo@102.10.0-2.el8_7?arch=s390x", }, }, }, ], category: "architecture", name: "s390x", }, ], category: "vendor", name: "Red Hat", }, ], relationships: [ { category: "default_component_of", full_product_name: { name: "thunderbird-0:102.10.0-2.el8_7.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.aarch64", }, product_reference: "thunderbird-0:102.10.0-2.el8_7.aarch64", relates_to_product_reference: "AppStream-8.7.0.Z.MAIN", }, { category: "default_component_of", full_product_name: { name: "thunderbird-0:102.10.0-2.el8_7.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.ppc64le", }, product_reference: "thunderbird-0:102.10.0-2.el8_7.ppc64le", relates_to_product_reference: "AppStream-8.7.0.Z.MAIN", }, { category: "default_component_of", full_product_name: { name: "thunderbird-0:102.10.0-2.el8_7.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.s390x", }, product_reference: "thunderbird-0:102.10.0-2.el8_7.s390x", relates_to_product_reference: "AppStream-8.7.0.Z.MAIN", }, { category: "default_component_of", full_product_name: { name: "thunderbird-0:102.10.0-2.el8_7.src as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.src", }, product_reference: "thunderbird-0:102.10.0-2.el8_7.src", relates_to_product_reference: "AppStream-8.7.0.Z.MAIN", }, { category: "default_component_of", full_product_name: { name: "thunderbird-0:102.10.0-2.el8_7.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.x86_64", }, product_reference: "thunderbird-0:102.10.0-2.el8_7.x86_64", relates_to_product_reference: "AppStream-8.7.0.Z.MAIN", }, { category: "default_component_of", full_product_name: { name: "thunderbird-debuginfo-0:102.10.0-2.el8_7.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.aarch64", }, product_reference: "thunderbird-debuginfo-0:102.10.0-2.el8_7.aarch64", relates_to_product_reference: "AppStream-8.7.0.Z.MAIN", }, { category: "default_component_of", full_product_name: { name: "thunderbird-debuginfo-0:102.10.0-2.el8_7.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.ppc64le", }, product_reference: "thunderbird-debuginfo-0:102.10.0-2.el8_7.ppc64le", relates_to_product_reference: "AppStream-8.7.0.Z.MAIN", }, { category: "default_component_of", full_product_name: { name: "thunderbird-debuginfo-0:102.10.0-2.el8_7.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.s390x", }, product_reference: "thunderbird-debuginfo-0:102.10.0-2.el8_7.s390x", relates_to_product_reference: "AppStream-8.7.0.Z.MAIN", }, { category: "default_component_of", full_product_name: { name: "thunderbird-debuginfo-0:102.10.0-2.el8_7.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.x86_64", }, product_reference: "thunderbird-debuginfo-0:102.10.0-2.el8_7.x86_64", relates_to_product_reference: "AppStream-8.7.0.Z.MAIN", }, { category: "default_component_of", full_product_name: { name: "thunderbird-debugsource-0:102.10.0-2.el8_7.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.aarch64", }, product_reference: "thunderbird-debugsource-0:102.10.0-2.el8_7.aarch64", relates_to_product_reference: "AppStream-8.7.0.Z.MAIN", }, { category: "default_component_of", full_product_name: { name: "thunderbird-debugsource-0:102.10.0-2.el8_7.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.ppc64le", }, product_reference: "thunderbird-debugsource-0:102.10.0-2.el8_7.ppc64le", relates_to_product_reference: "AppStream-8.7.0.Z.MAIN", }, { category: "default_component_of", full_product_name: { name: "thunderbird-debugsource-0:102.10.0-2.el8_7.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.s390x", }, product_reference: "thunderbird-debugsource-0:102.10.0-2.el8_7.s390x", relates_to_product_reference: "AppStream-8.7.0.Z.MAIN", }, { category: "default_component_of", full_product_name: { name: "thunderbird-debugsource-0:102.10.0-2.el8_7.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.x86_64", }, product_reference: "thunderbird-debugsource-0:102.10.0-2.el8_7.x86_64", relates_to_product_reference: "AppStream-8.7.0.Z.MAIN", }, ], }, vulnerabilities: [ { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Paul Menzel", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-0547", cwe: { id: "CWE-356", name: "Product UI does not Warn User of Unsafe Actions", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186734", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nOCSP revocation status of recipient certificates was not checked when sending S/Mime encrypted email, and revoked certificates would be accepted. Thunderbird versions from 68 to 102.9.1 were affected by this bug.", title: "Vulnerability description", }, { category: "summary", text: "Thunderbird: Revocation status of S/Mime recipient certificates was not checked", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.src", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-0547", }, { category: "external", summary: "RHBZ#2186734", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186734", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-0547", url: "https://www.cve.org/CVERecord?id=CVE-2023-0547", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-0547", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-0547", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-15/#CVE-2023-0547", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-15/#CVE-2023-0547", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T14:01:57+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.src", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1802", }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 7.5, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.src", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "Thunderbird: Revocation status of S/Mime recipient certificates was not checked", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Gabriele Svelto", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-1945", cwe: { id: "CWE-119", name: "Improper Restriction of Operations within the Bounds of a Memory Buffer", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186109", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nUnexpected data returned from the Safe Browsing API could have led to memory corruption and a potentially exploitable crash.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Memory Corruption in Safe Browsing Code", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.src", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-1945", }, { category: "external", summary: "RHBZ#2186109", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186109", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-1945", url: "https://www.cve.org/CVERecord?id=CVE-2023-1945", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-1945", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-1945", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-1945", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-1945", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T14:01:57+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.src", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1802", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "NONE", baseScore: 6.1, baseSeverity: "MEDIUM", confidentialityImpact: "LOW", integrityImpact: "LOW", privilegesRequired: "NONE", scope: "CHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", version: "3.1", }, products: [ "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.src", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "Mozilla: Memory Corruption in Safe Browsing Code", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Irvan Kurniawan", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-1999", cwe: { id: "CWE-415", name: "Double Free", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186102", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nA double-free in libwebp could have led to memory corruption and a potentially exploitable crash.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: libwebp: Double-free in libwebp", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.src", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-1999", }, { category: "external", summary: "RHBZ#2186102", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186102", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-1999", url: "https://www.cve.org/CVERecord?id=CVE-2023-1999", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-1999", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-1999", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-1999", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-1999", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-15/#CVE-2023-1999", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-15/#CVE-2023-1999", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T14:01:57+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.src", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1802", }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 7.5, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.src", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "Mozilla: libwebp: Double-free in libwebp", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Matrix Security Team", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-28427", cwe: { id: "CWE-1321", name: "Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')", }, discovery_date: "2023-03-28T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2183278", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nThunderbird users who use the Matrix chat protocol were vulnerable to a denial-of-service attack.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Matrix SDK bundled with Thunderbird vulnerable to denial-of-service attack", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.src", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-28427", }, { category: "external", summary: "RHBZ#2183278", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2183278", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-28427", url: "https://www.cve.org/CVERecord?id=CVE-2023-28427", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-28427", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-28427", }, { category: "external", summary: "https://github.com/matrix-org/matrix-js-sdk/security/advisories/GHSA-mwq8-fjpf-c2gr", url: "https://github.com/matrix-org/matrix-js-sdk/security/advisories/GHSA-mwq8-fjpf-c2gr", }, { category: "external", summary: "https://matrix.org/blog/2023/03/28/security-releases-matrix-js-sdk-24-0-0-and-matrix-react-sdk-3-69-0", url: "https://matrix.org/blog/2023/03/28/security-releases-matrix-js-sdk-24-0-0-and-matrix-react-sdk-3-69-0", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-12/#CVE-2023-28427", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-12/#CVE-2023-28427", }, ], release_date: "2023-03-28T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T14:01:57+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.src", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1802", }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 7.5, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.src", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "Mozilla: Matrix SDK bundled with Thunderbird vulnerable to denial-of-service attack", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Ribose RNP Team", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29479", cwe: { id: "CWE-400", name: "Uncontrolled Resource Consumption", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186735", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nCertain malformed OpenPGP messages could trigger incorrect parsing of PKESK/SKESK packets due to a bug in the Ribose RNP library used by Thunderbird up to version 102.9.1, which would cause the Thunderbird user interface to hang. The issue was discovered using Google's oss-fuzz.", title: "Vulnerability description", }, { category: "summary", text: "Thunderbird: Hang when processing certain OpenPGP messages", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.src", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29479", }, { category: "external", summary: "RHBZ#2186735", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186735", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29479", url: "https://www.cve.org/CVERecord?id=CVE-2023-29479", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29479", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29479", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-15/#CVE-2023-29479", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-15/#CVE-2023-29479", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T14:01:57+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.src", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1802", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 6.5, baseSeverity: "MEDIUM", confidentialityImpact: "NONE", integrityImpact: "NONE", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", version: "3.1", }, products: [ "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.src", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "Thunderbird: Hang when processing certain OpenPGP messages", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Irvan Kurniawan", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29533", cwe: { id: "CWE-425", name: "Direct Request ('Forced Browsing')", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186101", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nA website could have obscured the fullscreen notification by using a combination of `window.open`, fullscreen requests, `window.name` assignments, and `setInterval` calls. This could have led to user confusion and possible spoofing attacks.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Fullscreen notification obscured", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.src", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29533", }, { category: "external", summary: "RHBZ#2186101", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186101", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29533", url: "https://www.cve.org/CVERecord?id=CVE-2023-29533", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29533", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29533", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29533", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29533", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T14:01:57+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.src", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1802", }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 7.5, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.src", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "Mozilla: Fullscreen notification obscured", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Lukas Bernhard", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29535", cwe: { id: "CWE-119", name: "Improper Restriction of Operations within the Bounds of a Memory Buffer", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186103", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nFollowing a Garbage Collector compaction, weak maps may have been accessed before they were correctly traced. This resulted in memory corruption and a potentially exploitable crash.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Potential Memory Corruption following Garbage Collector compaction", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.src", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29535", }, { category: "external", summary: "RHBZ#2186103", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186103", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29535", url: "https://www.cve.org/CVERecord?id=CVE-2023-29535", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29535", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29535", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29535", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29535", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T14:01:57+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.src", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1802", }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 7.5, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.src", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "Mozilla: Potential Memory Corruption following Garbage Collector compaction", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "zx from qriousec", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29536", cwe: { id: "CWE-617", name: "Reachable Assertion", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186104", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nAn attacker could cause the memory manager to incorrectly free a pointer that addresses attacker-controlled memory, resulting in an assertion, memory corruption, or a potentially exploitable crash.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Invalid free from JavaScript code", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.src", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29536", }, { category: "external", summary: "RHBZ#2186104", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186104", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29536", url: "https://www.cve.org/CVERecord?id=CVE-2023-29536", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29536", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29536", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29536", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29536", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T14:01:57+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.src", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1802", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 8.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.src", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "Mozilla: Invalid free from JavaScript code", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Trung Pham", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29539", cwe: { id: "CWE-159", name: "Improper Handling of Invalid Use of Special Elements", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186105", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nWhen handling the filename directive in the Content-Disposition header, the filename would be truncated if the filename contained a NULL character. This could have led to reflected file download attacks potentially tricking users to install malware.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Content-Disposition filename truncation leads to Reflected File Download", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.src", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29539", }, { category: "external", summary: "RHBZ#2186105", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186105", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29539", url: "https://www.cve.org/CVERecord?id=CVE-2023-29539", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29539", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29539", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29539", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29539", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T14:01:57+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.src", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1802", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 8.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.src", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "Mozilla: Content-Disposition filename truncation leads to Reflected File Download", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Ameen Basha M K", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29541", cwe: { id: "CWE-434", name: "Unrestricted Upload of File with Dangerous Type", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186106", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nFirefox did not properly handle downloads of files ending in `.desktop`, which can be interpreted to run attacker-controlled commands.\r\n\r\n*This bug only affects Firefox for Linux on certain Distributions. Other operating systems are unaffected, and Mozilla is unable to enumerate all affected Linux Distributions.*", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Files with malicious extensions could have been downloaded unsafely on Linux", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.src", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29541", }, { category: "external", summary: "RHBZ#2186106", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186106", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29541", url: "https://www.cve.org/CVERecord?id=CVE-2023-29541", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29541", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29541", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29541", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29541", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T14:01:57+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.src", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1802", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 8.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.src", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "Mozilla: Files with malicious extensions could have been downloaded unsafely on Linux", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "JunYoung Park", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29548", cwe: { id: "CWE-682", name: "Incorrect Calculation", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186110", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nA wrong lowering instruction in the ARM64 Ion compiler resulted in a wrong optimization result.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Incorrect optimization result on ARM64", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.src", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29548", }, { category: "external", summary: "RHBZ#2186110", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186110", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29548", url: "https://www.cve.org/CVERecord?id=CVE-2023-29548", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29548", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29548", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29548", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29548", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T14:01:57+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.src", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1802", }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "NONE", baseScore: 3.4, baseSeverity: "LOW", confidentialityImpact: "NONE", integrityImpact: "LOW", privilegesRequired: "NONE", scope: "CHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:N", version: "3.1", }, products: [ "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.src", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.x86_64", ], }, ], threats: [ { category: "impact", details: "Low", }, ], title: "Mozilla: Incorrect optimization result on ARM64", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Mozilla developers and community", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29550", cwe: { id: "CWE-120", name: "Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186111", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nMozilla developers Andrew Osmond, Sebastian Hengst, Andrew McCreight, and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 111 and Firefox ESR 102.9. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Memory safety bugs fixed in Firefox 112 and Firefox ESR 102.10", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.src", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29550", }, { category: "external", summary: "RHBZ#2186111", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186111", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29550", url: "https://www.cve.org/CVERecord?id=CVE-2023-29550", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29550", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29550", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29550", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29550", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T14:01:57+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.src", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1802", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 8.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.src", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "Mozilla: Memory safety bugs fixed in Firefox 112 and Firefox ESR 102.10", }, ], }
rhsa-2023:1805
Vulnerability from csaf_redhat
Published
2023-04-17 14:03
Modified
2024-12-16 05:26
Summary
Red Hat Security Advisory: thunderbird security update
Notes
Topic
An update for thunderbird is now available for Red Hat Enterprise Linux 8.2 Advanced Update Support, Red Hat Enterprise Linux 8.2 Telecommunications Update Service, and Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Mozilla Thunderbird is a standalone mail and newsgroup client.
This update upgrades Thunderbird to version 102.10.0.
Security Fix(es):
* Thunderbird: Revocation status of S/Mime recipient certificates was not checked (CVE-2023-0547)
* Mozilla: Matrix SDK bundled with Thunderbird vulnerable to denial-of-service attack (CVE-2023-28427)
* Mozilla: Fullscreen notification obscured (CVE-2023-29533)
* Mozilla: Potential Memory Corruption following Garbage Collector compaction (CVE-2023-29535)
* Mozilla: Invalid free from JavaScript code (CVE-2023-29536)
* Mozilla: Memory safety bugs fixed in Firefox 112 and Firefox ESR 102.10 (CVE-2023-29550)
* Mozilla: Memory Corruption in Safe Browsing Code (CVE-2023-1945)
* Thunderbird: Hang when processing certain OpenPGP messages (CVE-2023-29479)
* Mozilla: Content-Disposition filename truncation leads to Reflected File Download (CVE-2023-29539)
* Mozilla: Files with malicious extensions could have been downloaded unsafely on Linux (CVE-2023-29541)
* Mozilla: Incorrect optimization result on ARM64 (CVE-2023-29548)
* MFSA-TMP-2023-0001 Mozilla: Double-free in libwebp (BZ#2186102)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ document: { aggregate_severity: { namespace: "https://access.redhat.com/security/updates/classification/", text: "Important", }, category: "csaf_security_advisory", csaf_version: "2.0", distribution: { text: "Copyright © Red Hat, Inc. All rights reserved.", tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "en", notes: [ { category: "summary", text: "An update for thunderbird is now available for Red Hat Enterprise Linux 8.2 Advanced Update Support, Red Hat Enterprise Linux 8.2 Telecommunications Update Service, and Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", title: "Topic", }, { category: "general", text: "Mozilla Thunderbird is a standalone mail and newsgroup client.\n\nThis update upgrades Thunderbird to version 102.10.0.\n\nSecurity Fix(es):\n\n* Thunderbird: Revocation status of S/Mime recipient certificates was not checked (CVE-2023-0547)\n\n* Mozilla: Matrix SDK bundled with Thunderbird vulnerable to denial-of-service attack (CVE-2023-28427)\n\n* Mozilla: Fullscreen notification obscured (CVE-2023-29533)\n\n* Mozilla: Potential Memory Corruption following Garbage Collector compaction (CVE-2023-29535)\n\n* Mozilla: Invalid free from JavaScript code (CVE-2023-29536)\n\n* Mozilla: Memory safety bugs fixed in Firefox 112 and Firefox ESR 102.10 (CVE-2023-29550)\n\n* Mozilla: Memory Corruption in Safe Browsing Code (CVE-2023-1945)\n\n* Thunderbird: Hang when processing certain OpenPGP messages (CVE-2023-29479)\n\n* Mozilla: Content-Disposition filename truncation leads to Reflected File Download (CVE-2023-29539)\n\n* Mozilla: Files with malicious extensions could have been downloaded unsafely on Linux (CVE-2023-29541)\n\n* Mozilla: Incorrect optimization result on ARM64 (CVE-2023-29548)\n\n* MFSA-TMP-2023-0001 Mozilla: Double-free in libwebp (BZ#2186102)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", title: "Details", }, { category: "legal_disclaimer", text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", title: "Terms of Use", }, ], publisher: { category: "vendor", contact_details: "https://access.redhat.com/security/team/contact/", issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", name: "Red Hat Product Security", namespace: "https://www.redhat.com", }, references: [ { category: "self", summary: "https://access.redhat.com/errata/RHSA-2023:1805", url: "https://access.redhat.com/errata/RHSA-2023:1805", }, { category: "external", summary: "https://access.redhat.com/security/updates/classification/#important", url: "https://access.redhat.com/security/updates/classification/#important", }, { category: "external", summary: "2183278", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2183278", }, { category: "external", summary: "2186101", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186101", }, { category: "external", summary: "2186102", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186102", }, { category: "external", summary: "2186103", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186103", }, { category: "external", summary: "2186104", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186104", }, { category: "external", summary: "2186105", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186105", }, { category: "external", summary: "2186106", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186106", }, { category: "external", summary: "2186109", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186109", }, { category: "external", summary: "2186110", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186110", }, { category: "external", summary: "2186111", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186111", }, { category: "external", summary: "2186734", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186734", }, { category: "external", summary: "2186735", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186735", }, { category: "self", summary: "Canonical URL", url: "https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_1805.json", }, ], title: "Red Hat Security Advisory: thunderbird security update", tracking: { current_release_date: "2024-12-16T05:26:37+00:00", generator: { date: "2024-12-16T05:26:37+00:00", engine: { name: "Red Hat SDEngine", version: "4.2.3", }, }, id: "RHSA-2023:1805", initial_release_date: "2023-04-17T14:03:17+00:00", revision_history: [ { date: "2023-04-17T14:03:17+00:00", number: "1", summary: "Initial version", }, { date: "2023-04-17T14:03:17+00:00", number: "2", summary: "Last updated version", }, { date: "2024-12-16T05:26:37+00:00", number: "3", summary: "Last generated version", }, ], status: "final", version: "3", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_name", name: "Red Hat Enterprise Linux AppStream AUS (v. 8.2)", product: { name: "Red Hat Enterprise Linux AppStream AUS (v. 8.2)", product_id: "AppStream-8.2.0.Z.AUS", product_identification_helper: { cpe: "cpe:/a:redhat:rhel_aus:8.2::appstream", }, }, }, { category: "product_name", name: "Red Hat Enterprise Linux AppStream E4S (v. 8.2)", product: { name: "Red Hat Enterprise Linux AppStream E4S (v. 8.2)", product_id: "AppStream-8.2.0.Z.E4S", product_identification_helper: { cpe: "cpe:/a:redhat:rhel_e4s:8.2::appstream", }, }, }, { category: "product_name", name: "Red Hat Enterprise Linux AppStream TUS (v. 8.2)", product: { name: "Red Hat Enterprise Linux AppStream TUS (v. 8.2)", product_id: "AppStream-8.2.0.Z.TUS", product_identification_helper: { cpe: "cpe:/a:redhat:rhel_tus:8.2::appstream", }, }, }, ], category: "product_family", name: "Red Hat Enterprise Linux", }, { branches: [ { category: "product_version", name: "thunderbird-0:102.10.0-2.el8_2.src", product: { name: "thunderbird-0:102.10.0-2.el8_2.src", product_id: "thunderbird-0:102.10.0-2.el8_2.src", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird@102.10.0-2.el8_2?arch=src", }, }, }, ], category: "architecture", name: "src", }, { branches: [ { category: "product_version", name: "thunderbird-0:102.10.0-2.el8_2.x86_64", product: { name: "thunderbird-0:102.10.0-2.el8_2.x86_64", product_id: "thunderbird-0:102.10.0-2.el8_2.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird@102.10.0-2.el8_2?arch=x86_64", }, }, }, { category: "product_version", name: "thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", product: { name: "thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", product_id: "thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird-debugsource@102.10.0-2.el8_2?arch=x86_64", }, }, }, { category: "product_version", name: "thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", product: { name: "thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", product_id: "thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird-debuginfo@102.10.0-2.el8_2?arch=x86_64", }, }, }, ], category: "architecture", name: "x86_64", }, { branches: [ { category: "product_version", name: "thunderbird-0:102.10.0-2.el8_2.ppc64le", product: { name: "thunderbird-0:102.10.0-2.el8_2.ppc64le", product_id: "thunderbird-0:102.10.0-2.el8_2.ppc64le", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird@102.10.0-2.el8_2?arch=ppc64le", }, }, }, { category: "product_version", name: "thunderbird-debugsource-0:102.10.0-2.el8_2.ppc64le", product: { name: "thunderbird-debugsource-0:102.10.0-2.el8_2.ppc64le", product_id: "thunderbird-debugsource-0:102.10.0-2.el8_2.ppc64le", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird-debugsource@102.10.0-2.el8_2?arch=ppc64le", }, }, }, { category: "product_version", name: "thunderbird-debuginfo-0:102.10.0-2.el8_2.ppc64le", product: { name: "thunderbird-debuginfo-0:102.10.0-2.el8_2.ppc64le", product_id: "thunderbird-debuginfo-0:102.10.0-2.el8_2.ppc64le", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird-debuginfo@102.10.0-2.el8_2?arch=ppc64le", }, }, }, ], category: "architecture", name: "ppc64le", }, ], category: "vendor", name: "Red Hat", }, ], relationships: [ { category: "default_component_of", full_product_name: { name: "thunderbird-0:102.10.0-2.el8_2.src as a component of Red Hat Enterprise Linux AppStream AUS (v. 8.2)", product_id: "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.src", }, product_reference: "thunderbird-0:102.10.0-2.el8_2.src", relates_to_product_reference: "AppStream-8.2.0.Z.AUS", }, { category: "default_component_of", full_product_name: { name: "thunderbird-0:102.10.0-2.el8_2.x86_64 as a component of Red Hat Enterprise Linux AppStream AUS (v. 8.2)", product_id: "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.x86_64", }, product_reference: "thunderbird-0:102.10.0-2.el8_2.x86_64", relates_to_product_reference: "AppStream-8.2.0.Z.AUS", }, { category: "default_component_of", full_product_name: { name: "thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64 as a component of Red Hat Enterprise Linux AppStream AUS (v. 8.2)", product_id: "AppStream-8.2.0.Z.AUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", }, product_reference: "thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", relates_to_product_reference: "AppStream-8.2.0.Z.AUS", }, { category: "default_component_of", full_product_name: { name: "thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64 as a component of Red Hat Enterprise Linux AppStream AUS (v. 8.2)", product_id: "AppStream-8.2.0.Z.AUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", }, product_reference: "thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", relates_to_product_reference: "AppStream-8.2.0.Z.AUS", }, { category: "default_component_of", full_product_name: { name: "thunderbird-0:102.10.0-2.el8_2.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v. 8.2)", product_id: "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.ppc64le", }, product_reference: "thunderbird-0:102.10.0-2.el8_2.ppc64le", relates_to_product_reference: "AppStream-8.2.0.Z.E4S", }, { category: "default_component_of", full_product_name: { name: "thunderbird-0:102.10.0-2.el8_2.src as a component of Red Hat Enterprise Linux AppStream E4S (v. 8.2)", product_id: "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.src", }, product_reference: "thunderbird-0:102.10.0-2.el8_2.src", relates_to_product_reference: "AppStream-8.2.0.Z.E4S", }, { category: "default_component_of", full_product_name: { name: "thunderbird-0:102.10.0-2.el8_2.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v. 8.2)", product_id: "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.x86_64", }, product_reference: "thunderbird-0:102.10.0-2.el8_2.x86_64", relates_to_product_reference: "AppStream-8.2.0.Z.E4S", }, { category: "default_component_of", full_product_name: { name: "thunderbird-debuginfo-0:102.10.0-2.el8_2.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v. 8.2)", product_id: "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.ppc64le", }, product_reference: "thunderbird-debuginfo-0:102.10.0-2.el8_2.ppc64le", relates_to_product_reference: "AppStream-8.2.0.Z.E4S", }, { category: "default_component_of", full_product_name: { name: "thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v. 8.2)", product_id: "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", }, product_reference: "thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", relates_to_product_reference: "AppStream-8.2.0.Z.E4S", }, { category: "default_component_of", full_product_name: { name: "thunderbird-debugsource-0:102.10.0-2.el8_2.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v. 8.2)", product_id: "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.ppc64le", }, product_reference: "thunderbird-debugsource-0:102.10.0-2.el8_2.ppc64le", relates_to_product_reference: "AppStream-8.2.0.Z.E4S", }, { category: "default_component_of", full_product_name: { name: "thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v. 8.2)", product_id: "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", }, product_reference: "thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", relates_to_product_reference: "AppStream-8.2.0.Z.E4S", }, { category: "default_component_of", full_product_name: { name: "thunderbird-0:102.10.0-2.el8_2.src as a component of Red Hat Enterprise Linux AppStream TUS (v. 8.2)", product_id: "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.src", }, product_reference: "thunderbird-0:102.10.0-2.el8_2.src", relates_to_product_reference: "AppStream-8.2.0.Z.TUS", }, { category: "default_component_of", full_product_name: { name: "thunderbird-0:102.10.0-2.el8_2.x86_64 as a component of Red Hat Enterprise Linux AppStream TUS (v. 8.2)", product_id: "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.x86_64", }, product_reference: "thunderbird-0:102.10.0-2.el8_2.x86_64", relates_to_product_reference: "AppStream-8.2.0.Z.TUS", }, { category: "default_component_of", full_product_name: { name: "thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64 as a component of Red Hat Enterprise Linux AppStream TUS (v. 8.2)", product_id: "AppStream-8.2.0.Z.TUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", }, product_reference: "thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", relates_to_product_reference: "AppStream-8.2.0.Z.TUS", }, { category: "default_component_of", full_product_name: { name: "thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64 as a component of Red Hat Enterprise Linux AppStream TUS (v. 8.2)", product_id: "AppStream-8.2.0.Z.TUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", }, product_reference: "thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", relates_to_product_reference: "AppStream-8.2.0.Z.TUS", }, ], }, vulnerabilities: [ { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Paul Menzel", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-0547", cwe: { id: "CWE-356", name: "Product UI does not Warn User of Unsafe Actions", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186734", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nOCSP revocation status of recipient certificates was not checked when sending S/Mime encrypted email, and revoked certificates would be accepted. Thunderbird versions from 68 to 102.9.1 were affected by this bug.", title: "Vulnerability description", }, { category: "summary", text: "Thunderbird: Revocation status of S/Mime recipient certificates was not checked", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-0547", }, { category: "external", summary: "RHBZ#2186734", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186734", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-0547", url: "https://www.cve.org/CVERecord?id=CVE-2023-0547", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-0547", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-0547", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-15/#CVE-2023-0547", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-15/#CVE-2023-0547", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T14:03:17+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1805", }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 7.5, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "Thunderbird: Revocation status of S/Mime recipient certificates was not checked", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Gabriele Svelto", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-1945", cwe: { id: "CWE-119", name: "Improper Restriction of Operations within the Bounds of a Memory Buffer", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186109", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nUnexpected data returned from the Safe Browsing API could have led to memory corruption and a potentially exploitable crash.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Memory Corruption in Safe Browsing Code", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-1945", }, { category: "external", summary: "RHBZ#2186109", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186109", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-1945", url: "https://www.cve.org/CVERecord?id=CVE-2023-1945", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-1945", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-1945", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-1945", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-1945", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T14:03:17+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1805", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "NONE", baseScore: 6.1, baseSeverity: "MEDIUM", confidentialityImpact: "LOW", integrityImpact: "LOW", privilegesRequired: "NONE", scope: "CHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", version: "3.1", }, products: [ "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "Mozilla: Memory Corruption in Safe Browsing Code", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Irvan Kurniawan", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-1999", cwe: { id: "CWE-415", name: "Double Free", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186102", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nA double-free in libwebp could have led to memory corruption and a potentially exploitable crash.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: libwebp: Double-free in libwebp", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-1999", }, { category: "external", summary: "RHBZ#2186102", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186102", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-1999", url: "https://www.cve.org/CVERecord?id=CVE-2023-1999", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-1999", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-1999", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-1999", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-1999", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-15/#CVE-2023-1999", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-15/#CVE-2023-1999", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T14:03:17+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1805", }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 7.5, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "Mozilla: libwebp: Double-free in libwebp", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Matrix Security Team", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-28427", cwe: { id: "CWE-1321", name: "Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')", }, discovery_date: "2023-03-28T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2183278", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nThunderbird users who use the Matrix chat protocol were vulnerable to a denial-of-service attack.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Matrix SDK bundled with Thunderbird vulnerable to denial-of-service attack", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-28427", }, { category: "external", summary: "RHBZ#2183278", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2183278", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-28427", url: "https://www.cve.org/CVERecord?id=CVE-2023-28427", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-28427", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-28427", }, { category: "external", summary: "https://github.com/matrix-org/matrix-js-sdk/security/advisories/GHSA-mwq8-fjpf-c2gr", url: "https://github.com/matrix-org/matrix-js-sdk/security/advisories/GHSA-mwq8-fjpf-c2gr", }, { category: "external", summary: "https://matrix.org/blog/2023/03/28/security-releases-matrix-js-sdk-24-0-0-and-matrix-react-sdk-3-69-0", url: "https://matrix.org/blog/2023/03/28/security-releases-matrix-js-sdk-24-0-0-and-matrix-react-sdk-3-69-0", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-12/#CVE-2023-28427", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-12/#CVE-2023-28427", }, ], release_date: "2023-03-28T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T14:03:17+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1805", }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 7.5, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "Mozilla: Matrix SDK bundled with Thunderbird vulnerable to denial-of-service attack", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Ribose RNP Team", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29479", cwe: { id: "CWE-400", name: "Uncontrolled Resource Consumption", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186735", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nCertain malformed OpenPGP messages could trigger incorrect parsing of PKESK/SKESK packets due to a bug in the Ribose RNP library used by Thunderbird up to version 102.9.1, which would cause the Thunderbird user interface to hang. The issue was discovered using Google's oss-fuzz.", title: "Vulnerability description", }, { category: "summary", text: "Thunderbird: Hang when processing certain OpenPGP messages", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29479", }, { category: "external", summary: "RHBZ#2186735", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186735", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29479", url: "https://www.cve.org/CVERecord?id=CVE-2023-29479", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29479", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29479", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-15/#CVE-2023-29479", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-15/#CVE-2023-29479", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T14:03:17+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1805", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 6.5, baseSeverity: "MEDIUM", confidentialityImpact: "NONE", integrityImpact: "NONE", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", version: "3.1", }, products: [ "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "Thunderbird: Hang when processing certain OpenPGP messages", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Irvan Kurniawan", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29533", cwe: { id: "CWE-425", name: "Direct Request ('Forced Browsing')", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186101", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nA website could have obscured the fullscreen notification by using a combination of `window.open`, fullscreen requests, `window.name` assignments, and `setInterval` calls. This could have led to user confusion and possible spoofing attacks.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Fullscreen notification obscured", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29533", }, { category: "external", summary: "RHBZ#2186101", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186101", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29533", url: "https://www.cve.org/CVERecord?id=CVE-2023-29533", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29533", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29533", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29533", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29533", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T14:03:17+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1805", }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 7.5, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "Mozilla: Fullscreen notification obscured", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Lukas Bernhard", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29535", cwe: { id: "CWE-119", name: "Improper Restriction of Operations within the Bounds of a Memory Buffer", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186103", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nFollowing a Garbage Collector compaction, weak maps may have been accessed before they were correctly traced. This resulted in memory corruption and a potentially exploitable crash.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Potential Memory Corruption following Garbage Collector compaction", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29535", }, { category: "external", summary: "RHBZ#2186103", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186103", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29535", url: "https://www.cve.org/CVERecord?id=CVE-2023-29535", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29535", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29535", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29535", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29535", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T14:03:17+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1805", }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 7.5, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "Mozilla: Potential Memory Corruption following Garbage Collector compaction", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "zx from qriousec", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29536", cwe: { id: "CWE-617", name: "Reachable Assertion", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186104", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nAn attacker could cause the memory manager to incorrectly free a pointer that addresses attacker-controlled memory, resulting in an assertion, memory corruption, or a potentially exploitable crash.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Invalid free from JavaScript code", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29536", }, { category: "external", summary: "RHBZ#2186104", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186104", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29536", url: "https://www.cve.org/CVERecord?id=CVE-2023-29536", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29536", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29536", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29536", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29536", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T14:03:17+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1805", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 8.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "Mozilla: Invalid free from JavaScript code", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Trung Pham", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29539", cwe: { id: "CWE-159", name: "Improper Handling of Invalid Use of Special Elements", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186105", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nWhen handling the filename directive in the Content-Disposition header, the filename would be truncated if the filename contained a NULL character. This could have led to reflected file download attacks potentially tricking users to install malware.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Content-Disposition filename truncation leads to Reflected File Download", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29539", }, { category: "external", summary: "RHBZ#2186105", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186105", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29539", url: "https://www.cve.org/CVERecord?id=CVE-2023-29539", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29539", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29539", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29539", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29539", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T14:03:17+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1805", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 8.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "Mozilla: Content-Disposition filename truncation leads to Reflected File Download", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Ameen Basha M K", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29541", cwe: { id: "CWE-434", name: "Unrestricted Upload of File with Dangerous Type", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186106", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nFirefox did not properly handle downloads of files ending in `.desktop`, which can be interpreted to run attacker-controlled commands.\r\n\r\n*This bug only affects Firefox for Linux on certain Distributions. Other operating systems are unaffected, and Mozilla is unable to enumerate all affected Linux Distributions.*", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Files with malicious extensions could have been downloaded unsafely on Linux", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29541", }, { category: "external", summary: "RHBZ#2186106", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186106", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29541", url: "https://www.cve.org/CVERecord?id=CVE-2023-29541", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29541", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29541", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29541", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29541", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T14:03:17+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1805", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 8.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "Mozilla: Files with malicious extensions could have been downloaded unsafely on Linux", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "JunYoung Park", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29548", cwe: { id: "CWE-682", name: "Incorrect Calculation", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186110", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nA wrong lowering instruction in the ARM64 Ion compiler resulted in a wrong optimization result.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Incorrect optimization result on ARM64", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29548", }, { category: "external", summary: "RHBZ#2186110", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186110", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29548", url: "https://www.cve.org/CVERecord?id=CVE-2023-29548", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29548", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29548", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29548", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29548", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T14:03:17+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1805", }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "NONE", baseScore: 3.4, baseSeverity: "LOW", confidentialityImpact: "NONE", integrityImpact: "LOW", privilegesRequired: "NONE", scope: "CHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:N", version: "3.1", }, products: [ "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", ], }, ], threats: [ { category: "impact", details: "Low", }, ], title: "Mozilla: Incorrect optimization result on ARM64", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Mozilla developers and community", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29550", cwe: { id: "CWE-120", name: "Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186111", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nMozilla developers Andrew Osmond, Sebastian Hengst, Andrew McCreight, and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 111 and Firefox ESR 102.9. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Memory safety bugs fixed in Firefox 112 and Firefox ESR 102.10", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29550", }, { category: "external", summary: "RHBZ#2186111", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186111", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29550", url: "https://www.cve.org/CVERecord?id=CVE-2023-29550", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29550", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29550", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29550", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29550", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T14:03:17+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1805", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 8.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "Mozilla: Memory safety bugs fixed in Firefox 112 and Firefox ESR 102.10", }, ], }
RHSA-2023:1805
Vulnerability from csaf_redhat
Published
2023-04-17 14:03
Modified
2024-12-16 05:26
Summary
Red Hat Security Advisory: thunderbird security update
Notes
Topic
An update for thunderbird is now available for Red Hat Enterprise Linux 8.2 Advanced Update Support, Red Hat Enterprise Linux 8.2 Telecommunications Update Service, and Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Mozilla Thunderbird is a standalone mail and newsgroup client.
This update upgrades Thunderbird to version 102.10.0.
Security Fix(es):
* Thunderbird: Revocation status of S/Mime recipient certificates was not checked (CVE-2023-0547)
* Mozilla: Matrix SDK bundled with Thunderbird vulnerable to denial-of-service attack (CVE-2023-28427)
* Mozilla: Fullscreen notification obscured (CVE-2023-29533)
* Mozilla: Potential Memory Corruption following Garbage Collector compaction (CVE-2023-29535)
* Mozilla: Invalid free from JavaScript code (CVE-2023-29536)
* Mozilla: Memory safety bugs fixed in Firefox 112 and Firefox ESR 102.10 (CVE-2023-29550)
* Mozilla: Memory Corruption in Safe Browsing Code (CVE-2023-1945)
* Thunderbird: Hang when processing certain OpenPGP messages (CVE-2023-29479)
* Mozilla: Content-Disposition filename truncation leads to Reflected File Download (CVE-2023-29539)
* Mozilla: Files with malicious extensions could have been downloaded unsafely on Linux (CVE-2023-29541)
* Mozilla: Incorrect optimization result on ARM64 (CVE-2023-29548)
* MFSA-TMP-2023-0001 Mozilla: Double-free in libwebp (BZ#2186102)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ document: { aggregate_severity: { namespace: "https://access.redhat.com/security/updates/classification/", text: "Important", }, category: "csaf_security_advisory", csaf_version: "2.0", distribution: { text: "Copyright © Red Hat, Inc. All rights reserved.", tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "en", notes: [ { category: "summary", text: "An update for thunderbird is now available for Red Hat Enterprise Linux 8.2 Advanced Update Support, Red Hat Enterprise Linux 8.2 Telecommunications Update Service, and Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", title: "Topic", }, { category: "general", text: "Mozilla Thunderbird is a standalone mail and newsgroup client.\n\nThis update upgrades Thunderbird to version 102.10.0.\n\nSecurity Fix(es):\n\n* Thunderbird: Revocation status of S/Mime recipient certificates was not checked (CVE-2023-0547)\n\n* Mozilla: Matrix SDK bundled with Thunderbird vulnerable to denial-of-service attack (CVE-2023-28427)\n\n* Mozilla: Fullscreen notification obscured (CVE-2023-29533)\n\n* Mozilla: Potential Memory Corruption following Garbage Collector compaction (CVE-2023-29535)\n\n* Mozilla: Invalid free from JavaScript code (CVE-2023-29536)\n\n* Mozilla: Memory safety bugs fixed in Firefox 112 and Firefox ESR 102.10 (CVE-2023-29550)\n\n* Mozilla: Memory Corruption in Safe Browsing Code (CVE-2023-1945)\n\n* Thunderbird: Hang when processing certain OpenPGP messages (CVE-2023-29479)\n\n* Mozilla: Content-Disposition filename truncation leads to Reflected File Download (CVE-2023-29539)\n\n* Mozilla: Files with malicious extensions could have been downloaded unsafely on Linux (CVE-2023-29541)\n\n* Mozilla: Incorrect optimization result on ARM64 (CVE-2023-29548)\n\n* MFSA-TMP-2023-0001 Mozilla: Double-free in libwebp (BZ#2186102)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", title: "Details", }, { category: "legal_disclaimer", text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", title: "Terms of Use", }, ], publisher: { category: "vendor", contact_details: "https://access.redhat.com/security/team/contact/", issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", name: "Red Hat Product Security", namespace: "https://www.redhat.com", }, references: [ { category: "self", summary: "https://access.redhat.com/errata/RHSA-2023:1805", url: "https://access.redhat.com/errata/RHSA-2023:1805", }, { category: "external", summary: "https://access.redhat.com/security/updates/classification/#important", url: "https://access.redhat.com/security/updates/classification/#important", }, { category: "external", summary: "2183278", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2183278", }, { category: "external", summary: "2186101", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186101", }, { category: "external", summary: "2186102", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186102", }, { category: "external", summary: "2186103", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186103", }, { category: "external", summary: "2186104", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186104", }, { category: "external", summary: "2186105", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186105", }, { category: "external", summary: "2186106", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186106", }, { category: "external", summary: "2186109", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186109", }, { category: "external", summary: "2186110", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186110", }, { category: "external", summary: "2186111", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186111", }, { category: "external", summary: "2186734", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186734", }, { category: "external", summary: "2186735", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186735", }, { category: "self", summary: "Canonical URL", url: "https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_1805.json", }, ], title: "Red Hat Security Advisory: thunderbird security update", tracking: { current_release_date: "2024-12-16T05:26:37+00:00", generator: { date: "2024-12-16T05:26:37+00:00", engine: { name: "Red Hat SDEngine", version: "4.2.3", }, }, id: "RHSA-2023:1805", initial_release_date: "2023-04-17T14:03:17+00:00", revision_history: [ { date: "2023-04-17T14:03:17+00:00", number: "1", summary: "Initial version", }, { date: "2023-04-17T14:03:17+00:00", number: "2", summary: "Last updated version", }, { date: "2024-12-16T05:26:37+00:00", number: "3", summary: "Last generated version", }, ], status: "final", version: "3", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_name", name: "Red Hat Enterprise Linux AppStream AUS (v. 8.2)", product: { name: "Red Hat Enterprise Linux AppStream AUS (v. 8.2)", product_id: "AppStream-8.2.0.Z.AUS", product_identification_helper: { cpe: "cpe:/a:redhat:rhel_aus:8.2::appstream", }, }, }, { category: "product_name", name: "Red Hat Enterprise Linux AppStream E4S (v. 8.2)", product: { name: "Red Hat Enterprise Linux AppStream E4S (v. 8.2)", product_id: "AppStream-8.2.0.Z.E4S", product_identification_helper: { cpe: "cpe:/a:redhat:rhel_e4s:8.2::appstream", }, }, }, { category: "product_name", name: "Red Hat Enterprise Linux AppStream TUS (v. 8.2)", product: { name: "Red Hat Enterprise Linux AppStream TUS (v. 8.2)", product_id: "AppStream-8.2.0.Z.TUS", product_identification_helper: { cpe: "cpe:/a:redhat:rhel_tus:8.2::appstream", }, }, }, ], category: "product_family", name: "Red Hat Enterprise Linux", }, { branches: [ { category: "product_version", name: "thunderbird-0:102.10.0-2.el8_2.src", product: { name: "thunderbird-0:102.10.0-2.el8_2.src", product_id: "thunderbird-0:102.10.0-2.el8_2.src", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird@102.10.0-2.el8_2?arch=src", }, }, }, ], category: "architecture", name: "src", }, { branches: [ { category: "product_version", name: "thunderbird-0:102.10.0-2.el8_2.x86_64", product: { name: "thunderbird-0:102.10.0-2.el8_2.x86_64", product_id: "thunderbird-0:102.10.0-2.el8_2.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird@102.10.0-2.el8_2?arch=x86_64", }, }, }, { category: "product_version", name: "thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", product: { name: "thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", product_id: "thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird-debugsource@102.10.0-2.el8_2?arch=x86_64", }, }, }, { category: "product_version", name: "thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", product: { name: "thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", product_id: "thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird-debuginfo@102.10.0-2.el8_2?arch=x86_64", }, }, }, ], category: "architecture", name: "x86_64", }, { branches: [ { category: "product_version", name: "thunderbird-0:102.10.0-2.el8_2.ppc64le", product: { name: "thunderbird-0:102.10.0-2.el8_2.ppc64le", product_id: "thunderbird-0:102.10.0-2.el8_2.ppc64le", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird@102.10.0-2.el8_2?arch=ppc64le", }, }, }, { category: "product_version", name: "thunderbird-debugsource-0:102.10.0-2.el8_2.ppc64le", product: { name: "thunderbird-debugsource-0:102.10.0-2.el8_2.ppc64le", product_id: "thunderbird-debugsource-0:102.10.0-2.el8_2.ppc64le", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird-debugsource@102.10.0-2.el8_2?arch=ppc64le", }, }, }, { category: "product_version", name: "thunderbird-debuginfo-0:102.10.0-2.el8_2.ppc64le", product: { name: "thunderbird-debuginfo-0:102.10.0-2.el8_2.ppc64le", product_id: "thunderbird-debuginfo-0:102.10.0-2.el8_2.ppc64le", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird-debuginfo@102.10.0-2.el8_2?arch=ppc64le", }, }, }, ], category: "architecture", name: "ppc64le", }, ], category: "vendor", name: "Red Hat", }, ], relationships: [ { category: "default_component_of", full_product_name: { name: "thunderbird-0:102.10.0-2.el8_2.src as a component of Red Hat Enterprise Linux AppStream AUS (v. 8.2)", product_id: "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.src", }, product_reference: "thunderbird-0:102.10.0-2.el8_2.src", relates_to_product_reference: "AppStream-8.2.0.Z.AUS", }, { category: "default_component_of", full_product_name: { name: "thunderbird-0:102.10.0-2.el8_2.x86_64 as a component of Red Hat Enterprise Linux AppStream AUS (v. 8.2)", product_id: "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.x86_64", }, product_reference: "thunderbird-0:102.10.0-2.el8_2.x86_64", relates_to_product_reference: "AppStream-8.2.0.Z.AUS", }, { category: "default_component_of", full_product_name: { name: "thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64 as a component of Red Hat Enterprise Linux AppStream AUS (v. 8.2)", product_id: "AppStream-8.2.0.Z.AUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", }, product_reference: "thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", relates_to_product_reference: "AppStream-8.2.0.Z.AUS", }, { category: "default_component_of", full_product_name: { name: "thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64 as a component of Red Hat Enterprise Linux AppStream AUS (v. 8.2)", product_id: "AppStream-8.2.0.Z.AUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", }, product_reference: "thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", relates_to_product_reference: "AppStream-8.2.0.Z.AUS", }, { category: "default_component_of", full_product_name: { name: "thunderbird-0:102.10.0-2.el8_2.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v. 8.2)", product_id: "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.ppc64le", }, product_reference: "thunderbird-0:102.10.0-2.el8_2.ppc64le", relates_to_product_reference: "AppStream-8.2.0.Z.E4S", }, { category: "default_component_of", full_product_name: { name: "thunderbird-0:102.10.0-2.el8_2.src as a component of Red Hat Enterprise Linux AppStream E4S (v. 8.2)", product_id: "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.src", }, product_reference: "thunderbird-0:102.10.0-2.el8_2.src", relates_to_product_reference: "AppStream-8.2.0.Z.E4S", }, { category: "default_component_of", full_product_name: { name: "thunderbird-0:102.10.0-2.el8_2.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v. 8.2)", product_id: "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.x86_64", }, product_reference: "thunderbird-0:102.10.0-2.el8_2.x86_64", relates_to_product_reference: "AppStream-8.2.0.Z.E4S", }, { category: "default_component_of", full_product_name: { name: "thunderbird-debuginfo-0:102.10.0-2.el8_2.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v. 8.2)", product_id: "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.ppc64le", }, product_reference: "thunderbird-debuginfo-0:102.10.0-2.el8_2.ppc64le", relates_to_product_reference: "AppStream-8.2.0.Z.E4S", }, { category: "default_component_of", full_product_name: { name: "thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v. 8.2)", product_id: "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", }, product_reference: "thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", relates_to_product_reference: "AppStream-8.2.0.Z.E4S", }, { category: "default_component_of", full_product_name: { name: "thunderbird-debugsource-0:102.10.0-2.el8_2.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v. 8.2)", product_id: "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.ppc64le", }, product_reference: "thunderbird-debugsource-0:102.10.0-2.el8_2.ppc64le", relates_to_product_reference: "AppStream-8.2.0.Z.E4S", }, { category: "default_component_of", full_product_name: { name: "thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v. 8.2)", product_id: "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", }, product_reference: "thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", relates_to_product_reference: "AppStream-8.2.0.Z.E4S", }, { category: "default_component_of", full_product_name: { name: "thunderbird-0:102.10.0-2.el8_2.src as a component of Red Hat Enterprise Linux AppStream TUS (v. 8.2)", product_id: "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.src", }, product_reference: "thunderbird-0:102.10.0-2.el8_2.src", relates_to_product_reference: "AppStream-8.2.0.Z.TUS", }, { category: "default_component_of", full_product_name: { name: "thunderbird-0:102.10.0-2.el8_2.x86_64 as a component of Red Hat Enterprise Linux AppStream TUS (v. 8.2)", product_id: "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.x86_64", }, product_reference: "thunderbird-0:102.10.0-2.el8_2.x86_64", relates_to_product_reference: "AppStream-8.2.0.Z.TUS", }, { category: "default_component_of", full_product_name: { name: "thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64 as a component of Red Hat Enterprise Linux AppStream TUS (v. 8.2)", product_id: "AppStream-8.2.0.Z.TUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", }, product_reference: "thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", relates_to_product_reference: "AppStream-8.2.0.Z.TUS", }, { category: "default_component_of", full_product_name: { name: "thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64 as a component of Red Hat Enterprise Linux AppStream TUS (v. 8.2)", product_id: "AppStream-8.2.0.Z.TUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", }, product_reference: "thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", relates_to_product_reference: "AppStream-8.2.0.Z.TUS", }, ], }, vulnerabilities: [ { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Paul Menzel", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-0547", cwe: { id: "CWE-356", name: "Product UI does not Warn User of Unsafe Actions", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186734", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nOCSP revocation status of recipient certificates was not checked when sending S/Mime encrypted email, and revoked certificates would be accepted. Thunderbird versions from 68 to 102.9.1 were affected by this bug.", title: "Vulnerability description", }, { category: "summary", text: "Thunderbird: Revocation status of S/Mime recipient certificates was not checked", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-0547", }, { category: "external", summary: "RHBZ#2186734", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186734", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-0547", url: "https://www.cve.org/CVERecord?id=CVE-2023-0547", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-0547", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-0547", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-15/#CVE-2023-0547", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-15/#CVE-2023-0547", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T14:03:17+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1805", }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 7.5, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "Thunderbird: Revocation status of S/Mime recipient certificates was not checked", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Gabriele Svelto", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-1945", cwe: { id: "CWE-119", name: "Improper Restriction of Operations within the Bounds of a Memory Buffer", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186109", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nUnexpected data returned from the Safe Browsing API could have led to memory corruption and a potentially exploitable crash.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Memory Corruption in Safe Browsing Code", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-1945", }, { category: "external", summary: "RHBZ#2186109", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186109", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-1945", url: "https://www.cve.org/CVERecord?id=CVE-2023-1945", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-1945", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-1945", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-1945", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-1945", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T14:03:17+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1805", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "NONE", baseScore: 6.1, baseSeverity: "MEDIUM", confidentialityImpact: "LOW", integrityImpact: "LOW", privilegesRequired: "NONE", scope: "CHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", version: "3.1", }, products: [ "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "Mozilla: Memory Corruption in Safe Browsing Code", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Irvan Kurniawan", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-1999", cwe: { id: "CWE-415", name: "Double Free", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186102", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nA double-free in libwebp could have led to memory corruption and a potentially exploitable crash.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: libwebp: Double-free in libwebp", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-1999", }, { category: "external", summary: "RHBZ#2186102", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186102", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-1999", url: "https://www.cve.org/CVERecord?id=CVE-2023-1999", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-1999", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-1999", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-1999", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-1999", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-15/#CVE-2023-1999", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-15/#CVE-2023-1999", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T14:03:17+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1805", }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 7.5, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "Mozilla: libwebp: Double-free in libwebp", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Matrix Security Team", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-28427", cwe: { id: "CWE-1321", name: "Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')", }, discovery_date: "2023-03-28T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2183278", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nThunderbird users who use the Matrix chat protocol were vulnerable to a denial-of-service attack.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Matrix SDK bundled with Thunderbird vulnerable to denial-of-service attack", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-28427", }, { category: "external", summary: "RHBZ#2183278", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2183278", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-28427", url: "https://www.cve.org/CVERecord?id=CVE-2023-28427", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-28427", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-28427", }, { category: "external", summary: "https://github.com/matrix-org/matrix-js-sdk/security/advisories/GHSA-mwq8-fjpf-c2gr", url: "https://github.com/matrix-org/matrix-js-sdk/security/advisories/GHSA-mwq8-fjpf-c2gr", }, { category: "external", summary: "https://matrix.org/blog/2023/03/28/security-releases-matrix-js-sdk-24-0-0-and-matrix-react-sdk-3-69-0", url: "https://matrix.org/blog/2023/03/28/security-releases-matrix-js-sdk-24-0-0-and-matrix-react-sdk-3-69-0", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-12/#CVE-2023-28427", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-12/#CVE-2023-28427", }, ], release_date: "2023-03-28T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T14:03:17+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1805", }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 7.5, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "Mozilla: Matrix SDK bundled with Thunderbird vulnerable to denial-of-service attack", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Ribose RNP Team", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29479", cwe: { id: "CWE-400", name: "Uncontrolled Resource Consumption", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186735", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nCertain malformed OpenPGP messages could trigger incorrect parsing of PKESK/SKESK packets due to a bug in the Ribose RNP library used by Thunderbird up to version 102.9.1, which would cause the Thunderbird user interface to hang. The issue was discovered using Google's oss-fuzz.", title: "Vulnerability description", }, { category: "summary", text: "Thunderbird: Hang when processing certain OpenPGP messages", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29479", }, { category: "external", summary: "RHBZ#2186735", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186735", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29479", url: "https://www.cve.org/CVERecord?id=CVE-2023-29479", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29479", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29479", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-15/#CVE-2023-29479", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-15/#CVE-2023-29479", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T14:03:17+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1805", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 6.5, baseSeverity: "MEDIUM", confidentialityImpact: "NONE", integrityImpact: "NONE", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", version: "3.1", }, products: [ "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "Thunderbird: Hang when processing certain OpenPGP messages", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Irvan Kurniawan", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29533", cwe: { id: "CWE-425", name: "Direct Request ('Forced Browsing')", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186101", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nA website could have obscured the fullscreen notification by using a combination of `window.open`, fullscreen requests, `window.name` assignments, and `setInterval` calls. This could have led to user confusion and possible spoofing attacks.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Fullscreen notification obscured", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29533", }, { category: "external", summary: "RHBZ#2186101", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186101", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29533", url: "https://www.cve.org/CVERecord?id=CVE-2023-29533", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29533", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29533", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29533", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29533", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T14:03:17+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1805", }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 7.5, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "Mozilla: Fullscreen notification obscured", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Lukas Bernhard", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29535", cwe: { id: "CWE-119", name: "Improper Restriction of Operations within the Bounds of a Memory Buffer", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186103", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nFollowing a Garbage Collector compaction, weak maps may have been accessed before they were correctly traced. This resulted in memory corruption and a potentially exploitable crash.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Potential Memory Corruption following Garbage Collector compaction", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29535", }, { category: "external", summary: "RHBZ#2186103", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186103", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29535", url: "https://www.cve.org/CVERecord?id=CVE-2023-29535", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29535", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29535", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29535", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29535", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T14:03:17+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1805", }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 7.5, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "Mozilla: Potential Memory Corruption following Garbage Collector compaction", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "zx from qriousec", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29536", cwe: { id: "CWE-617", name: "Reachable Assertion", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186104", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nAn attacker could cause the memory manager to incorrectly free a pointer that addresses attacker-controlled memory, resulting in an assertion, memory corruption, or a potentially exploitable crash.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Invalid free from JavaScript code", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29536", }, { category: "external", summary: "RHBZ#2186104", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186104", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29536", url: "https://www.cve.org/CVERecord?id=CVE-2023-29536", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29536", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29536", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29536", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29536", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T14:03:17+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1805", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 8.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "Mozilla: Invalid free from JavaScript code", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Trung Pham", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29539", cwe: { id: "CWE-159", name: "Improper Handling of Invalid Use of Special Elements", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186105", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nWhen handling the filename directive in the Content-Disposition header, the filename would be truncated if the filename contained a NULL character. This could have led to reflected file download attacks potentially tricking users to install malware.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Content-Disposition filename truncation leads to Reflected File Download", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29539", }, { category: "external", summary: "RHBZ#2186105", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186105", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29539", url: "https://www.cve.org/CVERecord?id=CVE-2023-29539", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29539", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29539", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29539", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29539", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T14:03:17+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1805", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 8.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "Mozilla: Content-Disposition filename truncation leads to Reflected File Download", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Ameen Basha M K", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29541", cwe: { id: "CWE-434", name: "Unrestricted Upload of File with Dangerous Type", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186106", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nFirefox did not properly handle downloads of files ending in `.desktop`, which can be interpreted to run attacker-controlled commands.\r\n\r\n*This bug only affects Firefox for Linux on certain Distributions. Other operating systems are unaffected, and Mozilla is unable to enumerate all affected Linux Distributions.*", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Files with malicious extensions could have been downloaded unsafely on Linux", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29541", }, { category: "external", summary: "RHBZ#2186106", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186106", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29541", url: "https://www.cve.org/CVERecord?id=CVE-2023-29541", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29541", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29541", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29541", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29541", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T14:03:17+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1805", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 8.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "Mozilla: Files with malicious extensions could have been downloaded unsafely on Linux", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "JunYoung Park", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29548", cwe: { id: "CWE-682", name: "Incorrect Calculation", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186110", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nA wrong lowering instruction in the ARM64 Ion compiler resulted in a wrong optimization result.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Incorrect optimization result on ARM64", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29548", }, { category: "external", summary: "RHBZ#2186110", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186110", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29548", url: "https://www.cve.org/CVERecord?id=CVE-2023-29548", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29548", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29548", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29548", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29548", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T14:03:17+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1805", }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "NONE", baseScore: 3.4, baseSeverity: "LOW", confidentialityImpact: "NONE", integrityImpact: "LOW", privilegesRequired: "NONE", scope: "CHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:N", version: "3.1", }, products: [ "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", ], }, ], threats: [ { category: "impact", details: "Low", }, ], title: "Mozilla: Incorrect optimization result on ARM64", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Mozilla developers and community", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29550", cwe: { id: "CWE-120", name: "Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186111", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nMozilla developers Andrew Osmond, Sebastian Hengst, Andrew McCreight, and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 111 and Firefox ESR 102.9. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Memory safety bugs fixed in Firefox 112 and Firefox ESR 102.10", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29550", }, { category: "external", summary: "RHBZ#2186111", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186111", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29550", url: "https://www.cve.org/CVERecord?id=CVE-2023-29550", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29550", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29550", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29550", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29550", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T14:03:17+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1805", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 8.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.AUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.AUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.E4S:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.ppc64le", "AppStream-8.2.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.src", "AppStream-8.2.0.Z.TUS:thunderbird-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debuginfo-0:102.10.0-2.el8_2.x86_64", "AppStream-8.2.0.Z.TUS:thunderbird-debugsource-0:102.10.0-2.el8_2.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "Mozilla: Memory safety bugs fixed in Firefox 112 and Firefox ESR 102.10", }, ], }
rhsa-2023_1810
Vulnerability from csaf_redhat
Published
2023-04-17 15:03
Modified
2024-12-16 05:27
Summary
Red Hat Security Advisory: thunderbird security update
Notes
Topic
An update for thunderbird is now available for Red Hat Enterprise Linux 9.0 Extended Update Support.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Mozilla Thunderbird is a standalone mail and newsgroup client.
This update upgrades Thunderbird to version 102.10.0.
Security Fix(es):
* Thunderbird: Revocation status of S/Mime recipient certificates was not checked (CVE-2023-0547)
* Mozilla: Matrix SDK bundled with Thunderbird vulnerable to denial-of-service attack (CVE-2023-28427)
* Mozilla: Fullscreen notification obscured (CVE-2023-29533)
* Mozilla: Potential Memory Corruption following Garbage Collector compaction (CVE-2023-29535)
* Mozilla: Invalid free from JavaScript code (CVE-2023-29536)
* Mozilla: Memory safety bugs fixed in Firefox 112 and Firefox ESR 102.10 (CVE-2023-29550)
* Mozilla: Memory Corruption in Safe Browsing Code (CVE-2023-1945)
* Thunderbird: Hang when processing certain OpenPGP messages (CVE-2023-29479)
* Mozilla: Content-Disposition filename truncation leads to Reflected File Download (CVE-2023-29539)
* Mozilla: Files with malicious extensions could have been downloaded unsafely on Linux (CVE-2023-29541)
* Mozilla: Incorrect optimization result on ARM64 (CVE-2023-29548)
* MFSA-TMP-2023-0001 Mozilla: Double-free in libwebp (BZ#2186102)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ document: { aggregate_severity: { namespace: "https://access.redhat.com/security/updates/classification/", text: "Important", }, category: "csaf_security_advisory", csaf_version: "2.0", distribution: { text: "Copyright © Red Hat, Inc. All rights reserved.", tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "en", notes: [ { category: "summary", text: "An update for thunderbird is now available for Red Hat Enterprise Linux 9.0 Extended Update Support.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", title: "Topic", }, { category: "general", text: "Mozilla Thunderbird is a standalone mail and newsgroup client.\n\nThis update upgrades Thunderbird to version 102.10.0.\n\nSecurity Fix(es):\n\n* Thunderbird: Revocation status of S/Mime recipient certificates was not checked (CVE-2023-0547)\n\n* Mozilla: Matrix SDK bundled with Thunderbird vulnerable to denial-of-service attack (CVE-2023-28427)\n\n* Mozilla: Fullscreen notification obscured (CVE-2023-29533)\n\n* Mozilla: Potential Memory Corruption following Garbage Collector compaction (CVE-2023-29535)\n\n* Mozilla: Invalid free from JavaScript code (CVE-2023-29536)\n\n* Mozilla: Memory safety bugs fixed in Firefox 112 and Firefox ESR 102.10 (CVE-2023-29550)\n\n* Mozilla: Memory Corruption in Safe Browsing Code (CVE-2023-1945)\n\n* Thunderbird: Hang when processing certain OpenPGP messages (CVE-2023-29479)\n\n* Mozilla: Content-Disposition filename truncation leads to Reflected File Download (CVE-2023-29539)\n\n* Mozilla: Files with malicious extensions could have been downloaded unsafely on Linux (CVE-2023-29541)\n\n* Mozilla: Incorrect optimization result on ARM64 (CVE-2023-29548)\n\n* MFSA-TMP-2023-0001 Mozilla: Double-free in libwebp (BZ#2186102)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", title: "Details", }, { category: "legal_disclaimer", text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", title: "Terms of Use", }, ], publisher: { category: "vendor", contact_details: "https://access.redhat.com/security/team/contact/", issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", name: "Red Hat Product Security", namespace: "https://www.redhat.com", }, references: [ { category: "self", summary: "https://access.redhat.com/errata/RHSA-2023:1810", url: "https://access.redhat.com/errata/RHSA-2023:1810", }, { category: "external", summary: "https://access.redhat.com/security/updates/classification/#important", url: "https://access.redhat.com/security/updates/classification/#important", }, { category: "external", summary: "2183278", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2183278", }, { category: "external", summary: "2186101", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186101", }, { category: "external", summary: "2186102", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186102", }, { category: "external", summary: "2186103", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186103", }, { category: "external", summary: "2186104", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186104", }, { category: "external", summary: "2186105", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186105", }, { category: "external", summary: "2186106", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186106", }, { category: "external", summary: "2186109", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186109", }, { category: "external", summary: "2186110", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186110", }, { category: "external", summary: "2186111", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186111", }, { category: "external", summary: "2186734", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186734", }, { category: "external", summary: "2186735", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186735", }, { category: "self", summary: "Canonical URL", url: "https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_1810.json", }, ], title: "Red Hat Security Advisory: thunderbird security update", tracking: { current_release_date: "2024-12-16T05:27:04+00:00", generator: { date: "2024-12-16T05:27:04+00:00", engine: { name: "Red Hat SDEngine", version: "4.2.3", }, }, id: "RHSA-2023:1810", initial_release_date: "2023-04-17T15:03:40+00:00", revision_history: [ { date: "2023-04-17T15:03:40+00:00", number: "1", summary: "Initial version", }, { date: "2023-04-17T15:03:40+00:00", number: "2", summary: "Last updated version", }, { date: "2024-12-16T05:27:04+00:00", number: "3", summary: "Last generated version", }, ], status: "final", version: "3", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_name", name: "Red Hat Enterprise Linux AppStream EUS (v.9.0)", product: { name: "Red Hat Enterprise Linux AppStream EUS (v.9.0)", product_id: "AppStream-9.0.0.Z.EUS", product_identification_helper: { cpe: "cpe:/a:redhat:rhel_eus:9.0::appstream", }, }, }, ], category: "product_family", name: "Red Hat Enterprise Linux", }, { branches: [ { category: "product_version", name: "thunderbird-0:102.10.0-2.el9_0.src", product: { name: "thunderbird-0:102.10.0-2.el9_0.src", product_id: "thunderbird-0:102.10.0-2.el9_0.src", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird@102.10.0-2.el9_0?arch=src", }, }, }, ], category: "architecture", name: "src", }, { branches: [ { category: "product_version", name: "thunderbird-0:102.10.0-2.el9_0.aarch64", product: { name: "thunderbird-0:102.10.0-2.el9_0.aarch64", product_id: "thunderbird-0:102.10.0-2.el9_0.aarch64", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird@102.10.0-2.el9_0?arch=aarch64", }, }, }, { category: "product_version", name: "thunderbird-debugsource-0:102.10.0-2.el9_0.aarch64", product: { name: "thunderbird-debugsource-0:102.10.0-2.el9_0.aarch64", product_id: "thunderbird-debugsource-0:102.10.0-2.el9_0.aarch64", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird-debugsource@102.10.0-2.el9_0?arch=aarch64", }, }, }, { category: "product_version", name: "thunderbird-debuginfo-0:102.10.0-2.el9_0.aarch64", product: { name: "thunderbird-debuginfo-0:102.10.0-2.el9_0.aarch64", product_id: "thunderbird-debuginfo-0:102.10.0-2.el9_0.aarch64", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird-debuginfo@102.10.0-2.el9_0?arch=aarch64", }, }, }, ], category: "architecture", name: "aarch64", }, { branches: [ { category: "product_version", name: "thunderbird-0:102.10.0-2.el9_0.ppc64le", product: { name: "thunderbird-0:102.10.0-2.el9_0.ppc64le", product_id: "thunderbird-0:102.10.0-2.el9_0.ppc64le", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird@102.10.0-2.el9_0?arch=ppc64le", }, }, }, { category: "product_version", name: "thunderbird-debugsource-0:102.10.0-2.el9_0.ppc64le", product: { name: "thunderbird-debugsource-0:102.10.0-2.el9_0.ppc64le", product_id: "thunderbird-debugsource-0:102.10.0-2.el9_0.ppc64le", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird-debugsource@102.10.0-2.el9_0?arch=ppc64le", }, }, }, { category: "product_version", name: "thunderbird-debuginfo-0:102.10.0-2.el9_0.ppc64le", product: { name: "thunderbird-debuginfo-0:102.10.0-2.el9_0.ppc64le", product_id: "thunderbird-debuginfo-0:102.10.0-2.el9_0.ppc64le", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird-debuginfo@102.10.0-2.el9_0?arch=ppc64le", }, }, }, ], category: "architecture", name: "ppc64le", }, { branches: [ { category: "product_version", name: "thunderbird-0:102.10.0-2.el9_0.x86_64", product: { name: "thunderbird-0:102.10.0-2.el9_0.x86_64", product_id: "thunderbird-0:102.10.0-2.el9_0.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird@102.10.0-2.el9_0?arch=x86_64", }, }, }, { category: "product_version", name: "thunderbird-debugsource-0:102.10.0-2.el9_0.x86_64", product: { name: "thunderbird-debugsource-0:102.10.0-2.el9_0.x86_64", product_id: "thunderbird-debugsource-0:102.10.0-2.el9_0.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird-debugsource@102.10.0-2.el9_0?arch=x86_64", }, }, }, { category: "product_version", name: "thunderbird-debuginfo-0:102.10.0-2.el9_0.x86_64", product: { name: "thunderbird-debuginfo-0:102.10.0-2.el9_0.x86_64", product_id: "thunderbird-debuginfo-0:102.10.0-2.el9_0.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird-debuginfo@102.10.0-2.el9_0?arch=x86_64", }, }, }, ], category: "architecture", name: "x86_64", }, { branches: [ { category: "product_version", name: "thunderbird-0:102.10.0-2.el9_0.s390x", product: { name: "thunderbird-0:102.10.0-2.el9_0.s390x", product_id: "thunderbird-0:102.10.0-2.el9_0.s390x", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird@102.10.0-2.el9_0?arch=s390x", }, }, }, { category: "product_version", name: "thunderbird-debugsource-0:102.10.0-2.el9_0.s390x", product: { name: "thunderbird-debugsource-0:102.10.0-2.el9_0.s390x", product_id: "thunderbird-debugsource-0:102.10.0-2.el9_0.s390x", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird-debugsource@102.10.0-2.el9_0?arch=s390x", }, }, }, { category: "product_version", name: "thunderbird-debuginfo-0:102.10.0-2.el9_0.s390x", product: { name: "thunderbird-debuginfo-0:102.10.0-2.el9_0.s390x", product_id: "thunderbird-debuginfo-0:102.10.0-2.el9_0.s390x", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird-debuginfo@102.10.0-2.el9_0?arch=s390x", }, }, }, ], category: "architecture", name: "s390x", }, ], category: "vendor", name: "Red Hat", }, ], relationships: [ { category: "default_component_of", full_product_name: { name: "thunderbird-0:102.10.0-2.el9_0.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.0)", product_id: "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.aarch64", }, product_reference: "thunderbird-0:102.10.0-2.el9_0.aarch64", relates_to_product_reference: "AppStream-9.0.0.Z.EUS", }, { category: "default_component_of", full_product_name: { name: "thunderbird-0:102.10.0-2.el9_0.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.9.0)", product_id: "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.ppc64le", }, product_reference: "thunderbird-0:102.10.0-2.el9_0.ppc64le", relates_to_product_reference: "AppStream-9.0.0.Z.EUS", }, { category: "default_component_of", full_product_name: { name: "thunderbird-0:102.10.0-2.el9_0.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.9.0)", product_id: "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.s390x", }, product_reference: "thunderbird-0:102.10.0-2.el9_0.s390x", relates_to_product_reference: "AppStream-9.0.0.Z.EUS", }, { category: "default_component_of", full_product_name: { name: "thunderbird-0:102.10.0-2.el9_0.src as a component of Red Hat Enterprise Linux AppStream EUS (v.9.0)", product_id: "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.src", }, product_reference: "thunderbird-0:102.10.0-2.el9_0.src", relates_to_product_reference: "AppStream-9.0.0.Z.EUS", }, { category: "default_component_of", full_product_name: { name: "thunderbird-0:102.10.0-2.el9_0.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.0)", product_id: "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.x86_64", }, product_reference: "thunderbird-0:102.10.0-2.el9_0.x86_64", relates_to_product_reference: "AppStream-9.0.0.Z.EUS", }, { category: "default_component_of", full_product_name: { name: "thunderbird-debuginfo-0:102.10.0-2.el9_0.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.0)", product_id: "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.aarch64", }, product_reference: "thunderbird-debuginfo-0:102.10.0-2.el9_0.aarch64", relates_to_product_reference: "AppStream-9.0.0.Z.EUS", }, { category: "default_component_of", full_product_name: { name: "thunderbird-debuginfo-0:102.10.0-2.el9_0.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.9.0)", product_id: "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.ppc64le", }, product_reference: "thunderbird-debuginfo-0:102.10.0-2.el9_0.ppc64le", relates_to_product_reference: "AppStream-9.0.0.Z.EUS", }, { category: "default_component_of", full_product_name: { name: "thunderbird-debuginfo-0:102.10.0-2.el9_0.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.9.0)", product_id: "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.s390x", }, product_reference: "thunderbird-debuginfo-0:102.10.0-2.el9_0.s390x", relates_to_product_reference: "AppStream-9.0.0.Z.EUS", }, { category: "default_component_of", full_product_name: { name: "thunderbird-debuginfo-0:102.10.0-2.el9_0.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.0)", product_id: "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.x86_64", }, product_reference: "thunderbird-debuginfo-0:102.10.0-2.el9_0.x86_64", relates_to_product_reference: "AppStream-9.0.0.Z.EUS", }, { category: "default_component_of", full_product_name: { name: "thunderbird-debugsource-0:102.10.0-2.el9_0.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.0)", product_id: "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.aarch64", }, product_reference: "thunderbird-debugsource-0:102.10.0-2.el9_0.aarch64", relates_to_product_reference: "AppStream-9.0.0.Z.EUS", }, { category: "default_component_of", full_product_name: { name: "thunderbird-debugsource-0:102.10.0-2.el9_0.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.9.0)", product_id: "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.ppc64le", }, product_reference: "thunderbird-debugsource-0:102.10.0-2.el9_0.ppc64le", relates_to_product_reference: "AppStream-9.0.0.Z.EUS", }, { category: "default_component_of", full_product_name: { name: "thunderbird-debugsource-0:102.10.0-2.el9_0.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.9.0)", product_id: "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.s390x", }, product_reference: "thunderbird-debugsource-0:102.10.0-2.el9_0.s390x", relates_to_product_reference: "AppStream-9.0.0.Z.EUS", }, { category: "default_component_of", full_product_name: { name: "thunderbird-debugsource-0:102.10.0-2.el9_0.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.0)", product_id: "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.x86_64", }, product_reference: "thunderbird-debugsource-0:102.10.0-2.el9_0.x86_64", relates_to_product_reference: "AppStream-9.0.0.Z.EUS", }, ], }, vulnerabilities: [ { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Paul Menzel", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-0547", cwe: { id: "CWE-356", name: "Product UI does not Warn User of Unsafe Actions", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186734", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nOCSP revocation status of recipient certificates was not checked when sending S/Mime encrypted email, and revoked certificates would be accepted. Thunderbird versions from 68 to 102.9.1 were affected by this bug.", title: "Vulnerability description", }, { category: "summary", text: "Thunderbird: Revocation status of S/Mime recipient certificates was not checked", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.src", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-0547", }, { category: "external", summary: "RHBZ#2186734", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186734", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-0547", url: "https://www.cve.org/CVERecord?id=CVE-2023-0547", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-0547", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-0547", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-15/#CVE-2023-0547", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-15/#CVE-2023-0547", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T15:03:40+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.src", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1810", }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 7.5, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.src", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "Thunderbird: Revocation status of S/Mime recipient certificates was not checked", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Gabriele Svelto", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-1945", cwe: { id: "CWE-119", name: "Improper Restriction of Operations within the Bounds of a Memory Buffer", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186109", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nUnexpected data returned from the Safe Browsing API could have led to memory corruption and a potentially exploitable crash.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Memory Corruption in Safe Browsing Code", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.src", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-1945", }, { category: "external", summary: "RHBZ#2186109", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186109", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-1945", url: "https://www.cve.org/CVERecord?id=CVE-2023-1945", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-1945", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-1945", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-1945", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-1945", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T15:03:40+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.src", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1810", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "NONE", baseScore: 6.1, baseSeverity: "MEDIUM", confidentialityImpact: "LOW", integrityImpact: "LOW", privilegesRequired: "NONE", scope: "CHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", version: "3.1", }, products: [ "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.src", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "Mozilla: Memory Corruption in Safe Browsing Code", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Irvan Kurniawan", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-1999", cwe: { id: "CWE-415", name: "Double Free", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186102", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nA double-free in libwebp could have led to memory corruption and a potentially exploitable crash.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: libwebp: Double-free in libwebp", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.src", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-1999", }, { category: "external", summary: "RHBZ#2186102", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186102", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-1999", url: "https://www.cve.org/CVERecord?id=CVE-2023-1999", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-1999", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-1999", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-1999", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-1999", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-15/#CVE-2023-1999", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-15/#CVE-2023-1999", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T15:03:40+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.src", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1810", }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 7.5, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.src", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "Mozilla: libwebp: Double-free in libwebp", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Matrix Security Team", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-28427", cwe: { id: "CWE-1321", name: "Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')", }, discovery_date: "2023-03-28T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2183278", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nThunderbird users who use the Matrix chat protocol were vulnerable to a denial-of-service attack.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Matrix SDK bundled with Thunderbird vulnerable to denial-of-service attack", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.src", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-28427", }, { category: "external", summary: "RHBZ#2183278", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2183278", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-28427", url: "https://www.cve.org/CVERecord?id=CVE-2023-28427", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-28427", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-28427", }, { category: "external", summary: "https://github.com/matrix-org/matrix-js-sdk/security/advisories/GHSA-mwq8-fjpf-c2gr", url: "https://github.com/matrix-org/matrix-js-sdk/security/advisories/GHSA-mwq8-fjpf-c2gr", }, { category: "external", summary: "https://matrix.org/blog/2023/03/28/security-releases-matrix-js-sdk-24-0-0-and-matrix-react-sdk-3-69-0", url: "https://matrix.org/blog/2023/03/28/security-releases-matrix-js-sdk-24-0-0-and-matrix-react-sdk-3-69-0", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-12/#CVE-2023-28427", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-12/#CVE-2023-28427", }, ], release_date: "2023-03-28T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T15:03:40+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.src", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1810", }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 7.5, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.src", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "Mozilla: Matrix SDK bundled with Thunderbird vulnerable to denial-of-service attack", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Ribose RNP Team", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29479", cwe: { id: "CWE-400", name: "Uncontrolled Resource Consumption", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186735", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nCertain malformed OpenPGP messages could trigger incorrect parsing of PKESK/SKESK packets due to a bug in the Ribose RNP library used by Thunderbird up to version 102.9.1, which would cause the Thunderbird user interface to hang. The issue was discovered using Google's oss-fuzz.", title: "Vulnerability description", }, { category: "summary", text: "Thunderbird: Hang when processing certain OpenPGP messages", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.src", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29479", }, { category: "external", summary: "RHBZ#2186735", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186735", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29479", url: "https://www.cve.org/CVERecord?id=CVE-2023-29479", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29479", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29479", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-15/#CVE-2023-29479", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-15/#CVE-2023-29479", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T15:03:40+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.src", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1810", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 6.5, baseSeverity: "MEDIUM", confidentialityImpact: "NONE", integrityImpact: "NONE", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", version: "3.1", }, products: [ "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.src", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "Thunderbird: Hang when processing certain OpenPGP messages", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Irvan Kurniawan", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29533", cwe: { id: "CWE-425", name: "Direct Request ('Forced Browsing')", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186101", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nA website could have obscured the fullscreen notification by using a combination of `window.open`, fullscreen requests, `window.name` assignments, and `setInterval` calls. This could have led to user confusion and possible spoofing attacks.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Fullscreen notification obscured", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.src", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29533", }, { category: "external", summary: "RHBZ#2186101", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186101", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29533", url: "https://www.cve.org/CVERecord?id=CVE-2023-29533", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29533", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29533", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29533", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29533", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T15:03:40+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.src", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1810", }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 7.5, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.src", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "Mozilla: Fullscreen notification obscured", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Lukas Bernhard", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29535", cwe: { id: "CWE-119", name: "Improper Restriction of Operations within the Bounds of a Memory Buffer", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186103", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nFollowing a Garbage Collector compaction, weak maps may have been accessed before they were correctly traced. This resulted in memory corruption and a potentially exploitable crash.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Potential Memory Corruption following Garbage Collector compaction", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.src", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29535", }, { category: "external", summary: "RHBZ#2186103", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186103", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29535", url: "https://www.cve.org/CVERecord?id=CVE-2023-29535", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29535", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29535", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29535", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29535", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T15:03:40+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.src", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1810", }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 7.5, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.src", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "Mozilla: Potential Memory Corruption following Garbage Collector compaction", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "zx from qriousec", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29536", cwe: { id: "CWE-617", name: "Reachable Assertion", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186104", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nAn attacker could cause the memory manager to incorrectly free a pointer that addresses attacker-controlled memory, resulting in an assertion, memory corruption, or a potentially exploitable crash.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Invalid free from JavaScript code", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.src", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29536", }, { category: "external", summary: "RHBZ#2186104", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186104", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29536", url: "https://www.cve.org/CVERecord?id=CVE-2023-29536", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29536", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29536", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29536", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29536", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T15:03:40+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.src", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1810", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 8.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.src", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "Mozilla: Invalid free from JavaScript code", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Trung Pham", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29539", cwe: { id: "CWE-159", name: "Improper Handling of Invalid Use of Special Elements", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186105", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nWhen handling the filename directive in the Content-Disposition header, the filename would be truncated if the filename contained a NULL character. This could have led to reflected file download attacks potentially tricking users to install malware.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Content-Disposition filename truncation leads to Reflected File Download", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.src", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29539", }, { category: "external", summary: "RHBZ#2186105", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186105", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29539", url: "https://www.cve.org/CVERecord?id=CVE-2023-29539", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29539", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29539", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29539", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29539", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T15:03:40+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.src", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1810", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 8.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.src", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "Mozilla: Content-Disposition filename truncation leads to Reflected File Download", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Ameen Basha M K", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29541", cwe: { id: "CWE-434", name: "Unrestricted Upload of File with Dangerous Type", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186106", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nFirefox did not properly handle downloads of files ending in `.desktop`, which can be interpreted to run attacker-controlled commands.\r\n\r\n*This bug only affects Firefox for Linux on certain Distributions. Other operating systems are unaffected, and Mozilla is unable to enumerate all affected Linux Distributions.*", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Files with malicious extensions could have been downloaded unsafely on Linux", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.src", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29541", }, { category: "external", summary: "RHBZ#2186106", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186106", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29541", url: "https://www.cve.org/CVERecord?id=CVE-2023-29541", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29541", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29541", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29541", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29541", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T15:03:40+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.src", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1810", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 8.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.src", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "Mozilla: Files with malicious extensions could have been downloaded unsafely on Linux", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "JunYoung Park", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29548", cwe: { id: "CWE-682", name: "Incorrect Calculation", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186110", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nA wrong lowering instruction in the ARM64 Ion compiler resulted in a wrong optimization result.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Incorrect optimization result on ARM64", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.src", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29548", }, { category: "external", summary: "RHBZ#2186110", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186110", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29548", url: "https://www.cve.org/CVERecord?id=CVE-2023-29548", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29548", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29548", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29548", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29548", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T15:03:40+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.src", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1810", }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "NONE", baseScore: 3.4, baseSeverity: "LOW", confidentialityImpact: "NONE", integrityImpact: "LOW", privilegesRequired: "NONE", scope: "CHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:N", version: "3.1", }, products: [ "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.src", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.x86_64", ], }, ], threats: [ { category: "impact", details: "Low", }, ], title: "Mozilla: Incorrect optimization result on ARM64", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Mozilla developers and community", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29550", cwe: { id: "CWE-120", name: "Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186111", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nMozilla developers Andrew Osmond, Sebastian Hengst, Andrew McCreight, and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 111 and Firefox ESR 102.9. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Memory safety bugs fixed in Firefox 112 and Firefox ESR 102.10", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.src", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29550", }, { category: "external", summary: "RHBZ#2186111", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186111", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29550", url: "https://www.cve.org/CVERecord?id=CVE-2023-29550", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29550", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29550", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29550", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29550", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T15:03:40+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.src", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1810", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 8.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.src", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "Mozilla: Memory safety bugs fixed in Firefox 112 and Firefox ESR 102.10", }, ], }
RHSA-2023:1804
Vulnerability from csaf_redhat
Published
2023-04-17 14:04
Modified
2024-12-16 05:26
Summary
Red Hat Security Advisory: thunderbird security update
Notes
Topic
An update for thunderbird is now available for Red Hat Enterprise Linux 8.4 Extended Update Support.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Mozilla Thunderbird is a standalone mail and newsgroup client.
This update upgrades Thunderbird to version 102.10.0.
Security Fix(es):
* Thunderbird: Revocation status of S/Mime recipient certificates was not checked (CVE-2023-0547)
* Mozilla: Matrix SDK bundled with Thunderbird vulnerable to denial-of-service attack (CVE-2023-28427)
* Mozilla: Fullscreen notification obscured (CVE-2023-29533)
* Mozilla: Potential Memory Corruption following Garbage Collector compaction (CVE-2023-29535)
* Mozilla: Invalid free from JavaScript code (CVE-2023-29536)
* Mozilla: Memory safety bugs fixed in Firefox 112 and Firefox ESR 102.10 (CVE-2023-29550)
* Mozilla: Memory Corruption in Safe Browsing Code (CVE-2023-1945)
* Thunderbird: Hang when processing certain OpenPGP messages (CVE-2023-29479)
* Mozilla: Content-Disposition filename truncation leads to Reflected File Download (CVE-2023-29539)
* Mozilla: Files with malicious extensions could have been downloaded unsafely on Linux (CVE-2023-29541)
* Mozilla: Incorrect optimization result on ARM64 (CVE-2023-29548)
* MFSA-TMP-2023-0001 Mozilla: Double-free in libwebp (BZ#2186102)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ document: { aggregate_severity: { namespace: "https://access.redhat.com/security/updates/classification/", text: "Important", }, category: "csaf_security_advisory", csaf_version: "2.0", distribution: { text: "Copyright © Red Hat, Inc. All rights reserved.", tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "en", notes: [ { category: "summary", text: "An update for thunderbird is now available for Red Hat Enterprise Linux 8.4 Extended Update Support.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", title: "Topic", }, { category: "general", text: "Mozilla Thunderbird is a standalone mail and newsgroup client.\n\nThis update upgrades Thunderbird to version 102.10.0.\n\nSecurity Fix(es):\n\n* Thunderbird: Revocation status of S/Mime recipient certificates was not checked (CVE-2023-0547)\n\n* Mozilla: Matrix SDK bundled with Thunderbird vulnerable to denial-of-service attack (CVE-2023-28427)\n\n* Mozilla: Fullscreen notification obscured (CVE-2023-29533)\n\n* Mozilla: Potential Memory Corruption following Garbage Collector compaction (CVE-2023-29535)\n\n* Mozilla: Invalid free from JavaScript code (CVE-2023-29536)\n\n* Mozilla: Memory safety bugs fixed in Firefox 112 and Firefox ESR 102.10 (CVE-2023-29550)\n\n* Mozilla: Memory Corruption in Safe Browsing Code (CVE-2023-1945)\n\n* Thunderbird: Hang when processing certain OpenPGP messages (CVE-2023-29479)\n\n* Mozilla: Content-Disposition filename truncation leads to Reflected File Download (CVE-2023-29539)\n\n* Mozilla: Files with malicious extensions could have been downloaded unsafely on Linux (CVE-2023-29541)\n\n* Mozilla: Incorrect optimization result on ARM64 (CVE-2023-29548)\n\n* MFSA-TMP-2023-0001 Mozilla: Double-free in libwebp (BZ#2186102)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", title: "Details", }, { category: "legal_disclaimer", text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", title: "Terms of Use", }, ], publisher: { category: "vendor", contact_details: "https://access.redhat.com/security/team/contact/", issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", name: "Red Hat Product Security", namespace: "https://www.redhat.com", }, references: [ { category: "self", summary: "https://access.redhat.com/errata/RHSA-2023:1804", url: "https://access.redhat.com/errata/RHSA-2023:1804", }, { category: "external", summary: "https://access.redhat.com/security/updates/classification/#important", url: "https://access.redhat.com/security/updates/classification/#important", }, { category: "external", summary: "2183278", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2183278", }, { category: "external", summary: "2186101", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186101", }, { category: "external", summary: "2186102", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186102", }, { category: "external", summary: "2186103", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186103", }, { category: "external", summary: "2186104", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186104", }, { category: "external", summary: "2186105", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186105", }, { category: "external", summary: "2186106", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186106", }, { category: "external", summary: "2186109", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186109", }, { category: "external", summary: "2186110", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186110", }, { category: "external", summary: "2186111", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186111", }, { category: "external", summary: "2186734", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186734", }, { category: "external", summary: "2186735", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186735", }, { category: "self", summary: "Canonical URL", url: "https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_1804.json", }, ], title: "Red Hat Security Advisory: thunderbird security update", tracking: { current_release_date: "2024-12-16T05:26:46+00:00", generator: { date: "2024-12-16T05:26:46+00:00", engine: { name: "Red Hat SDEngine", version: "4.2.3", }, }, id: "RHSA-2023:1804", initial_release_date: "2023-04-17T14:04:25+00:00", revision_history: [ { date: "2023-04-17T14:04:25+00:00", number: "1", summary: "Initial version", }, { date: "2023-04-17T14:04:25+00:00", number: "2", summary: "Last updated version", }, { date: "2024-12-16T05:26:46+00:00", number: "3", summary: "Last generated version", }, ], status: "final", version: "3", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_name", name: "Red Hat Enterprise Linux AppStream EUS (v.8.4)", product: { name: "Red Hat Enterprise Linux AppStream EUS (v.8.4)", product_id: "AppStream-8.4.0.Z.EUS", product_identification_helper: { cpe: "cpe:/a:redhat:rhel_eus:8.4::appstream", }, }, }, ], category: "product_family", name: "Red Hat Enterprise Linux", }, { branches: [ { category: "product_version", name: "thunderbird-0:102.10.0-2.el8_4.src", product: { name: "thunderbird-0:102.10.0-2.el8_4.src", product_id: "thunderbird-0:102.10.0-2.el8_4.src", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird@102.10.0-2.el8_4?arch=src", }, }, }, ], category: "architecture", name: "src", }, { branches: [ { category: "product_version", name: "thunderbird-0:102.10.0-2.el8_4.aarch64", product: { name: "thunderbird-0:102.10.0-2.el8_4.aarch64", product_id: "thunderbird-0:102.10.0-2.el8_4.aarch64", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird@102.10.0-2.el8_4?arch=aarch64", }, }, }, { category: "product_version", name: "thunderbird-debugsource-0:102.10.0-2.el8_4.aarch64", product: { name: "thunderbird-debugsource-0:102.10.0-2.el8_4.aarch64", product_id: "thunderbird-debugsource-0:102.10.0-2.el8_4.aarch64", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird-debugsource@102.10.0-2.el8_4?arch=aarch64", }, }, }, { category: "product_version", name: "thunderbird-debuginfo-0:102.10.0-2.el8_4.aarch64", product: { name: "thunderbird-debuginfo-0:102.10.0-2.el8_4.aarch64", product_id: "thunderbird-debuginfo-0:102.10.0-2.el8_4.aarch64", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird-debuginfo@102.10.0-2.el8_4?arch=aarch64", }, }, }, ], category: "architecture", name: "aarch64", }, { branches: [ { category: "product_version", name: "thunderbird-0:102.10.0-2.el8_4.ppc64le", product: { name: "thunderbird-0:102.10.0-2.el8_4.ppc64le", product_id: "thunderbird-0:102.10.0-2.el8_4.ppc64le", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird@102.10.0-2.el8_4?arch=ppc64le", }, }, }, { category: "product_version", name: "thunderbird-debugsource-0:102.10.0-2.el8_4.ppc64le", product: { name: "thunderbird-debugsource-0:102.10.0-2.el8_4.ppc64le", product_id: "thunderbird-debugsource-0:102.10.0-2.el8_4.ppc64le", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird-debugsource@102.10.0-2.el8_4?arch=ppc64le", }, }, }, { category: "product_version", name: "thunderbird-debuginfo-0:102.10.0-2.el8_4.ppc64le", product: { name: "thunderbird-debuginfo-0:102.10.0-2.el8_4.ppc64le", product_id: "thunderbird-debuginfo-0:102.10.0-2.el8_4.ppc64le", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird-debuginfo@102.10.0-2.el8_4?arch=ppc64le", }, }, }, ], category: "architecture", name: "ppc64le", }, { branches: [ { category: "product_version", name: "thunderbird-0:102.10.0-2.el8_4.x86_64", product: { name: "thunderbird-0:102.10.0-2.el8_4.x86_64", product_id: "thunderbird-0:102.10.0-2.el8_4.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird@102.10.0-2.el8_4?arch=x86_64", }, }, }, { category: "product_version", name: "thunderbird-debugsource-0:102.10.0-2.el8_4.x86_64", product: { name: "thunderbird-debugsource-0:102.10.0-2.el8_4.x86_64", product_id: "thunderbird-debugsource-0:102.10.0-2.el8_4.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird-debugsource@102.10.0-2.el8_4?arch=x86_64", }, }, }, { category: "product_version", name: "thunderbird-debuginfo-0:102.10.0-2.el8_4.x86_64", product: { name: "thunderbird-debuginfo-0:102.10.0-2.el8_4.x86_64", product_id: "thunderbird-debuginfo-0:102.10.0-2.el8_4.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird-debuginfo@102.10.0-2.el8_4?arch=x86_64", }, }, }, ], category: "architecture", name: "x86_64", }, { branches: [ { category: "product_version", name: "thunderbird-0:102.10.0-2.el8_4.s390x", product: { name: "thunderbird-0:102.10.0-2.el8_4.s390x", product_id: "thunderbird-0:102.10.0-2.el8_4.s390x", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird@102.10.0-2.el8_4?arch=s390x", }, }, }, { category: "product_version", name: "thunderbird-debugsource-0:102.10.0-2.el8_4.s390x", product: { name: "thunderbird-debugsource-0:102.10.0-2.el8_4.s390x", product_id: "thunderbird-debugsource-0:102.10.0-2.el8_4.s390x", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird-debugsource@102.10.0-2.el8_4?arch=s390x", }, }, }, { category: "product_version", name: "thunderbird-debuginfo-0:102.10.0-2.el8_4.s390x", product: { name: "thunderbird-debuginfo-0:102.10.0-2.el8_4.s390x", product_id: "thunderbird-debuginfo-0:102.10.0-2.el8_4.s390x", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird-debuginfo@102.10.0-2.el8_4?arch=s390x", }, }, }, ], category: "architecture", name: "s390x", }, ], category: "vendor", name: "Red Hat", }, ], relationships: [ { category: "default_component_of", full_product_name: { name: "thunderbird-0:102.10.0-2.el8_4.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", product_id: "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.aarch64", }, product_reference: "thunderbird-0:102.10.0-2.el8_4.aarch64", relates_to_product_reference: "AppStream-8.4.0.Z.EUS", }, { category: "default_component_of", full_product_name: { name: "thunderbird-0:102.10.0-2.el8_4.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", product_id: "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.ppc64le", }, product_reference: "thunderbird-0:102.10.0-2.el8_4.ppc64le", relates_to_product_reference: "AppStream-8.4.0.Z.EUS", }, { category: "default_component_of", full_product_name: { name: "thunderbird-0:102.10.0-2.el8_4.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", product_id: "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.s390x", }, product_reference: "thunderbird-0:102.10.0-2.el8_4.s390x", relates_to_product_reference: "AppStream-8.4.0.Z.EUS", }, { category: "default_component_of", full_product_name: { name: "thunderbird-0:102.10.0-2.el8_4.src as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", product_id: "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.src", }, product_reference: "thunderbird-0:102.10.0-2.el8_4.src", relates_to_product_reference: "AppStream-8.4.0.Z.EUS", }, { category: "default_component_of", full_product_name: { name: "thunderbird-0:102.10.0-2.el8_4.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", product_id: "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.x86_64", }, product_reference: "thunderbird-0:102.10.0-2.el8_4.x86_64", relates_to_product_reference: "AppStream-8.4.0.Z.EUS", }, { category: "default_component_of", full_product_name: { name: "thunderbird-debuginfo-0:102.10.0-2.el8_4.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", product_id: "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.aarch64", }, product_reference: "thunderbird-debuginfo-0:102.10.0-2.el8_4.aarch64", relates_to_product_reference: "AppStream-8.4.0.Z.EUS", }, { category: "default_component_of", full_product_name: { name: "thunderbird-debuginfo-0:102.10.0-2.el8_4.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", product_id: "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.ppc64le", }, product_reference: "thunderbird-debuginfo-0:102.10.0-2.el8_4.ppc64le", relates_to_product_reference: "AppStream-8.4.0.Z.EUS", }, { category: "default_component_of", full_product_name: { name: "thunderbird-debuginfo-0:102.10.0-2.el8_4.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", product_id: "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.s390x", }, product_reference: "thunderbird-debuginfo-0:102.10.0-2.el8_4.s390x", relates_to_product_reference: "AppStream-8.4.0.Z.EUS", }, { category: "default_component_of", full_product_name: { name: "thunderbird-debuginfo-0:102.10.0-2.el8_4.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", product_id: "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.x86_64", }, product_reference: "thunderbird-debuginfo-0:102.10.0-2.el8_4.x86_64", relates_to_product_reference: "AppStream-8.4.0.Z.EUS", }, { category: "default_component_of", full_product_name: { name: "thunderbird-debugsource-0:102.10.0-2.el8_4.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", product_id: "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.aarch64", }, product_reference: "thunderbird-debugsource-0:102.10.0-2.el8_4.aarch64", relates_to_product_reference: "AppStream-8.4.0.Z.EUS", }, { category: "default_component_of", full_product_name: { name: "thunderbird-debugsource-0:102.10.0-2.el8_4.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", product_id: "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.ppc64le", }, product_reference: "thunderbird-debugsource-0:102.10.0-2.el8_4.ppc64le", relates_to_product_reference: "AppStream-8.4.0.Z.EUS", }, { category: "default_component_of", full_product_name: { name: "thunderbird-debugsource-0:102.10.0-2.el8_4.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", product_id: "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.s390x", }, product_reference: "thunderbird-debugsource-0:102.10.0-2.el8_4.s390x", relates_to_product_reference: "AppStream-8.4.0.Z.EUS", }, { category: "default_component_of", full_product_name: { name: "thunderbird-debugsource-0:102.10.0-2.el8_4.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", product_id: "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.x86_64", }, product_reference: "thunderbird-debugsource-0:102.10.0-2.el8_4.x86_64", relates_to_product_reference: "AppStream-8.4.0.Z.EUS", }, ], }, vulnerabilities: [ { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Paul Menzel", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-0547", cwe: { id: "CWE-356", name: "Product UI does not Warn User of Unsafe Actions", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186734", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nOCSP revocation status of recipient certificates was not checked when sending S/Mime encrypted email, and revoked certificates would be accepted. Thunderbird versions from 68 to 102.9.1 were affected by this bug.", title: "Vulnerability description", }, { category: "summary", text: "Thunderbird: Revocation status of S/Mime recipient certificates was not checked", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.src", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-0547", }, { category: "external", summary: "RHBZ#2186734", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186734", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-0547", url: "https://www.cve.org/CVERecord?id=CVE-2023-0547", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-0547", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-0547", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-15/#CVE-2023-0547", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-15/#CVE-2023-0547", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T14:04:25+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.src", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1804", }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 7.5, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.src", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "Thunderbird: Revocation status of S/Mime recipient certificates was not checked", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Gabriele Svelto", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-1945", cwe: { id: "CWE-119", name: "Improper Restriction of Operations within the Bounds of a Memory Buffer", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186109", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nUnexpected data returned from the Safe Browsing API could have led to memory corruption and a potentially exploitable crash.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Memory Corruption in Safe Browsing Code", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.src", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-1945", }, { category: "external", summary: "RHBZ#2186109", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186109", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-1945", url: "https://www.cve.org/CVERecord?id=CVE-2023-1945", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-1945", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-1945", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-1945", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-1945", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T14:04:25+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.src", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1804", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "NONE", baseScore: 6.1, baseSeverity: "MEDIUM", confidentialityImpact: "LOW", integrityImpact: "LOW", privilegesRequired: "NONE", scope: "CHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", version: "3.1", }, products: [ "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.src", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "Mozilla: Memory Corruption in Safe Browsing Code", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Irvan Kurniawan", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-1999", cwe: { id: "CWE-415", name: "Double Free", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186102", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nA double-free in libwebp could have led to memory corruption and a potentially exploitable crash.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: libwebp: Double-free in libwebp", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.src", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-1999", }, { category: "external", summary: "RHBZ#2186102", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186102", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-1999", url: "https://www.cve.org/CVERecord?id=CVE-2023-1999", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-1999", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-1999", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-1999", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-1999", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-15/#CVE-2023-1999", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-15/#CVE-2023-1999", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T14:04:25+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.src", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1804", }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 7.5, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.src", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "Mozilla: libwebp: Double-free in libwebp", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Matrix Security Team", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-28427", cwe: { id: "CWE-1321", name: "Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')", }, discovery_date: "2023-03-28T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2183278", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nThunderbird users who use the Matrix chat protocol were vulnerable to a denial-of-service attack.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Matrix SDK bundled with Thunderbird vulnerable to denial-of-service attack", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.src", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-28427", }, { category: "external", summary: "RHBZ#2183278", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2183278", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-28427", url: "https://www.cve.org/CVERecord?id=CVE-2023-28427", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-28427", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-28427", }, { category: "external", summary: "https://github.com/matrix-org/matrix-js-sdk/security/advisories/GHSA-mwq8-fjpf-c2gr", url: "https://github.com/matrix-org/matrix-js-sdk/security/advisories/GHSA-mwq8-fjpf-c2gr", }, { category: "external", summary: "https://matrix.org/blog/2023/03/28/security-releases-matrix-js-sdk-24-0-0-and-matrix-react-sdk-3-69-0", url: "https://matrix.org/blog/2023/03/28/security-releases-matrix-js-sdk-24-0-0-and-matrix-react-sdk-3-69-0", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-12/#CVE-2023-28427", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-12/#CVE-2023-28427", }, ], release_date: "2023-03-28T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T14:04:25+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.src", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1804", }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 7.5, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.src", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "Mozilla: Matrix SDK bundled with Thunderbird vulnerable to denial-of-service attack", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Ribose RNP Team", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29479", cwe: { id: "CWE-400", name: "Uncontrolled Resource Consumption", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186735", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nCertain malformed OpenPGP messages could trigger incorrect parsing of PKESK/SKESK packets due to a bug in the Ribose RNP library used by Thunderbird up to version 102.9.1, which would cause the Thunderbird user interface to hang. The issue was discovered using Google's oss-fuzz.", title: "Vulnerability description", }, { category: "summary", text: "Thunderbird: Hang when processing certain OpenPGP messages", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.src", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29479", }, { category: "external", summary: "RHBZ#2186735", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186735", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29479", url: "https://www.cve.org/CVERecord?id=CVE-2023-29479", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29479", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29479", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-15/#CVE-2023-29479", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-15/#CVE-2023-29479", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T14:04:25+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.src", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1804", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 6.5, baseSeverity: "MEDIUM", confidentialityImpact: "NONE", integrityImpact: "NONE", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", version: "3.1", }, products: [ "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.src", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "Thunderbird: Hang when processing certain OpenPGP messages", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Irvan Kurniawan", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29533", cwe: { id: "CWE-425", name: "Direct Request ('Forced Browsing')", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186101", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nA website could have obscured the fullscreen notification by using a combination of `window.open`, fullscreen requests, `window.name` assignments, and `setInterval` calls. This could have led to user confusion and possible spoofing attacks.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Fullscreen notification obscured", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.src", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29533", }, { category: "external", summary: "RHBZ#2186101", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186101", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29533", url: "https://www.cve.org/CVERecord?id=CVE-2023-29533", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29533", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29533", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29533", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29533", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T14:04:25+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.src", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1804", }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 7.5, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.src", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "Mozilla: Fullscreen notification obscured", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Lukas Bernhard", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29535", cwe: { id: "CWE-119", name: "Improper Restriction of Operations within the Bounds of a Memory Buffer", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186103", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nFollowing a Garbage Collector compaction, weak maps may have been accessed before they were correctly traced. This resulted in memory corruption and a potentially exploitable crash.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Potential Memory Corruption following Garbage Collector compaction", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.src", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29535", }, { category: "external", summary: "RHBZ#2186103", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186103", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29535", url: "https://www.cve.org/CVERecord?id=CVE-2023-29535", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29535", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29535", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29535", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29535", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T14:04:25+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.src", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1804", }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 7.5, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.src", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "Mozilla: Potential Memory Corruption following Garbage Collector compaction", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "zx from qriousec", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29536", cwe: { id: "CWE-617", name: "Reachable Assertion", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186104", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nAn attacker could cause the memory manager to incorrectly free a pointer that addresses attacker-controlled memory, resulting in an assertion, memory corruption, or a potentially exploitable crash.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Invalid free from JavaScript code", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.src", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29536", }, { category: "external", summary: "RHBZ#2186104", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186104", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29536", url: "https://www.cve.org/CVERecord?id=CVE-2023-29536", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29536", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29536", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29536", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29536", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T14:04:25+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.src", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1804", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 8.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.src", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "Mozilla: Invalid free from JavaScript code", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Trung Pham", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29539", cwe: { id: "CWE-159", name: "Improper Handling of Invalid Use of Special Elements", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186105", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nWhen handling the filename directive in the Content-Disposition header, the filename would be truncated if the filename contained a NULL character. This could have led to reflected file download attacks potentially tricking users to install malware.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Content-Disposition filename truncation leads to Reflected File Download", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.src", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29539", }, { category: "external", summary: "RHBZ#2186105", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186105", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29539", url: "https://www.cve.org/CVERecord?id=CVE-2023-29539", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29539", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29539", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29539", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29539", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T14:04:25+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.src", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1804", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 8.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.src", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "Mozilla: Content-Disposition filename truncation leads to Reflected File Download", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Ameen Basha M K", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29541", cwe: { id: "CWE-434", name: "Unrestricted Upload of File with Dangerous Type", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186106", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nFirefox did not properly handle downloads of files ending in `.desktop`, which can be interpreted to run attacker-controlled commands.\r\n\r\n*This bug only affects Firefox for Linux on certain Distributions. Other operating systems are unaffected, and Mozilla is unable to enumerate all affected Linux Distributions.*", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Files with malicious extensions could have been downloaded unsafely on Linux", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.src", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29541", }, { category: "external", summary: "RHBZ#2186106", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186106", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29541", url: "https://www.cve.org/CVERecord?id=CVE-2023-29541", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29541", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29541", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29541", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29541", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T14:04:25+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.src", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1804", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 8.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.src", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "Mozilla: Files with malicious extensions could have been downloaded unsafely on Linux", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "JunYoung Park", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29548", cwe: { id: "CWE-682", name: "Incorrect Calculation", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186110", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nA wrong lowering instruction in the ARM64 Ion compiler resulted in a wrong optimization result.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Incorrect optimization result on ARM64", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.src", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29548", }, { category: "external", summary: "RHBZ#2186110", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186110", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29548", url: "https://www.cve.org/CVERecord?id=CVE-2023-29548", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29548", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29548", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29548", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29548", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T14:04:25+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.src", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1804", }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "NONE", baseScore: 3.4, baseSeverity: "LOW", confidentialityImpact: "NONE", integrityImpact: "LOW", privilegesRequired: "NONE", scope: "CHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:N", version: "3.1", }, products: [ "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.src", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.x86_64", ], }, ], threats: [ { category: "impact", details: "Low", }, ], title: "Mozilla: Incorrect optimization result on ARM64", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Mozilla developers and community", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29550", cwe: { id: "CWE-120", name: "Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186111", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nMozilla developers Andrew Osmond, Sebastian Hengst, Andrew McCreight, and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 111 and Firefox ESR 102.9. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Memory safety bugs fixed in Firefox 112 and Firefox ESR 102.10", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.src", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29550", }, { category: "external", summary: "RHBZ#2186111", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186111", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29550", url: "https://www.cve.org/CVERecord?id=CVE-2023-29550", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29550", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29550", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29550", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29550", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T14:04:25+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.src", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1804", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 8.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.src", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "Mozilla: Memory safety bugs fixed in Firefox 112 and Firefox ESR 102.10", }, ], }
rhsa-2023:1803
Vulnerability from csaf_redhat
Published
2023-04-17 13:56
Modified
2024-12-16 05:27
Summary
Red Hat Security Advisory: thunderbird security update
Notes
Topic
An update for thunderbird is now available for Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Mozilla Thunderbird is a standalone mail and newsgroup client.
This update upgrades Thunderbird to version 102.10.0.
Security Fix(es):
* Thunderbird: Revocation status of S/Mime recipient certificates was not checked (CVE-2023-0547)
* Mozilla: Matrix SDK bundled with Thunderbird vulnerable to denial-of-service attack (CVE-2023-28427)
* Mozilla: Fullscreen notification obscured (CVE-2023-29533)
* Mozilla: Potential Memory Corruption following Garbage Collector compaction (CVE-2023-29535)
* Mozilla: Invalid free from JavaScript code (CVE-2023-29536)
* Mozilla: Memory safety bugs fixed in Firefox 112 and Firefox ESR 102.10 (CVE-2023-29550)
* Mozilla: Memory Corruption in Safe Browsing Code (CVE-2023-1945)
* Thunderbird: Hang when processing certain OpenPGP messages (CVE-2023-29479)
* Mozilla: Content-Disposition filename truncation leads to Reflected File Download (CVE-2023-29539)
* Mozilla: Files with malicious extensions could have been downloaded unsafely on Linux (CVE-2023-29541)
* Mozilla: Incorrect optimization result on ARM64 (CVE-2023-29548)
* MFSA-TMP-2023-0001 Mozilla: Double-free in libwebp (BZ#2186102)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ document: { aggregate_severity: { namespace: "https://access.redhat.com/security/updates/classification/", text: "Important", }, category: "csaf_security_advisory", csaf_version: "2.0", distribution: { text: "Copyright © Red Hat, Inc. All rights reserved.", tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "en", notes: [ { category: "summary", text: "An update for thunderbird is now available for Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", title: "Topic", }, { category: "general", text: "Mozilla Thunderbird is a standalone mail and newsgroup client.\n\nThis update upgrades Thunderbird to version 102.10.0.\n\nSecurity Fix(es):\n\n* Thunderbird: Revocation status of S/Mime recipient certificates was not checked (CVE-2023-0547)\n\n* Mozilla: Matrix SDK bundled with Thunderbird vulnerable to denial-of-service attack (CVE-2023-28427)\n\n* Mozilla: Fullscreen notification obscured (CVE-2023-29533)\n\n* Mozilla: Potential Memory Corruption following Garbage Collector compaction (CVE-2023-29535)\n\n* Mozilla: Invalid free from JavaScript code (CVE-2023-29536)\n\n* Mozilla: Memory safety bugs fixed in Firefox 112 and Firefox ESR 102.10 (CVE-2023-29550)\n\n* Mozilla: Memory Corruption in Safe Browsing Code (CVE-2023-1945)\n\n* Thunderbird: Hang when processing certain OpenPGP messages (CVE-2023-29479)\n\n* Mozilla: Content-Disposition filename truncation leads to Reflected File Download (CVE-2023-29539)\n\n* Mozilla: Files with malicious extensions could have been downloaded unsafely on Linux (CVE-2023-29541)\n\n* Mozilla: Incorrect optimization result on ARM64 (CVE-2023-29548)\n\n* MFSA-TMP-2023-0001 Mozilla: Double-free in libwebp (BZ#2186102)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", title: "Details", }, { category: "legal_disclaimer", text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", title: "Terms of Use", }, ], publisher: { category: "vendor", contact_details: "https://access.redhat.com/security/team/contact/", issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", name: "Red Hat Product Security", namespace: "https://www.redhat.com", }, references: [ { category: "self", summary: "https://access.redhat.com/errata/RHSA-2023:1803", url: "https://access.redhat.com/errata/RHSA-2023:1803", }, { category: "external", summary: "https://access.redhat.com/security/updates/classification/#important", url: "https://access.redhat.com/security/updates/classification/#important", }, { category: "external", summary: "2183278", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2183278", }, { category: "external", summary: "2186101", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186101", }, { category: "external", summary: "2186102", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186102", }, { category: "external", summary: "2186103", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186103", }, { category: "external", summary: "2186104", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186104", }, { category: "external", summary: "2186105", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186105", }, { category: "external", summary: "2186106", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186106", }, { category: "external", summary: "2186109", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186109", }, { category: "external", summary: "2186110", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186110", }, { category: "external", summary: "2186111", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186111", }, { category: "external", summary: "2186734", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186734", }, { category: "external", summary: "2186735", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186735", }, { category: "self", summary: "Canonical URL", url: "https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_1803.json", }, ], title: "Red Hat Security Advisory: thunderbird security update", tracking: { current_release_date: "2024-12-16T05:27:32+00:00", generator: { date: "2024-12-16T05:27:32+00:00", engine: { name: "Red Hat SDEngine", version: "4.2.3", }, }, id: "RHSA-2023:1803", initial_release_date: "2023-04-17T13:56:07+00:00", revision_history: [ { date: "2023-04-17T13:56:07+00:00", number: "1", summary: "Initial version", }, { date: "2023-04-17T13:56:07+00:00", number: "2", summary: "Last updated version", }, { date: "2024-12-16T05:27:32+00:00", number: "3", summary: "Last generated version", }, ], status: "final", version: "3", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_name", name: "Red Hat Enterprise Linux AppStream E4S (v. 8.1)", product: { name: "Red Hat Enterprise Linux AppStream E4S (v. 8.1)", product_id: "AppStream-8.1.0.Z.E4S", product_identification_helper: { cpe: "cpe:/a:redhat:rhel_e4s:8.1::appstream", }, }, }, ], category: "product_family", name: "Red Hat Enterprise Linux", }, { branches: [ { category: "product_version", name: "thunderbird-0:102.10.0-2.el8_1.src", product: { name: "thunderbird-0:102.10.0-2.el8_1.src", product_id: "thunderbird-0:102.10.0-2.el8_1.src", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird@102.10.0-2.el8_1?arch=src", }, }, }, ], category: "architecture", name: "src", }, { branches: [ { category: "product_version", name: "thunderbird-0:102.10.0-2.el8_1.ppc64le", product: { name: "thunderbird-0:102.10.0-2.el8_1.ppc64le", product_id: "thunderbird-0:102.10.0-2.el8_1.ppc64le", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird@102.10.0-2.el8_1?arch=ppc64le", }, }, }, { category: "product_version", name: "thunderbird-debugsource-0:102.10.0-2.el8_1.ppc64le", product: { name: "thunderbird-debugsource-0:102.10.0-2.el8_1.ppc64le", product_id: "thunderbird-debugsource-0:102.10.0-2.el8_1.ppc64le", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird-debugsource@102.10.0-2.el8_1?arch=ppc64le", }, }, }, { category: "product_version", name: "thunderbird-debuginfo-0:102.10.0-2.el8_1.ppc64le", product: { name: "thunderbird-debuginfo-0:102.10.0-2.el8_1.ppc64le", product_id: "thunderbird-debuginfo-0:102.10.0-2.el8_1.ppc64le", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird-debuginfo@102.10.0-2.el8_1?arch=ppc64le", }, }, }, ], category: "architecture", name: "ppc64le", }, { branches: [ { category: "product_version", name: "thunderbird-0:102.10.0-2.el8_1.x86_64", product: { name: "thunderbird-0:102.10.0-2.el8_1.x86_64", product_id: "thunderbird-0:102.10.0-2.el8_1.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird@102.10.0-2.el8_1?arch=x86_64", }, }, }, { category: "product_version", name: "thunderbird-debugsource-0:102.10.0-2.el8_1.x86_64", product: { name: "thunderbird-debugsource-0:102.10.0-2.el8_1.x86_64", product_id: "thunderbird-debugsource-0:102.10.0-2.el8_1.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird-debugsource@102.10.0-2.el8_1?arch=x86_64", }, }, }, { category: "product_version", name: "thunderbird-debuginfo-0:102.10.0-2.el8_1.x86_64", product: { name: "thunderbird-debuginfo-0:102.10.0-2.el8_1.x86_64", product_id: "thunderbird-debuginfo-0:102.10.0-2.el8_1.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird-debuginfo@102.10.0-2.el8_1?arch=x86_64", }, }, }, ], category: "architecture", name: "x86_64", }, ], category: "vendor", name: "Red Hat", }, ], relationships: [ { category: "default_component_of", full_product_name: { name: "thunderbird-0:102.10.0-2.el8_1.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v. 8.1)", product_id: "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.ppc64le", }, product_reference: "thunderbird-0:102.10.0-2.el8_1.ppc64le", relates_to_product_reference: "AppStream-8.1.0.Z.E4S", }, { category: "default_component_of", full_product_name: { name: "thunderbird-0:102.10.0-2.el8_1.src as a component of Red Hat Enterprise Linux AppStream E4S (v. 8.1)", product_id: "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.src", }, product_reference: "thunderbird-0:102.10.0-2.el8_1.src", relates_to_product_reference: "AppStream-8.1.0.Z.E4S", }, { category: "default_component_of", full_product_name: { name: "thunderbird-0:102.10.0-2.el8_1.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v. 8.1)", product_id: "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.x86_64", }, product_reference: "thunderbird-0:102.10.0-2.el8_1.x86_64", relates_to_product_reference: "AppStream-8.1.0.Z.E4S", }, { category: "default_component_of", full_product_name: { name: "thunderbird-debuginfo-0:102.10.0-2.el8_1.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v. 8.1)", product_id: "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.ppc64le", }, product_reference: "thunderbird-debuginfo-0:102.10.0-2.el8_1.ppc64le", relates_to_product_reference: "AppStream-8.1.0.Z.E4S", }, { category: "default_component_of", full_product_name: { name: "thunderbird-debuginfo-0:102.10.0-2.el8_1.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v. 8.1)", product_id: "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.x86_64", }, product_reference: "thunderbird-debuginfo-0:102.10.0-2.el8_1.x86_64", relates_to_product_reference: "AppStream-8.1.0.Z.E4S", }, { category: "default_component_of", full_product_name: { name: "thunderbird-debugsource-0:102.10.0-2.el8_1.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v. 8.1)", product_id: "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.ppc64le", }, product_reference: "thunderbird-debugsource-0:102.10.0-2.el8_1.ppc64le", relates_to_product_reference: "AppStream-8.1.0.Z.E4S", }, { category: "default_component_of", full_product_name: { name: "thunderbird-debugsource-0:102.10.0-2.el8_1.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v. 8.1)", product_id: "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.x86_64", }, product_reference: "thunderbird-debugsource-0:102.10.0-2.el8_1.x86_64", relates_to_product_reference: "AppStream-8.1.0.Z.E4S", }, ], }, vulnerabilities: [ { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Paul Menzel", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-0547", cwe: { id: "CWE-356", name: "Product UI does not Warn User of Unsafe Actions", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186734", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nOCSP revocation status of recipient certificates was not checked when sending S/Mime encrypted email, and revoked certificates would be accepted. Thunderbird versions from 68 to 102.9.1 were affected by this bug.", title: "Vulnerability description", }, { category: "summary", text: "Thunderbird: Revocation status of S/Mime recipient certificates was not checked", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.src", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-0547", }, { category: "external", summary: "RHBZ#2186734", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186734", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-0547", url: "https://www.cve.org/CVERecord?id=CVE-2023-0547", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-0547", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-0547", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-15/#CVE-2023-0547", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-15/#CVE-2023-0547", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T13:56:07+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.src", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1803", }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 7.5, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.src", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "Thunderbird: Revocation status of S/Mime recipient certificates was not checked", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Gabriele Svelto", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-1945", cwe: { id: "CWE-119", name: "Improper Restriction of Operations within the Bounds of a Memory Buffer", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186109", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nUnexpected data returned from the Safe Browsing API could have led to memory corruption and a potentially exploitable crash.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Memory Corruption in Safe Browsing Code", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.src", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-1945", }, { category: "external", summary: "RHBZ#2186109", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186109", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-1945", url: "https://www.cve.org/CVERecord?id=CVE-2023-1945", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-1945", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-1945", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-1945", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-1945", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T13:56:07+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.src", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1803", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "NONE", baseScore: 6.1, baseSeverity: "MEDIUM", confidentialityImpact: "LOW", integrityImpact: "LOW", privilegesRequired: "NONE", scope: "CHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", version: "3.1", }, products: [ "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.src", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "Mozilla: Memory Corruption in Safe Browsing Code", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Irvan Kurniawan", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-1999", cwe: { id: "CWE-415", name: "Double Free", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186102", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nA double-free in libwebp could have led to memory corruption and a potentially exploitable crash.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: libwebp: Double-free in libwebp", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.src", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-1999", }, { category: "external", summary: "RHBZ#2186102", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186102", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-1999", url: "https://www.cve.org/CVERecord?id=CVE-2023-1999", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-1999", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-1999", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-1999", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-1999", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-15/#CVE-2023-1999", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-15/#CVE-2023-1999", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T13:56:07+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.src", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1803", }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 7.5, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.src", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "Mozilla: libwebp: Double-free in libwebp", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Matrix Security Team", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-28427", cwe: { id: "CWE-1321", name: "Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')", }, discovery_date: "2023-03-28T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2183278", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nThunderbird users who use the Matrix chat protocol were vulnerable to a denial-of-service attack.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Matrix SDK bundled with Thunderbird vulnerable to denial-of-service attack", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.src", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-28427", }, { category: "external", summary: "RHBZ#2183278", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2183278", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-28427", url: "https://www.cve.org/CVERecord?id=CVE-2023-28427", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-28427", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-28427", }, { category: "external", summary: "https://github.com/matrix-org/matrix-js-sdk/security/advisories/GHSA-mwq8-fjpf-c2gr", url: "https://github.com/matrix-org/matrix-js-sdk/security/advisories/GHSA-mwq8-fjpf-c2gr", }, { category: "external", summary: "https://matrix.org/blog/2023/03/28/security-releases-matrix-js-sdk-24-0-0-and-matrix-react-sdk-3-69-0", url: "https://matrix.org/blog/2023/03/28/security-releases-matrix-js-sdk-24-0-0-and-matrix-react-sdk-3-69-0", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-12/#CVE-2023-28427", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-12/#CVE-2023-28427", }, ], release_date: "2023-03-28T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T13:56:07+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.src", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1803", }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 7.5, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.src", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "Mozilla: Matrix SDK bundled with Thunderbird vulnerable to denial-of-service attack", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Ribose RNP Team", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29479", cwe: { id: "CWE-400", name: "Uncontrolled Resource Consumption", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186735", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nCertain malformed OpenPGP messages could trigger incorrect parsing of PKESK/SKESK packets due to a bug in the Ribose RNP library used by Thunderbird up to version 102.9.1, which would cause the Thunderbird user interface to hang. The issue was discovered using Google's oss-fuzz.", title: "Vulnerability description", }, { category: "summary", text: "Thunderbird: Hang when processing certain OpenPGP messages", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.src", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29479", }, { category: "external", summary: "RHBZ#2186735", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186735", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29479", url: "https://www.cve.org/CVERecord?id=CVE-2023-29479", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29479", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29479", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-15/#CVE-2023-29479", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-15/#CVE-2023-29479", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T13:56:07+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.src", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1803", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 6.5, baseSeverity: "MEDIUM", confidentialityImpact: "NONE", integrityImpact: "NONE", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", version: "3.1", }, products: [ "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.src", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "Thunderbird: Hang when processing certain OpenPGP messages", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Irvan Kurniawan", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29533", cwe: { id: "CWE-425", name: "Direct Request ('Forced Browsing')", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186101", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nA website could have obscured the fullscreen notification by using a combination of `window.open`, fullscreen requests, `window.name` assignments, and `setInterval` calls. This could have led to user confusion and possible spoofing attacks.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Fullscreen notification obscured", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.src", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29533", }, { category: "external", summary: "RHBZ#2186101", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186101", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29533", url: "https://www.cve.org/CVERecord?id=CVE-2023-29533", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29533", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29533", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29533", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29533", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T13:56:07+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.src", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1803", }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 7.5, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.src", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "Mozilla: Fullscreen notification obscured", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Lukas Bernhard", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29535", cwe: { id: "CWE-119", name: "Improper Restriction of Operations within the Bounds of a Memory Buffer", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186103", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nFollowing a Garbage Collector compaction, weak maps may have been accessed before they were correctly traced. This resulted in memory corruption and a potentially exploitable crash.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Potential Memory Corruption following Garbage Collector compaction", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.src", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29535", }, { category: "external", summary: "RHBZ#2186103", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186103", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29535", url: "https://www.cve.org/CVERecord?id=CVE-2023-29535", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29535", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29535", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29535", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29535", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T13:56:07+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.src", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1803", }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 7.5, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.src", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "Mozilla: Potential Memory Corruption following Garbage Collector compaction", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "zx from qriousec", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29536", cwe: { id: "CWE-617", name: "Reachable Assertion", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186104", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nAn attacker could cause the memory manager to incorrectly free a pointer that addresses attacker-controlled memory, resulting in an assertion, memory corruption, or a potentially exploitable crash.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Invalid free from JavaScript code", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.src", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29536", }, { category: "external", summary: "RHBZ#2186104", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186104", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29536", url: "https://www.cve.org/CVERecord?id=CVE-2023-29536", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29536", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29536", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29536", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29536", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T13:56:07+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.src", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1803", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 8.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.src", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "Mozilla: Invalid free from JavaScript code", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Trung Pham", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29539", cwe: { id: "CWE-159", name: "Improper Handling of Invalid Use of Special Elements", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186105", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nWhen handling the filename directive in the Content-Disposition header, the filename would be truncated if the filename contained a NULL character. This could have led to reflected file download attacks potentially tricking users to install malware.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Content-Disposition filename truncation leads to Reflected File Download", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.src", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29539", }, { category: "external", summary: "RHBZ#2186105", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186105", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29539", url: "https://www.cve.org/CVERecord?id=CVE-2023-29539", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29539", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29539", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29539", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29539", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T13:56:07+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.src", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1803", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 8.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.src", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "Mozilla: Content-Disposition filename truncation leads to Reflected File Download", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Ameen Basha M K", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29541", cwe: { id: "CWE-434", name: "Unrestricted Upload of File with Dangerous Type", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186106", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nFirefox did not properly handle downloads of files ending in `.desktop`, which can be interpreted to run attacker-controlled commands.\r\n\r\n*This bug only affects Firefox for Linux on certain Distributions. Other operating systems are unaffected, and Mozilla is unable to enumerate all affected Linux Distributions.*", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Files with malicious extensions could have been downloaded unsafely on Linux", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.src", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29541", }, { category: "external", summary: "RHBZ#2186106", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186106", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29541", url: "https://www.cve.org/CVERecord?id=CVE-2023-29541", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29541", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29541", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29541", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29541", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T13:56:07+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.src", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1803", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 8.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.src", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "Mozilla: Files with malicious extensions could have been downloaded unsafely on Linux", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "JunYoung Park", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29548", cwe: { id: "CWE-682", name: "Incorrect Calculation", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186110", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nA wrong lowering instruction in the ARM64 Ion compiler resulted in a wrong optimization result.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Incorrect optimization result on ARM64", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.src", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29548", }, { category: "external", summary: "RHBZ#2186110", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186110", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29548", url: "https://www.cve.org/CVERecord?id=CVE-2023-29548", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29548", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29548", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29548", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29548", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T13:56:07+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.src", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1803", }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "NONE", baseScore: 3.4, baseSeverity: "LOW", confidentialityImpact: "NONE", integrityImpact: "LOW", privilegesRequired: "NONE", scope: "CHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:N", version: "3.1", }, products: [ "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.src", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.x86_64", ], }, ], threats: [ { category: "impact", details: "Low", }, ], title: "Mozilla: Incorrect optimization result on ARM64", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Mozilla developers and community", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29550", cwe: { id: "CWE-120", name: "Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186111", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nMozilla developers Andrew Osmond, Sebastian Hengst, Andrew McCreight, and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 111 and Firefox ESR 102.9. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Memory safety bugs fixed in Firefox 112 and Firefox ESR 102.10", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.src", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29550", }, { category: "external", summary: "RHBZ#2186111", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186111", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29550", url: "https://www.cve.org/CVERecord?id=CVE-2023-29550", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29550", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29550", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29550", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29550", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T13:56:07+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.src", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1803", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 8.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.src", "AppStream-8.1.0.Z.E4S:thunderbird-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debuginfo-0:102.10.0-2.el8_1.x86_64", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.ppc64le", "AppStream-8.1.0.Z.E4S:thunderbird-debugsource-0:102.10.0-2.el8_1.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "Mozilla: Memory safety bugs fixed in Firefox 112 and Firefox ESR 102.10", }, ], }
rhsa-2023:1806
Vulnerability from csaf_redhat
Published
2023-04-17 15:05
Modified
2024-12-16 05:26
Summary
Red Hat Security Advisory: thunderbird security update
Notes
Topic
An update for thunderbird is now available for Red Hat Enterprise Linux 7.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Mozilla Thunderbird is a standalone mail and newsgroup client.
This update upgrades Thunderbird to version 102.10.0.
Security Fix(es):
* Thunderbird: Revocation status of S/Mime recipient certificates was not checked (CVE-2023-0547)
* Mozilla: Matrix SDK bundled with Thunderbird vulnerable to denial-of-service attack (CVE-2023-28427)
* Mozilla: Fullscreen notification obscured (CVE-2023-29533)
* Mozilla: Potential Memory Corruption following Garbage Collector compaction (CVE-2023-29535)
* Mozilla: Invalid free from JavaScript code (CVE-2023-29536)
* Mozilla: Memory safety bugs fixed in Firefox 112 and Firefox ESR 102.10 (CVE-2023-29550)
* Mozilla: Memory Corruption in Safe Browsing Code (CVE-2023-1945)
* Thunderbird: Hang when processing certain OpenPGP messages (CVE-2023-29479)
* Mozilla: Content-Disposition filename truncation leads to Reflected File Download (CVE-2023-29539)
* Mozilla: Files with malicious extensions could have been downloaded unsafely on Linux (CVE-2023-29541)
* Mozilla: Incorrect optimization result on ARM64 (CVE-2023-29548)
* MFSA-TMP-2023-0001 Mozilla: Double-free in libwebp (BZ#2186102)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ document: { aggregate_severity: { namespace: "https://access.redhat.com/security/updates/classification/", text: "Important", }, category: "csaf_security_advisory", csaf_version: "2.0", distribution: { text: "Copyright © Red Hat, Inc. All rights reserved.", tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "en", notes: [ { category: "summary", text: "An update for thunderbird is now available for Red Hat Enterprise Linux 7.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", title: "Topic", }, { category: "general", text: "Mozilla Thunderbird is a standalone mail and newsgroup client.\n\nThis update upgrades Thunderbird to version 102.10.0.\n\nSecurity Fix(es):\n\n* Thunderbird: Revocation status of S/Mime recipient certificates was not checked (CVE-2023-0547)\n\n* Mozilla: Matrix SDK bundled with Thunderbird vulnerable to denial-of-service attack (CVE-2023-28427)\n\n* Mozilla: Fullscreen notification obscured (CVE-2023-29533)\n\n* Mozilla: Potential Memory Corruption following Garbage Collector compaction (CVE-2023-29535)\n\n* Mozilla: Invalid free from JavaScript code (CVE-2023-29536)\n\n* Mozilla: Memory safety bugs fixed in Firefox 112 and Firefox ESR 102.10 (CVE-2023-29550)\n\n* Mozilla: Memory Corruption in Safe Browsing Code (CVE-2023-1945)\n\n* Thunderbird: Hang when processing certain OpenPGP messages (CVE-2023-29479)\n\n* Mozilla: Content-Disposition filename truncation leads to Reflected File Download (CVE-2023-29539)\n\n* Mozilla: Files with malicious extensions could have been downloaded unsafely on Linux (CVE-2023-29541)\n\n* Mozilla: Incorrect optimization result on ARM64 (CVE-2023-29548)\n\n* MFSA-TMP-2023-0001 Mozilla: Double-free in libwebp (BZ#2186102)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", title: "Details", }, { category: "legal_disclaimer", text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", title: "Terms of Use", }, ], publisher: { category: "vendor", contact_details: "https://access.redhat.com/security/team/contact/", issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", name: "Red Hat Product Security", namespace: "https://www.redhat.com", }, references: [ { category: "self", summary: "https://access.redhat.com/errata/RHSA-2023:1806", url: "https://access.redhat.com/errata/RHSA-2023:1806", }, { category: "external", summary: "https://access.redhat.com/security/updates/classification/#important", url: "https://access.redhat.com/security/updates/classification/#important", }, { category: "external", summary: "2183278", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2183278", }, { category: "external", summary: "2186101", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186101", }, { category: "external", summary: "2186102", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186102", }, { category: "external", summary: "2186103", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186103", }, { category: "external", summary: "2186104", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186104", }, { category: "external", summary: "2186105", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186105", }, { category: "external", summary: "2186106", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186106", }, { category: "external", summary: "2186109", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186109", }, { category: "external", summary: "2186110", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186110", }, { category: "external", summary: "2186111", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186111", }, { category: "external", summary: "2186734", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186734", }, { category: "external", summary: "2186735", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186735", }, { category: "self", summary: "Canonical URL", url: "https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_1806.json", }, ], title: "Red Hat Security Advisory: thunderbird security update", tracking: { current_release_date: "2024-12-16T05:26:29+00:00", generator: { date: "2024-12-16T05:26:29+00:00", engine: { name: "Red Hat SDEngine", version: "4.2.3", }, }, id: "RHSA-2023:1806", initial_release_date: "2023-04-17T15:05:37+00:00", revision_history: [ { date: "2023-04-17T15:05:37+00:00", number: "1", summary: "Initial version", }, { date: "2023-04-17T15:05:37+00:00", number: "2", summary: "Last updated version", }, { date: "2024-12-16T05:26:29+00:00", number: "3", summary: "Last generated version", }, ], status: "final", version: "3", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_name", name: "Red Hat Enterprise Linux Client (v. 7)", product: { name: "Red Hat Enterprise Linux Client (v. 7)", product_id: "7Client-7.9.Z", product_identification_helper: { cpe: "cpe:/o:redhat:enterprise_linux:7::client", }, }, }, { category: "product_name", name: "Red Hat Enterprise Linux Server Optional (v. 7)", product: { name: "Red Hat Enterprise Linux Server Optional (v. 7)", product_id: "7Server-optional-7.9.Z", product_identification_helper: { cpe: "cpe:/o:redhat:enterprise_linux:7::server", }, }, }, { category: "product_name", name: "Red Hat Enterprise Linux Workstation (v. 7)", product: { name: "Red Hat Enterprise Linux Workstation (v. 7)", product_id: "7Workstation-7.9.Z", product_identification_helper: { cpe: "cpe:/o:redhat:enterprise_linux:7::workstation", }, }, }, ], category: "product_family", name: "Red Hat Enterprise Linux", }, { branches: [ { category: "product_version", name: "thunderbird-0:102.10.0-2.el7_9.src", product: { name: "thunderbird-0:102.10.0-2.el7_9.src", product_id: "thunderbird-0:102.10.0-2.el7_9.src", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird@102.10.0-2.el7_9?arch=src", }, }, }, ], category: "architecture", name: "src", }, { branches: [ { category: "product_version", name: "thunderbird-0:102.10.0-2.el7_9.x86_64", product: { name: "thunderbird-0:102.10.0-2.el7_9.x86_64", product_id: "thunderbird-0:102.10.0-2.el7_9.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird@102.10.0-2.el7_9?arch=x86_64", }, }, }, { category: "product_version", name: "thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", product: { name: "thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", product_id: "thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird-debuginfo@102.10.0-2.el7_9?arch=x86_64", }, }, }, ], category: "architecture", name: "x86_64", }, { branches: [ { category: "product_version", name: "thunderbird-0:102.10.0-2.el7_9.ppc64le", product: { name: "thunderbird-0:102.10.0-2.el7_9.ppc64le", product_id: "thunderbird-0:102.10.0-2.el7_9.ppc64le", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird@102.10.0-2.el7_9?arch=ppc64le", }, }, }, { category: "product_version", name: "thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", product: { name: "thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", product_id: "thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird-debuginfo@102.10.0-2.el7_9?arch=ppc64le", }, }, }, ], category: "architecture", name: "ppc64le", }, ], category: "vendor", name: "Red Hat", }, ], relationships: [ { category: "default_component_of", full_product_name: { name: "thunderbird-0:102.10.0-2.el7_9.ppc64le as a component of Red Hat Enterprise Linux Client (v. 7)", product_id: "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", }, product_reference: "thunderbird-0:102.10.0-2.el7_9.ppc64le", relates_to_product_reference: "7Client-7.9.Z", }, { category: "default_component_of", full_product_name: { name: "thunderbird-0:102.10.0-2.el7_9.src as a component of Red Hat Enterprise Linux Client (v. 7)", product_id: "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", }, product_reference: "thunderbird-0:102.10.0-2.el7_9.src", relates_to_product_reference: "7Client-7.9.Z", }, { category: "default_component_of", full_product_name: { name: "thunderbird-0:102.10.0-2.el7_9.x86_64 as a component of Red Hat Enterprise Linux Client (v. 7)", product_id: "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", }, product_reference: "thunderbird-0:102.10.0-2.el7_9.x86_64", relates_to_product_reference: "7Client-7.9.Z", }, { category: "default_component_of", full_product_name: { name: "thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le as a component of Red Hat Enterprise Linux Client (v. 7)", product_id: "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", }, product_reference: "thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", relates_to_product_reference: "7Client-7.9.Z", }, { category: "default_component_of", full_product_name: { name: "thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64 as a component of Red Hat Enterprise Linux Client (v. 7)", product_id: "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", }, product_reference: "thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", relates_to_product_reference: "7Client-7.9.Z", }, { category: "default_component_of", full_product_name: { name: "thunderbird-0:102.10.0-2.el7_9.ppc64le as a component of Red Hat Enterprise Linux Server Optional (v. 7)", product_id: "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", }, product_reference: "thunderbird-0:102.10.0-2.el7_9.ppc64le", relates_to_product_reference: "7Server-optional-7.9.Z", }, { category: "default_component_of", full_product_name: { name: "thunderbird-0:102.10.0-2.el7_9.src as a component of Red Hat Enterprise Linux Server Optional (v. 7)", product_id: "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", }, product_reference: "thunderbird-0:102.10.0-2.el7_9.src", relates_to_product_reference: "7Server-optional-7.9.Z", }, { category: "default_component_of", full_product_name: { name: "thunderbird-0:102.10.0-2.el7_9.x86_64 as a component of Red Hat Enterprise Linux Server Optional (v. 7)", product_id: "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", }, product_reference: "thunderbird-0:102.10.0-2.el7_9.x86_64", relates_to_product_reference: "7Server-optional-7.9.Z", }, { category: "default_component_of", full_product_name: { name: "thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le as a component of Red Hat Enterprise Linux Server Optional (v. 7)", product_id: "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", }, product_reference: "thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", relates_to_product_reference: "7Server-optional-7.9.Z", }, { category: "default_component_of", full_product_name: { name: "thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64 as a component of Red Hat Enterprise Linux Server Optional (v. 7)", product_id: "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", }, product_reference: "thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", relates_to_product_reference: "7Server-optional-7.9.Z", }, { category: "default_component_of", full_product_name: { name: "thunderbird-0:102.10.0-2.el7_9.ppc64le as a component of Red Hat Enterprise Linux Workstation (v. 7)", product_id: "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", }, product_reference: "thunderbird-0:102.10.0-2.el7_9.ppc64le", relates_to_product_reference: "7Workstation-7.9.Z", }, { category: "default_component_of", full_product_name: { name: "thunderbird-0:102.10.0-2.el7_9.src as a component of Red Hat Enterprise Linux Workstation (v. 7)", product_id: "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", }, product_reference: "thunderbird-0:102.10.0-2.el7_9.src", relates_to_product_reference: "7Workstation-7.9.Z", }, { category: "default_component_of", full_product_name: { name: "thunderbird-0:102.10.0-2.el7_9.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 7)", product_id: "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", }, product_reference: "thunderbird-0:102.10.0-2.el7_9.x86_64", relates_to_product_reference: "7Workstation-7.9.Z", }, { category: "default_component_of", full_product_name: { name: "thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le as a component of Red Hat Enterprise Linux Workstation (v. 7)", product_id: "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", }, product_reference: "thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", relates_to_product_reference: "7Workstation-7.9.Z", }, { category: "default_component_of", full_product_name: { name: "thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 7)", product_id: "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", }, product_reference: "thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", relates_to_product_reference: "7Workstation-7.9.Z", }, ], }, vulnerabilities: [ { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Paul Menzel", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-0547", cwe: { id: "CWE-356", name: "Product UI does not Warn User of Unsafe Actions", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186734", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nOCSP revocation status of recipient certificates was not checked when sending S/Mime encrypted email, and revoked certificates would be accepted. Thunderbird versions from 68 to 102.9.1 were affected by this bug.", title: "Vulnerability description", }, { category: "summary", text: "Thunderbird: Revocation status of S/Mime recipient certificates was not checked", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-0547", }, { category: "external", summary: "RHBZ#2186734", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186734", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-0547", url: "https://www.cve.org/CVERecord?id=CVE-2023-0547", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-0547", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-0547", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-15/#CVE-2023-0547", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-15/#CVE-2023-0547", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T15:05:37+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1806", }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 7.5, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "Thunderbird: Revocation status of S/Mime recipient certificates was not checked", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Gabriele Svelto", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-1945", cwe: { id: "CWE-119", name: "Improper Restriction of Operations within the Bounds of a Memory Buffer", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186109", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nUnexpected data returned from the Safe Browsing API could have led to memory corruption and a potentially exploitable crash.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Memory Corruption in Safe Browsing Code", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-1945", }, { category: "external", summary: "RHBZ#2186109", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186109", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-1945", url: "https://www.cve.org/CVERecord?id=CVE-2023-1945", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-1945", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-1945", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-1945", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-1945", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T15:05:37+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1806", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "NONE", baseScore: 6.1, baseSeverity: "MEDIUM", confidentialityImpact: "LOW", integrityImpact: "LOW", privilegesRequired: "NONE", scope: "CHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", version: "3.1", }, products: [ "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "Mozilla: Memory Corruption in Safe Browsing Code", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Irvan Kurniawan", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-1999", cwe: { id: "CWE-415", name: "Double Free", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186102", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nA double-free in libwebp could have led to memory corruption and a potentially exploitable crash.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: libwebp: Double-free in libwebp", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-1999", }, { category: "external", summary: "RHBZ#2186102", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186102", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-1999", url: "https://www.cve.org/CVERecord?id=CVE-2023-1999", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-1999", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-1999", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-1999", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-1999", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-15/#CVE-2023-1999", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-15/#CVE-2023-1999", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T15:05:37+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1806", }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 7.5, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "Mozilla: libwebp: Double-free in libwebp", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Matrix Security Team", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-28427", cwe: { id: "CWE-1321", name: "Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')", }, discovery_date: "2023-03-28T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2183278", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nThunderbird users who use the Matrix chat protocol were vulnerable to a denial-of-service attack.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Matrix SDK bundled with Thunderbird vulnerable to denial-of-service attack", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-28427", }, { category: "external", summary: "RHBZ#2183278", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2183278", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-28427", url: "https://www.cve.org/CVERecord?id=CVE-2023-28427", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-28427", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-28427", }, { category: "external", summary: "https://github.com/matrix-org/matrix-js-sdk/security/advisories/GHSA-mwq8-fjpf-c2gr", url: "https://github.com/matrix-org/matrix-js-sdk/security/advisories/GHSA-mwq8-fjpf-c2gr", }, { category: "external", summary: "https://matrix.org/blog/2023/03/28/security-releases-matrix-js-sdk-24-0-0-and-matrix-react-sdk-3-69-0", url: "https://matrix.org/blog/2023/03/28/security-releases-matrix-js-sdk-24-0-0-and-matrix-react-sdk-3-69-0", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-12/#CVE-2023-28427", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-12/#CVE-2023-28427", }, ], release_date: "2023-03-28T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T15:05:37+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1806", }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 7.5, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "Mozilla: Matrix SDK bundled with Thunderbird vulnerable to denial-of-service attack", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Ribose RNP Team", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29479", cwe: { id: "CWE-400", name: "Uncontrolled Resource Consumption", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186735", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nCertain malformed OpenPGP messages could trigger incorrect parsing of PKESK/SKESK packets due to a bug in the Ribose RNP library used by Thunderbird up to version 102.9.1, which would cause the Thunderbird user interface to hang. The issue was discovered using Google's oss-fuzz.", title: "Vulnerability description", }, { category: "summary", text: "Thunderbird: Hang when processing certain OpenPGP messages", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29479", }, { category: "external", summary: "RHBZ#2186735", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186735", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29479", url: "https://www.cve.org/CVERecord?id=CVE-2023-29479", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29479", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29479", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-15/#CVE-2023-29479", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-15/#CVE-2023-29479", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T15:05:37+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1806", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 6.5, baseSeverity: "MEDIUM", confidentialityImpact: "NONE", integrityImpact: "NONE", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", version: "3.1", }, products: [ "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "Thunderbird: Hang when processing certain OpenPGP messages", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Irvan Kurniawan", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29533", cwe: { id: "CWE-425", name: "Direct Request ('Forced Browsing')", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186101", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nA website could have obscured the fullscreen notification by using a combination of `window.open`, fullscreen requests, `window.name` assignments, and `setInterval` calls. This could have led to user confusion and possible spoofing attacks.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Fullscreen notification obscured", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29533", }, { category: "external", summary: "RHBZ#2186101", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186101", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29533", url: "https://www.cve.org/CVERecord?id=CVE-2023-29533", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29533", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29533", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29533", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29533", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T15:05:37+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1806", }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 7.5, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "Mozilla: Fullscreen notification obscured", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Lukas Bernhard", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29535", cwe: { id: "CWE-119", name: "Improper Restriction of Operations within the Bounds of a Memory Buffer", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186103", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nFollowing a Garbage Collector compaction, weak maps may have been accessed before they were correctly traced. This resulted in memory corruption and a potentially exploitable crash.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Potential Memory Corruption following Garbage Collector compaction", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29535", }, { category: "external", summary: "RHBZ#2186103", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186103", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29535", url: "https://www.cve.org/CVERecord?id=CVE-2023-29535", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29535", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29535", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29535", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29535", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T15:05:37+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1806", }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 7.5, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "Mozilla: Potential Memory Corruption following Garbage Collector compaction", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "zx from qriousec", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29536", cwe: { id: "CWE-617", name: "Reachable Assertion", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186104", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nAn attacker could cause the memory manager to incorrectly free a pointer that addresses attacker-controlled memory, resulting in an assertion, memory corruption, or a potentially exploitable crash.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Invalid free from JavaScript code", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29536", }, { category: "external", summary: "RHBZ#2186104", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186104", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29536", url: "https://www.cve.org/CVERecord?id=CVE-2023-29536", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29536", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29536", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29536", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29536", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T15:05:37+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1806", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 8.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "Mozilla: Invalid free from JavaScript code", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Trung Pham", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29539", cwe: { id: "CWE-159", name: "Improper Handling of Invalid Use of Special Elements", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186105", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nWhen handling the filename directive in the Content-Disposition header, the filename would be truncated if the filename contained a NULL character. This could have led to reflected file download attacks potentially tricking users to install malware.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Content-Disposition filename truncation leads to Reflected File Download", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29539", }, { category: "external", summary: "RHBZ#2186105", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186105", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29539", url: "https://www.cve.org/CVERecord?id=CVE-2023-29539", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29539", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29539", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29539", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29539", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T15:05:37+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1806", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 8.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "Mozilla: Content-Disposition filename truncation leads to Reflected File Download", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Ameen Basha M K", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29541", cwe: { id: "CWE-434", name: "Unrestricted Upload of File with Dangerous Type", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186106", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nFirefox did not properly handle downloads of files ending in `.desktop`, which can be interpreted to run attacker-controlled commands.\r\n\r\n*This bug only affects Firefox for Linux on certain Distributions. Other operating systems are unaffected, and Mozilla is unable to enumerate all affected Linux Distributions.*", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Files with malicious extensions could have been downloaded unsafely on Linux", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29541", }, { category: "external", summary: "RHBZ#2186106", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186106", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29541", url: "https://www.cve.org/CVERecord?id=CVE-2023-29541", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29541", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29541", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29541", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29541", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T15:05:37+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1806", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 8.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "Mozilla: Files with malicious extensions could have been downloaded unsafely on Linux", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "JunYoung Park", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29548", cwe: { id: "CWE-682", name: "Incorrect Calculation", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186110", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nA wrong lowering instruction in the ARM64 Ion compiler resulted in a wrong optimization result.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Incorrect optimization result on ARM64", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29548", }, { category: "external", summary: "RHBZ#2186110", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186110", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29548", url: "https://www.cve.org/CVERecord?id=CVE-2023-29548", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29548", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29548", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29548", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29548", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T15:05:37+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1806", }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "NONE", baseScore: 3.4, baseSeverity: "LOW", confidentialityImpact: "NONE", integrityImpact: "LOW", privilegesRequired: "NONE", scope: "CHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:N", version: "3.1", }, products: [ "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", ], }, ], threats: [ { category: "impact", details: "Low", }, ], title: "Mozilla: Incorrect optimization result on ARM64", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Mozilla developers and community", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29550", cwe: { id: "CWE-120", name: "Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186111", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nMozilla developers Andrew Osmond, Sebastian Hengst, Andrew McCreight, and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 111 and Firefox ESR 102.9. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Memory safety bugs fixed in Firefox 112 and Firefox ESR 102.10", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29550", }, { category: "external", summary: "RHBZ#2186111", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186111", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29550", url: "https://www.cve.org/CVERecord?id=CVE-2023-29550", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29550", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29550", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29550", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29550", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T15:05:37+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1806", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 8.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "Mozilla: Memory safety bugs fixed in Firefox 112 and Firefox ESR 102.10", }, ], }
rhsa-2023:1810
Vulnerability from csaf_redhat
Published
2023-04-17 15:03
Modified
2024-12-16 05:27
Summary
Red Hat Security Advisory: thunderbird security update
Notes
Topic
An update for thunderbird is now available for Red Hat Enterprise Linux 9.0 Extended Update Support.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Mozilla Thunderbird is a standalone mail and newsgroup client.
This update upgrades Thunderbird to version 102.10.0.
Security Fix(es):
* Thunderbird: Revocation status of S/Mime recipient certificates was not checked (CVE-2023-0547)
* Mozilla: Matrix SDK bundled with Thunderbird vulnerable to denial-of-service attack (CVE-2023-28427)
* Mozilla: Fullscreen notification obscured (CVE-2023-29533)
* Mozilla: Potential Memory Corruption following Garbage Collector compaction (CVE-2023-29535)
* Mozilla: Invalid free from JavaScript code (CVE-2023-29536)
* Mozilla: Memory safety bugs fixed in Firefox 112 and Firefox ESR 102.10 (CVE-2023-29550)
* Mozilla: Memory Corruption in Safe Browsing Code (CVE-2023-1945)
* Thunderbird: Hang when processing certain OpenPGP messages (CVE-2023-29479)
* Mozilla: Content-Disposition filename truncation leads to Reflected File Download (CVE-2023-29539)
* Mozilla: Files with malicious extensions could have been downloaded unsafely on Linux (CVE-2023-29541)
* Mozilla: Incorrect optimization result on ARM64 (CVE-2023-29548)
* MFSA-TMP-2023-0001 Mozilla: Double-free in libwebp (BZ#2186102)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ document: { aggregate_severity: { namespace: "https://access.redhat.com/security/updates/classification/", text: "Important", }, category: "csaf_security_advisory", csaf_version: "2.0", distribution: { text: "Copyright © Red Hat, Inc. All rights reserved.", tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "en", notes: [ { category: "summary", text: "An update for thunderbird is now available for Red Hat Enterprise Linux 9.0 Extended Update Support.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", title: "Topic", }, { category: "general", text: "Mozilla Thunderbird is a standalone mail and newsgroup client.\n\nThis update upgrades Thunderbird to version 102.10.0.\n\nSecurity Fix(es):\n\n* Thunderbird: Revocation status of S/Mime recipient certificates was not checked (CVE-2023-0547)\n\n* Mozilla: Matrix SDK bundled with Thunderbird vulnerable to denial-of-service attack (CVE-2023-28427)\n\n* Mozilla: Fullscreen notification obscured (CVE-2023-29533)\n\n* Mozilla: Potential Memory Corruption following Garbage Collector compaction (CVE-2023-29535)\n\n* Mozilla: Invalid free from JavaScript code (CVE-2023-29536)\n\n* Mozilla: Memory safety bugs fixed in Firefox 112 and Firefox ESR 102.10 (CVE-2023-29550)\n\n* Mozilla: Memory Corruption in Safe Browsing Code (CVE-2023-1945)\n\n* Thunderbird: Hang when processing certain OpenPGP messages (CVE-2023-29479)\n\n* Mozilla: Content-Disposition filename truncation leads to Reflected File Download (CVE-2023-29539)\n\n* Mozilla: Files with malicious extensions could have been downloaded unsafely on Linux (CVE-2023-29541)\n\n* Mozilla: Incorrect optimization result on ARM64 (CVE-2023-29548)\n\n* MFSA-TMP-2023-0001 Mozilla: Double-free in libwebp (BZ#2186102)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", title: "Details", }, { category: "legal_disclaimer", text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", title: "Terms of Use", }, ], publisher: { category: "vendor", contact_details: "https://access.redhat.com/security/team/contact/", issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", name: "Red Hat Product Security", namespace: "https://www.redhat.com", }, references: [ { category: "self", summary: "https://access.redhat.com/errata/RHSA-2023:1810", url: "https://access.redhat.com/errata/RHSA-2023:1810", }, { category: "external", summary: "https://access.redhat.com/security/updates/classification/#important", url: "https://access.redhat.com/security/updates/classification/#important", }, { category: "external", summary: "2183278", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2183278", }, { category: "external", summary: "2186101", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186101", }, { category: "external", summary: "2186102", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186102", }, { category: "external", summary: "2186103", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186103", }, { category: "external", summary: "2186104", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186104", }, { category: "external", summary: "2186105", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186105", }, { category: "external", summary: "2186106", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186106", }, { category: "external", summary: "2186109", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186109", }, { category: "external", summary: "2186110", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186110", }, { category: "external", summary: "2186111", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186111", }, { category: "external", summary: "2186734", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186734", }, { category: "external", summary: "2186735", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186735", }, { category: "self", summary: "Canonical URL", url: "https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_1810.json", }, ], title: "Red Hat Security Advisory: thunderbird security update", tracking: { current_release_date: "2024-12-16T05:27:04+00:00", generator: { date: "2024-12-16T05:27:04+00:00", engine: { name: "Red Hat SDEngine", version: "4.2.3", }, }, id: "RHSA-2023:1810", initial_release_date: "2023-04-17T15:03:40+00:00", revision_history: [ { date: "2023-04-17T15:03:40+00:00", number: "1", summary: "Initial version", }, { date: "2023-04-17T15:03:40+00:00", number: "2", summary: "Last updated version", }, { date: "2024-12-16T05:27:04+00:00", number: "3", summary: "Last generated version", }, ], status: "final", version: "3", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_name", name: "Red Hat Enterprise Linux AppStream EUS (v.9.0)", product: { name: "Red Hat Enterprise Linux AppStream EUS (v.9.0)", product_id: "AppStream-9.0.0.Z.EUS", product_identification_helper: { cpe: "cpe:/a:redhat:rhel_eus:9.0::appstream", }, }, }, ], category: "product_family", name: "Red Hat Enterprise Linux", }, { branches: [ { category: "product_version", name: "thunderbird-0:102.10.0-2.el9_0.src", product: { name: "thunderbird-0:102.10.0-2.el9_0.src", product_id: "thunderbird-0:102.10.0-2.el9_0.src", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird@102.10.0-2.el9_0?arch=src", }, }, }, ], category: "architecture", name: "src", }, { branches: [ { category: "product_version", name: "thunderbird-0:102.10.0-2.el9_0.aarch64", product: { name: "thunderbird-0:102.10.0-2.el9_0.aarch64", product_id: "thunderbird-0:102.10.0-2.el9_0.aarch64", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird@102.10.0-2.el9_0?arch=aarch64", }, }, }, { category: "product_version", name: "thunderbird-debugsource-0:102.10.0-2.el9_0.aarch64", product: { name: "thunderbird-debugsource-0:102.10.0-2.el9_0.aarch64", product_id: "thunderbird-debugsource-0:102.10.0-2.el9_0.aarch64", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird-debugsource@102.10.0-2.el9_0?arch=aarch64", }, }, }, { category: "product_version", name: "thunderbird-debuginfo-0:102.10.0-2.el9_0.aarch64", product: { name: "thunderbird-debuginfo-0:102.10.0-2.el9_0.aarch64", product_id: "thunderbird-debuginfo-0:102.10.0-2.el9_0.aarch64", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird-debuginfo@102.10.0-2.el9_0?arch=aarch64", }, }, }, ], category: "architecture", name: "aarch64", }, { branches: [ { category: "product_version", name: "thunderbird-0:102.10.0-2.el9_0.ppc64le", product: { name: "thunderbird-0:102.10.0-2.el9_0.ppc64le", product_id: "thunderbird-0:102.10.0-2.el9_0.ppc64le", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird@102.10.0-2.el9_0?arch=ppc64le", }, }, }, { category: "product_version", name: "thunderbird-debugsource-0:102.10.0-2.el9_0.ppc64le", product: { name: "thunderbird-debugsource-0:102.10.0-2.el9_0.ppc64le", product_id: "thunderbird-debugsource-0:102.10.0-2.el9_0.ppc64le", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird-debugsource@102.10.0-2.el9_0?arch=ppc64le", }, }, }, { category: "product_version", name: "thunderbird-debuginfo-0:102.10.0-2.el9_0.ppc64le", product: { name: "thunderbird-debuginfo-0:102.10.0-2.el9_0.ppc64le", product_id: "thunderbird-debuginfo-0:102.10.0-2.el9_0.ppc64le", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird-debuginfo@102.10.0-2.el9_0?arch=ppc64le", }, }, }, ], category: "architecture", name: "ppc64le", }, { branches: [ { category: "product_version", name: "thunderbird-0:102.10.0-2.el9_0.x86_64", product: { name: "thunderbird-0:102.10.0-2.el9_0.x86_64", product_id: "thunderbird-0:102.10.0-2.el9_0.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird@102.10.0-2.el9_0?arch=x86_64", }, }, }, { category: "product_version", name: "thunderbird-debugsource-0:102.10.0-2.el9_0.x86_64", product: { name: "thunderbird-debugsource-0:102.10.0-2.el9_0.x86_64", product_id: "thunderbird-debugsource-0:102.10.0-2.el9_0.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird-debugsource@102.10.0-2.el9_0?arch=x86_64", }, }, }, { category: "product_version", name: "thunderbird-debuginfo-0:102.10.0-2.el9_0.x86_64", product: { name: "thunderbird-debuginfo-0:102.10.0-2.el9_0.x86_64", product_id: "thunderbird-debuginfo-0:102.10.0-2.el9_0.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird-debuginfo@102.10.0-2.el9_0?arch=x86_64", }, }, }, ], category: "architecture", name: "x86_64", }, { branches: [ { category: "product_version", name: "thunderbird-0:102.10.0-2.el9_0.s390x", product: { name: "thunderbird-0:102.10.0-2.el9_0.s390x", product_id: "thunderbird-0:102.10.0-2.el9_0.s390x", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird@102.10.0-2.el9_0?arch=s390x", }, }, }, { category: "product_version", name: "thunderbird-debugsource-0:102.10.0-2.el9_0.s390x", product: { name: "thunderbird-debugsource-0:102.10.0-2.el9_0.s390x", product_id: "thunderbird-debugsource-0:102.10.0-2.el9_0.s390x", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird-debugsource@102.10.0-2.el9_0?arch=s390x", }, }, }, { category: "product_version", name: "thunderbird-debuginfo-0:102.10.0-2.el9_0.s390x", product: { name: "thunderbird-debuginfo-0:102.10.0-2.el9_0.s390x", product_id: "thunderbird-debuginfo-0:102.10.0-2.el9_0.s390x", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird-debuginfo@102.10.0-2.el9_0?arch=s390x", }, }, }, ], category: "architecture", name: "s390x", }, ], category: "vendor", name: "Red Hat", }, ], relationships: [ { category: "default_component_of", full_product_name: { name: "thunderbird-0:102.10.0-2.el9_0.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.0)", product_id: "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.aarch64", }, product_reference: "thunderbird-0:102.10.0-2.el9_0.aarch64", relates_to_product_reference: "AppStream-9.0.0.Z.EUS", }, { category: "default_component_of", full_product_name: { name: "thunderbird-0:102.10.0-2.el9_0.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.9.0)", product_id: "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.ppc64le", }, product_reference: "thunderbird-0:102.10.0-2.el9_0.ppc64le", relates_to_product_reference: "AppStream-9.0.0.Z.EUS", }, { category: "default_component_of", full_product_name: { name: "thunderbird-0:102.10.0-2.el9_0.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.9.0)", product_id: "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.s390x", }, product_reference: "thunderbird-0:102.10.0-2.el9_0.s390x", relates_to_product_reference: "AppStream-9.0.0.Z.EUS", }, { category: "default_component_of", full_product_name: { name: "thunderbird-0:102.10.0-2.el9_0.src as a component of Red Hat Enterprise Linux AppStream EUS (v.9.0)", product_id: "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.src", }, product_reference: "thunderbird-0:102.10.0-2.el9_0.src", relates_to_product_reference: "AppStream-9.0.0.Z.EUS", }, { category: "default_component_of", full_product_name: { name: "thunderbird-0:102.10.0-2.el9_0.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.0)", product_id: "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.x86_64", }, product_reference: "thunderbird-0:102.10.0-2.el9_0.x86_64", relates_to_product_reference: "AppStream-9.0.0.Z.EUS", }, { category: "default_component_of", full_product_name: { name: "thunderbird-debuginfo-0:102.10.0-2.el9_0.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.0)", product_id: "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.aarch64", }, product_reference: "thunderbird-debuginfo-0:102.10.0-2.el9_0.aarch64", relates_to_product_reference: "AppStream-9.0.0.Z.EUS", }, { category: "default_component_of", full_product_name: { name: "thunderbird-debuginfo-0:102.10.0-2.el9_0.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.9.0)", product_id: "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.ppc64le", }, product_reference: "thunderbird-debuginfo-0:102.10.0-2.el9_0.ppc64le", relates_to_product_reference: "AppStream-9.0.0.Z.EUS", }, { category: "default_component_of", full_product_name: { name: "thunderbird-debuginfo-0:102.10.0-2.el9_0.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.9.0)", product_id: "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.s390x", }, product_reference: "thunderbird-debuginfo-0:102.10.0-2.el9_0.s390x", relates_to_product_reference: "AppStream-9.0.0.Z.EUS", }, { category: "default_component_of", full_product_name: { name: "thunderbird-debuginfo-0:102.10.0-2.el9_0.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.0)", product_id: "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.x86_64", }, product_reference: "thunderbird-debuginfo-0:102.10.0-2.el9_0.x86_64", relates_to_product_reference: "AppStream-9.0.0.Z.EUS", }, { category: "default_component_of", full_product_name: { name: "thunderbird-debugsource-0:102.10.0-2.el9_0.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.0)", product_id: "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.aarch64", }, product_reference: "thunderbird-debugsource-0:102.10.0-2.el9_0.aarch64", relates_to_product_reference: "AppStream-9.0.0.Z.EUS", }, { category: "default_component_of", full_product_name: { name: "thunderbird-debugsource-0:102.10.0-2.el9_0.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.9.0)", product_id: "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.ppc64le", }, product_reference: "thunderbird-debugsource-0:102.10.0-2.el9_0.ppc64le", relates_to_product_reference: "AppStream-9.0.0.Z.EUS", }, { category: "default_component_of", full_product_name: { name: "thunderbird-debugsource-0:102.10.0-2.el9_0.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.9.0)", product_id: "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.s390x", }, product_reference: "thunderbird-debugsource-0:102.10.0-2.el9_0.s390x", relates_to_product_reference: "AppStream-9.0.0.Z.EUS", }, { category: "default_component_of", full_product_name: { name: "thunderbird-debugsource-0:102.10.0-2.el9_0.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.0)", product_id: "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.x86_64", }, product_reference: "thunderbird-debugsource-0:102.10.0-2.el9_0.x86_64", relates_to_product_reference: "AppStream-9.0.0.Z.EUS", }, ], }, vulnerabilities: [ { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Paul Menzel", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-0547", cwe: { id: "CWE-356", name: "Product UI does not Warn User of Unsafe Actions", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186734", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nOCSP revocation status of recipient certificates was not checked when sending S/Mime encrypted email, and revoked certificates would be accepted. Thunderbird versions from 68 to 102.9.1 were affected by this bug.", title: "Vulnerability description", }, { category: "summary", text: "Thunderbird: Revocation status of S/Mime recipient certificates was not checked", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.src", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-0547", }, { category: "external", summary: "RHBZ#2186734", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186734", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-0547", url: "https://www.cve.org/CVERecord?id=CVE-2023-0547", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-0547", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-0547", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-15/#CVE-2023-0547", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-15/#CVE-2023-0547", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T15:03:40+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.src", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1810", }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 7.5, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.src", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "Thunderbird: Revocation status of S/Mime recipient certificates was not checked", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Gabriele Svelto", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-1945", cwe: { id: "CWE-119", name: "Improper Restriction of Operations within the Bounds of a Memory Buffer", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186109", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nUnexpected data returned from the Safe Browsing API could have led to memory corruption and a potentially exploitable crash.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Memory Corruption in Safe Browsing Code", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.src", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-1945", }, { category: "external", summary: "RHBZ#2186109", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186109", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-1945", url: "https://www.cve.org/CVERecord?id=CVE-2023-1945", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-1945", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-1945", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-1945", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-1945", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T15:03:40+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.src", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1810", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "NONE", baseScore: 6.1, baseSeverity: "MEDIUM", confidentialityImpact: "LOW", integrityImpact: "LOW", privilegesRequired: "NONE", scope: "CHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", version: "3.1", }, products: [ "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.src", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "Mozilla: Memory Corruption in Safe Browsing Code", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Irvan Kurniawan", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-1999", cwe: { id: "CWE-415", name: "Double Free", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186102", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nA double-free in libwebp could have led to memory corruption and a potentially exploitable crash.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: libwebp: Double-free in libwebp", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.src", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-1999", }, { category: "external", summary: "RHBZ#2186102", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186102", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-1999", url: "https://www.cve.org/CVERecord?id=CVE-2023-1999", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-1999", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-1999", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-1999", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-1999", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-15/#CVE-2023-1999", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-15/#CVE-2023-1999", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T15:03:40+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.src", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1810", }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 7.5, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.src", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "Mozilla: libwebp: Double-free in libwebp", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Matrix Security Team", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-28427", cwe: { id: "CWE-1321", name: "Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')", }, discovery_date: "2023-03-28T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2183278", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nThunderbird users who use the Matrix chat protocol were vulnerable to a denial-of-service attack.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Matrix SDK bundled with Thunderbird vulnerable to denial-of-service attack", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.src", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-28427", }, { category: "external", summary: "RHBZ#2183278", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2183278", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-28427", url: "https://www.cve.org/CVERecord?id=CVE-2023-28427", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-28427", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-28427", }, { category: "external", summary: "https://github.com/matrix-org/matrix-js-sdk/security/advisories/GHSA-mwq8-fjpf-c2gr", url: "https://github.com/matrix-org/matrix-js-sdk/security/advisories/GHSA-mwq8-fjpf-c2gr", }, { category: "external", summary: "https://matrix.org/blog/2023/03/28/security-releases-matrix-js-sdk-24-0-0-and-matrix-react-sdk-3-69-0", url: "https://matrix.org/blog/2023/03/28/security-releases-matrix-js-sdk-24-0-0-and-matrix-react-sdk-3-69-0", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-12/#CVE-2023-28427", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-12/#CVE-2023-28427", }, ], release_date: "2023-03-28T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T15:03:40+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.src", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1810", }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 7.5, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.src", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "Mozilla: Matrix SDK bundled with Thunderbird vulnerable to denial-of-service attack", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Ribose RNP Team", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29479", cwe: { id: "CWE-400", name: "Uncontrolled Resource Consumption", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186735", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nCertain malformed OpenPGP messages could trigger incorrect parsing of PKESK/SKESK packets due to a bug in the Ribose RNP library used by Thunderbird up to version 102.9.1, which would cause the Thunderbird user interface to hang. The issue was discovered using Google's oss-fuzz.", title: "Vulnerability description", }, { category: "summary", text: "Thunderbird: Hang when processing certain OpenPGP messages", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.src", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29479", }, { category: "external", summary: "RHBZ#2186735", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186735", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29479", url: "https://www.cve.org/CVERecord?id=CVE-2023-29479", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29479", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29479", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-15/#CVE-2023-29479", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-15/#CVE-2023-29479", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T15:03:40+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.src", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1810", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 6.5, baseSeverity: "MEDIUM", confidentialityImpact: "NONE", integrityImpact: "NONE", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", version: "3.1", }, products: [ "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.src", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "Thunderbird: Hang when processing certain OpenPGP messages", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Irvan Kurniawan", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29533", cwe: { id: "CWE-425", name: "Direct Request ('Forced Browsing')", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186101", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nA website could have obscured the fullscreen notification by using a combination of `window.open`, fullscreen requests, `window.name` assignments, and `setInterval` calls. This could have led to user confusion and possible spoofing attacks.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Fullscreen notification obscured", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.src", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29533", }, { category: "external", summary: "RHBZ#2186101", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186101", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29533", url: "https://www.cve.org/CVERecord?id=CVE-2023-29533", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29533", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29533", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29533", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29533", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T15:03:40+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.src", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1810", }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 7.5, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.src", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "Mozilla: Fullscreen notification obscured", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Lukas Bernhard", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29535", cwe: { id: "CWE-119", name: "Improper Restriction of Operations within the Bounds of a Memory Buffer", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186103", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nFollowing a Garbage Collector compaction, weak maps may have been accessed before they were correctly traced. This resulted in memory corruption and a potentially exploitable crash.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Potential Memory Corruption following Garbage Collector compaction", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.src", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29535", }, { category: "external", summary: "RHBZ#2186103", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186103", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29535", url: "https://www.cve.org/CVERecord?id=CVE-2023-29535", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29535", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29535", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29535", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29535", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T15:03:40+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.src", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1810", }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 7.5, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.src", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "Mozilla: Potential Memory Corruption following Garbage Collector compaction", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "zx from qriousec", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29536", cwe: { id: "CWE-617", name: "Reachable Assertion", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186104", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nAn attacker could cause the memory manager to incorrectly free a pointer that addresses attacker-controlled memory, resulting in an assertion, memory corruption, or a potentially exploitable crash.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Invalid free from JavaScript code", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.src", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29536", }, { category: "external", summary: "RHBZ#2186104", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186104", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29536", url: "https://www.cve.org/CVERecord?id=CVE-2023-29536", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29536", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29536", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29536", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29536", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T15:03:40+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.src", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1810", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 8.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.src", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "Mozilla: Invalid free from JavaScript code", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Trung Pham", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29539", cwe: { id: "CWE-159", name: "Improper Handling of Invalid Use of Special Elements", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186105", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nWhen handling the filename directive in the Content-Disposition header, the filename would be truncated if the filename contained a NULL character. This could have led to reflected file download attacks potentially tricking users to install malware.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Content-Disposition filename truncation leads to Reflected File Download", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.src", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29539", }, { category: "external", summary: "RHBZ#2186105", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186105", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29539", url: "https://www.cve.org/CVERecord?id=CVE-2023-29539", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29539", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29539", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29539", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29539", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T15:03:40+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.src", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1810", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 8.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.src", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "Mozilla: Content-Disposition filename truncation leads to Reflected File Download", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Ameen Basha M K", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29541", cwe: { id: "CWE-434", name: "Unrestricted Upload of File with Dangerous Type", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186106", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nFirefox did not properly handle downloads of files ending in `.desktop`, which can be interpreted to run attacker-controlled commands.\r\n\r\n*This bug only affects Firefox for Linux on certain Distributions. Other operating systems are unaffected, and Mozilla is unable to enumerate all affected Linux Distributions.*", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Files with malicious extensions could have been downloaded unsafely on Linux", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.src", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29541", }, { category: "external", summary: "RHBZ#2186106", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186106", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29541", url: "https://www.cve.org/CVERecord?id=CVE-2023-29541", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29541", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29541", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29541", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29541", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T15:03:40+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.src", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1810", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 8.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.src", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "Mozilla: Files with malicious extensions could have been downloaded unsafely on Linux", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "JunYoung Park", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29548", cwe: { id: "CWE-682", name: "Incorrect Calculation", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186110", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nA wrong lowering instruction in the ARM64 Ion compiler resulted in a wrong optimization result.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Incorrect optimization result on ARM64", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.src", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29548", }, { category: "external", summary: "RHBZ#2186110", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186110", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29548", url: "https://www.cve.org/CVERecord?id=CVE-2023-29548", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29548", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29548", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29548", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29548", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T15:03:40+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.src", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1810", }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "NONE", baseScore: 3.4, baseSeverity: "LOW", confidentialityImpact: "NONE", integrityImpact: "LOW", privilegesRequired: "NONE", scope: "CHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:N", version: "3.1", }, products: [ "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.src", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.x86_64", ], }, ], threats: [ { category: "impact", details: "Low", }, ], title: "Mozilla: Incorrect optimization result on ARM64", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Mozilla developers and community", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29550", cwe: { id: "CWE-120", name: "Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186111", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nMozilla developers Andrew Osmond, Sebastian Hengst, Andrew McCreight, and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 111 and Firefox ESR 102.9. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Memory safety bugs fixed in Firefox 112 and Firefox ESR 102.10", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.src", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29550", }, { category: "external", summary: "RHBZ#2186111", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186111", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29550", url: "https://www.cve.org/CVERecord?id=CVE-2023-29550", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29550", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29550", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29550", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29550", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T15:03:40+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.src", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1810", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 8.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.src", "AppStream-9.0.0.Z.EUS:thunderbird-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el9_0.x86_64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.aarch64", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.ppc64le", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.s390x", "AppStream-9.0.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el9_0.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "Mozilla: Memory safety bugs fixed in Firefox 112 and Firefox ESR 102.10", }, ], }
RHSA-2023:1802
Vulnerability from csaf_redhat
Published
2023-04-17 14:01
Modified
2024-12-16 05:27
Summary
Red Hat Security Advisory: thunderbird security update
Notes
Topic
An update for thunderbird is now available for Red Hat Enterprise Linux 8.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Mozilla Thunderbird is a standalone mail and newsgroup client.
This update upgrades Thunderbird to version 102.10.0.
Security Fix(es):
* Thunderbird: Revocation status of S/Mime recipient certificates was not checked (CVE-2023-0547)
* Mozilla: Matrix SDK bundled with Thunderbird vulnerable to denial-of-service attack (CVE-2023-28427)
* Mozilla: Fullscreen notification obscured (CVE-2023-29533)
* Mozilla: Potential Memory Corruption following Garbage Collector compaction (CVE-2023-29535)
* Mozilla: Invalid free from JavaScript code (CVE-2023-29536)
* Mozilla: Memory safety bugs fixed in Firefox 112 and Firefox ESR 102.10 (CVE-2023-29550)
* Mozilla: Memory Corruption in Safe Browsing Code (CVE-2023-1945)
* Thunderbird: Hang when processing certain OpenPGP messages (CVE-2023-29479)
* Mozilla: Content-Disposition filename truncation leads to Reflected File Download (CVE-2023-29539)
* Mozilla: Files with malicious extensions could have been downloaded unsafely on Linux (CVE-2023-29541)
* Mozilla: Incorrect optimization result on ARM64 (CVE-2023-29548)
* MFSA-TMP-2023-0001 Mozilla: Double-free in libwebp (BZ#2186102)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ document: { aggregate_severity: { namespace: "https://access.redhat.com/security/updates/classification/", text: "Important", }, category: "csaf_security_advisory", csaf_version: "2.0", distribution: { text: "Copyright © Red Hat, Inc. All rights reserved.", tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "en", notes: [ { category: "summary", text: "An update for thunderbird is now available for Red Hat Enterprise Linux 8.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", title: "Topic", }, { category: "general", text: "Mozilla Thunderbird is a standalone mail and newsgroup client.\n\nThis update upgrades Thunderbird to version 102.10.0.\n\nSecurity Fix(es):\n\n* Thunderbird: Revocation status of S/Mime recipient certificates was not checked (CVE-2023-0547)\n\n* Mozilla: Matrix SDK bundled with Thunderbird vulnerable to denial-of-service attack (CVE-2023-28427)\n\n* Mozilla: Fullscreen notification obscured (CVE-2023-29533)\n\n* Mozilla: Potential Memory Corruption following Garbage Collector compaction (CVE-2023-29535)\n\n* Mozilla: Invalid free from JavaScript code (CVE-2023-29536)\n\n* Mozilla: Memory safety bugs fixed in Firefox 112 and Firefox ESR 102.10 (CVE-2023-29550)\n\n* Mozilla: Memory Corruption in Safe Browsing Code (CVE-2023-1945)\n\n* Thunderbird: Hang when processing certain OpenPGP messages (CVE-2023-29479)\n\n* Mozilla: Content-Disposition filename truncation leads to Reflected File Download (CVE-2023-29539)\n\n* Mozilla: Files with malicious extensions could have been downloaded unsafely on Linux (CVE-2023-29541)\n\n* Mozilla: Incorrect optimization result on ARM64 (CVE-2023-29548)\n\n* MFSA-TMP-2023-0001 Mozilla: Double-free in libwebp (BZ#2186102)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", title: "Details", }, { category: "legal_disclaimer", text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", title: "Terms of Use", }, ], publisher: { category: "vendor", contact_details: "https://access.redhat.com/security/team/contact/", issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", name: "Red Hat Product Security", namespace: "https://www.redhat.com", }, references: [ { category: "self", summary: "https://access.redhat.com/errata/RHSA-2023:1802", url: "https://access.redhat.com/errata/RHSA-2023:1802", }, { category: "external", summary: "https://access.redhat.com/security/updates/classification/#important", url: "https://access.redhat.com/security/updates/classification/#important", }, { category: "external", summary: "2183278", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2183278", }, { category: "external", summary: "2186101", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186101", }, { category: "external", summary: "2186102", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186102", }, { category: "external", summary: "2186103", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186103", }, { category: "external", summary: "2186104", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186104", }, { category: "external", summary: "2186105", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186105", }, { category: "external", summary: "2186106", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186106", }, { category: "external", summary: "2186109", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186109", }, { category: "external", summary: "2186110", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186110", }, { category: "external", summary: "2186111", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186111", }, { category: "external", summary: "2186734", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186734", }, { category: "external", summary: "2186735", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186735", }, { category: "self", summary: "Canonical URL", url: "https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_1802.json", }, ], title: "Red Hat Security Advisory: thunderbird security update", tracking: { current_release_date: "2024-12-16T05:27:42+00:00", generator: { date: "2024-12-16T05:27:42+00:00", engine: { name: "Red Hat SDEngine", version: "4.2.3", }, }, id: "RHSA-2023:1802", initial_release_date: "2023-04-17T14:01:57+00:00", revision_history: [ { date: "2023-04-17T14:01:57+00:00", number: "1", summary: "Initial version", }, { date: "2023-04-17T14:01:57+00:00", number: "2", summary: "Last updated version", }, { date: "2024-12-16T05:27:42+00:00", number: "3", summary: "Last generated version", }, ], status: "final", version: "3", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_name", name: "Red Hat Enterprise Linux AppStream (v. 8)", product: { name: "Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.7.0.Z.MAIN", product_identification_helper: { cpe: "cpe:/a:redhat:enterprise_linux:8::appstream", }, }, }, ], category: "product_family", name: "Red Hat Enterprise Linux", }, { branches: [ { category: "product_version", name: "thunderbird-0:102.10.0-2.el8_7.src", product: { name: "thunderbird-0:102.10.0-2.el8_7.src", product_id: "thunderbird-0:102.10.0-2.el8_7.src", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird@102.10.0-2.el8_7?arch=src", }, }, }, ], category: "architecture", name: "src", }, { branches: [ { category: "product_version", name: "thunderbird-0:102.10.0-2.el8_7.aarch64", product: { name: "thunderbird-0:102.10.0-2.el8_7.aarch64", product_id: "thunderbird-0:102.10.0-2.el8_7.aarch64", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird@102.10.0-2.el8_7?arch=aarch64", }, }, }, { category: "product_version", name: "thunderbird-debugsource-0:102.10.0-2.el8_7.aarch64", product: { name: "thunderbird-debugsource-0:102.10.0-2.el8_7.aarch64", product_id: "thunderbird-debugsource-0:102.10.0-2.el8_7.aarch64", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird-debugsource@102.10.0-2.el8_7?arch=aarch64", }, }, }, { category: "product_version", name: "thunderbird-debuginfo-0:102.10.0-2.el8_7.aarch64", product: { name: "thunderbird-debuginfo-0:102.10.0-2.el8_7.aarch64", product_id: "thunderbird-debuginfo-0:102.10.0-2.el8_7.aarch64", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird-debuginfo@102.10.0-2.el8_7?arch=aarch64", }, }, }, ], category: "architecture", name: "aarch64", }, { branches: [ { category: "product_version", name: "thunderbird-0:102.10.0-2.el8_7.ppc64le", product: { name: "thunderbird-0:102.10.0-2.el8_7.ppc64le", product_id: "thunderbird-0:102.10.0-2.el8_7.ppc64le", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird@102.10.0-2.el8_7?arch=ppc64le", }, }, }, { category: "product_version", name: "thunderbird-debugsource-0:102.10.0-2.el8_7.ppc64le", product: { name: "thunderbird-debugsource-0:102.10.0-2.el8_7.ppc64le", product_id: "thunderbird-debugsource-0:102.10.0-2.el8_7.ppc64le", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird-debugsource@102.10.0-2.el8_7?arch=ppc64le", }, }, }, { category: "product_version", name: "thunderbird-debuginfo-0:102.10.0-2.el8_7.ppc64le", product: { name: "thunderbird-debuginfo-0:102.10.0-2.el8_7.ppc64le", product_id: "thunderbird-debuginfo-0:102.10.0-2.el8_7.ppc64le", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird-debuginfo@102.10.0-2.el8_7?arch=ppc64le", }, }, }, ], category: "architecture", name: "ppc64le", }, { branches: [ { category: "product_version", name: "thunderbird-0:102.10.0-2.el8_7.x86_64", product: { name: "thunderbird-0:102.10.0-2.el8_7.x86_64", product_id: "thunderbird-0:102.10.0-2.el8_7.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird@102.10.0-2.el8_7?arch=x86_64", }, }, }, { category: "product_version", name: "thunderbird-debugsource-0:102.10.0-2.el8_7.x86_64", product: { name: "thunderbird-debugsource-0:102.10.0-2.el8_7.x86_64", product_id: "thunderbird-debugsource-0:102.10.0-2.el8_7.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird-debugsource@102.10.0-2.el8_7?arch=x86_64", }, }, }, { category: "product_version", name: "thunderbird-debuginfo-0:102.10.0-2.el8_7.x86_64", product: { name: "thunderbird-debuginfo-0:102.10.0-2.el8_7.x86_64", product_id: "thunderbird-debuginfo-0:102.10.0-2.el8_7.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird-debuginfo@102.10.0-2.el8_7?arch=x86_64", }, }, }, ], category: "architecture", name: "x86_64", }, { branches: [ { category: "product_version", name: "thunderbird-0:102.10.0-2.el8_7.s390x", product: { name: "thunderbird-0:102.10.0-2.el8_7.s390x", product_id: "thunderbird-0:102.10.0-2.el8_7.s390x", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird@102.10.0-2.el8_7?arch=s390x", }, }, }, { category: "product_version", name: "thunderbird-debugsource-0:102.10.0-2.el8_7.s390x", product: { name: "thunderbird-debugsource-0:102.10.0-2.el8_7.s390x", product_id: "thunderbird-debugsource-0:102.10.0-2.el8_7.s390x", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird-debugsource@102.10.0-2.el8_7?arch=s390x", }, }, }, { category: "product_version", name: "thunderbird-debuginfo-0:102.10.0-2.el8_7.s390x", product: { name: "thunderbird-debuginfo-0:102.10.0-2.el8_7.s390x", product_id: "thunderbird-debuginfo-0:102.10.0-2.el8_7.s390x", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird-debuginfo@102.10.0-2.el8_7?arch=s390x", }, }, }, ], category: "architecture", name: "s390x", }, ], category: "vendor", name: "Red Hat", }, ], relationships: [ { category: "default_component_of", full_product_name: { name: "thunderbird-0:102.10.0-2.el8_7.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.aarch64", }, product_reference: "thunderbird-0:102.10.0-2.el8_7.aarch64", relates_to_product_reference: "AppStream-8.7.0.Z.MAIN", }, { category: "default_component_of", full_product_name: { name: "thunderbird-0:102.10.0-2.el8_7.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.ppc64le", }, product_reference: "thunderbird-0:102.10.0-2.el8_7.ppc64le", relates_to_product_reference: "AppStream-8.7.0.Z.MAIN", }, { category: "default_component_of", full_product_name: { name: "thunderbird-0:102.10.0-2.el8_7.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.s390x", }, product_reference: "thunderbird-0:102.10.0-2.el8_7.s390x", relates_to_product_reference: "AppStream-8.7.0.Z.MAIN", }, { category: "default_component_of", full_product_name: { name: "thunderbird-0:102.10.0-2.el8_7.src as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.src", }, product_reference: "thunderbird-0:102.10.0-2.el8_7.src", relates_to_product_reference: "AppStream-8.7.0.Z.MAIN", }, { category: "default_component_of", full_product_name: { name: "thunderbird-0:102.10.0-2.el8_7.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.x86_64", }, product_reference: "thunderbird-0:102.10.0-2.el8_7.x86_64", relates_to_product_reference: "AppStream-8.7.0.Z.MAIN", }, { category: "default_component_of", full_product_name: { name: "thunderbird-debuginfo-0:102.10.0-2.el8_7.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.aarch64", }, product_reference: "thunderbird-debuginfo-0:102.10.0-2.el8_7.aarch64", relates_to_product_reference: "AppStream-8.7.0.Z.MAIN", }, { category: "default_component_of", full_product_name: { name: "thunderbird-debuginfo-0:102.10.0-2.el8_7.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.ppc64le", }, product_reference: "thunderbird-debuginfo-0:102.10.0-2.el8_7.ppc64le", relates_to_product_reference: "AppStream-8.7.0.Z.MAIN", }, { category: "default_component_of", full_product_name: { name: "thunderbird-debuginfo-0:102.10.0-2.el8_7.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.s390x", }, product_reference: "thunderbird-debuginfo-0:102.10.0-2.el8_7.s390x", relates_to_product_reference: "AppStream-8.7.0.Z.MAIN", }, { category: "default_component_of", full_product_name: { name: "thunderbird-debuginfo-0:102.10.0-2.el8_7.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.x86_64", }, product_reference: "thunderbird-debuginfo-0:102.10.0-2.el8_7.x86_64", relates_to_product_reference: "AppStream-8.7.0.Z.MAIN", }, { category: "default_component_of", full_product_name: { name: "thunderbird-debugsource-0:102.10.0-2.el8_7.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.aarch64", }, product_reference: "thunderbird-debugsource-0:102.10.0-2.el8_7.aarch64", relates_to_product_reference: "AppStream-8.7.0.Z.MAIN", }, { category: "default_component_of", full_product_name: { name: "thunderbird-debugsource-0:102.10.0-2.el8_7.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.ppc64le", }, product_reference: "thunderbird-debugsource-0:102.10.0-2.el8_7.ppc64le", relates_to_product_reference: "AppStream-8.7.0.Z.MAIN", }, { category: "default_component_of", full_product_name: { name: "thunderbird-debugsource-0:102.10.0-2.el8_7.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.s390x", }, product_reference: "thunderbird-debugsource-0:102.10.0-2.el8_7.s390x", relates_to_product_reference: "AppStream-8.7.0.Z.MAIN", }, { category: "default_component_of", full_product_name: { name: "thunderbird-debugsource-0:102.10.0-2.el8_7.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.x86_64", }, product_reference: "thunderbird-debugsource-0:102.10.0-2.el8_7.x86_64", relates_to_product_reference: "AppStream-8.7.0.Z.MAIN", }, ], }, vulnerabilities: [ { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Paul Menzel", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-0547", cwe: { id: "CWE-356", name: "Product UI does not Warn User of Unsafe Actions", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186734", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nOCSP revocation status of recipient certificates was not checked when sending S/Mime encrypted email, and revoked certificates would be accepted. Thunderbird versions from 68 to 102.9.1 were affected by this bug.", title: "Vulnerability description", }, { category: "summary", text: "Thunderbird: Revocation status of S/Mime recipient certificates was not checked", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.src", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-0547", }, { category: "external", summary: "RHBZ#2186734", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186734", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-0547", url: "https://www.cve.org/CVERecord?id=CVE-2023-0547", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-0547", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-0547", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-15/#CVE-2023-0547", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-15/#CVE-2023-0547", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T14:01:57+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.src", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1802", }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 7.5, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.src", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "Thunderbird: Revocation status of S/Mime recipient certificates was not checked", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Gabriele Svelto", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-1945", cwe: { id: "CWE-119", name: "Improper Restriction of Operations within the Bounds of a Memory Buffer", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186109", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nUnexpected data returned from the Safe Browsing API could have led to memory corruption and a potentially exploitable crash.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Memory Corruption in Safe Browsing Code", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.src", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-1945", }, { category: "external", summary: "RHBZ#2186109", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186109", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-1945", url: "https://www.cve.org/CVERecord?id=CVE-2023-1945", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-1945", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-1945", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-1945", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-1945", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T14:01:57+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.src", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1802", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "NONE", baseScore: 6.1, baseSeverity: "MEDIUM", confidentialityImpact: "LOW", integrityImpact: "LOW", privilegesRequired: "NONE", scope: "CHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", version: "3.1", }, products: [ "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.src", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "Mozilla: Memory Corruption in Safe Browsing Code", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Irvan Kurniawan", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-1999", cwe: { id: "CWE-415", name: "Double Free", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186102", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nA double-free in libwebp could have led to memory corruption and a potentially exploitable crash.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: libwebp: Double-free in libwebp", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.src", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-1999", }, { category: "external", summary: "RHBZ#2186102", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186102", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-1999", url: "https://www.cve.org/CVERecord?id=CVE-2023-1999", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-1999", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-1999", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-1999", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-1999", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-15/#CVE-2023-1999", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-15/#CVE-2023-1999", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T14:01:57+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.src", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1802", }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 7.5, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.src", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "Mozilla: libwebp: Double-free in libwebp", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Matrix Security Team", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-28427", cwe: { id: "CWE-1321", name: "Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')", }, discovery_date: "2023-03-28T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2183278", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nThunderbird users who use the Matrix chat protocol were vulnerable to a denial-of-service attack.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Matrix SDK bundled with Thunderbird vulnerable to denial-of-service attack", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.src", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-28427", }, { category: "external", summary: "RHBZ#2183278", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2183278", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-28427", url: "https://www.cve.org/CVERecord?id=CVE-2023-28427", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-28427", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-28427", }, { category: "external", summary: "https://github.com/matrix-org/matrix-js-sdk/security/advisories/GHSA-mwq8-fjpf-c2gr", url: "https://github.com/matrix-org/matrix-js-sdk/security/advisories/GHSA-mwq8-fjpf-c2gr", }, { category: "external", summary: "https://matrix.org/blog/2023/03/28/security-releases-matrix-js-sdk-24-0-0-and-matrix-react-sdk-3-69-0", url: "https://matrix.org/blog/2023/03/28/security-releases-matrix-js-sdk-24-0-0-and-matrix-react-sdk-3-69-0", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-12/#CVE-2023-28427", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-12/#CVE-2023-28427", }, ], release_date: "2023-03-28T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T14:01:57+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.src", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1802", }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 7.5, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.src", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "Mozilla: Matrix SDK bundled with Thunderbird vulnerable to denial-of-service attack", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Ribose RNP Team", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29479", cwe: { id: "CWE-400", name: "Uncontrolled Resource Consumption", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186735", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nCertain malformed OpenPGP messages could trigger incorrect parsing of PKESK/SKESK packets due to a bug in the Ribose RNP library used by Thunderbird up to version 102.9.1, which would cause the Thunderbird user interface to hang. The issue was discovered using Google's oss-fuzz.", title: "Vulnerability description", }, { category: "summary", text: "Thunderbird: Hang when processing certain OpenPGP messages", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.src", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29479", }, { category: "external", summary: "RHBZ#2186735", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186735", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29479", url: "https://www.cve.org/CVERecord?id=CVE-2023-29479", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29479", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29479", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-15/#CVE-2023-29479", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-15/#CVE-2023-29479", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T14:01:57+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.src", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1802", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 6.5, baseSeverity: "MEDIUM", confidentialityImpact: "NONE", integrityImpact: "NONE", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", version: "3.1", }, products: [ "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.src", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "Thunderbird: Hang when processing certain OpenPGP messages", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Irvan Kurniawan", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29533", cwe: { id: "CWE-425", name: "Direct Request ('Forced Browsing')", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186101", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nA website could have obscured the fullscreen notification by using a combination of `window.open`, fullscreen requests, `window.name` assignments, and `setInterval` calls. This could have led to user confusion and possible spoofing attacks.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Fullscreen notification obscured", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.src", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29533", }, { category: "external", summary: "RHBZ#2186101", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186101", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29533", url: "https://www.cve.org/CVERecord?id=CVE-2023-29533", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29533", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29533", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29533", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29533", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T14:01:57+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.src", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1802", }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 7.5, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.src", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "Mozilla: Fullscreen notification obscured", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Lukas Bernhard", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29535", cwe: { id: "CWE-119", name: "Improper Restriction of Operations within the Bounds of a Memory Buffer", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186103", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nFollowing a Garbage Collector compaction, weak maps may have been accessed before they were correctly traced. This resulted in memory corruption and a potentially exploitable crash.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Potential Memory Corruption following Garbage Collector compaction", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.src", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29535", }, { category: "external", summary: "RHBZ#2186103", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186103", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29535", url: "https://www.cve.org/CVERecord?id=CVE-2023-29535", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29535", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29535", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29535", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29535", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T14:01:57+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.src", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1802", }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 7.5, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.src", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "Mozilla: Potential Memory Corruption following Garbage Collector compaction", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "zx from qriousec", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29536", cwe: { id: "CWE-617", name: "Reachable Assertion", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186104", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nAn attacker could cause the memory manager to incorrectly free a pointer that addresses attacker-controlled memory, resulting in an assertion, memory corruption, or a potentially exploitable crash.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Invalid free from JavaScript code", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.src", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29536", }, { category: "external", summary: "RHBZ#2186104", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186104", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29536", url: "https://www.cve.org/CVERecord?id=CVE-2023-29536", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29536", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29536", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29536", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29536", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T14:01:57+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.src", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1802", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 8.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.src", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "Mozilla: Invalid free from JavaScript code", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Trung Pham", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29539", cwe: { id: "CWE-159", name: "Improper Handling of Invalid Use of Special Elements", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186105", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nWhen handling the filename directive in the Content-Disposition header, the filename would be truncated if the filename contained a NULL character. This could have led to reflected file download attacks potentially tricking users to install malware.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Content-Disposition filename truncation leads to Reflected File Download", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.src", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29539", }, { category: "external", summary: "RHBZ#2186105", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186105", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29539", url: "https://www.cve.org/CVERecord?id=CVE-2023-29539", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29539", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29539", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29539", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29539", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T14:01:57+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.src", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1802", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 8.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.src", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "Mozilla: Content-Disposition filename truncation leads to Reflected File Download", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Ameen Basha M K", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29541", cwe: { id: "CWE-434", name: "Unrestricted Upload of File with Dangerous Type", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186106", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nFirefox did not properly handle downloads of files ending in `.desktop`, which can be interpreted to run attacker-controlled commands.\r\n\r\n*This bug only affects Firefox for Linux on certain Distributions. Other operating systems are unaffected, and Mozilla is unable to enumerate all affected Linux Distributions.*", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Files with malicious extensions could have been downloaded unsafely on Linux", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.src", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29541", }, { category: "external", summary: "RHBZ#2186106", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186106", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29541", url: "https://www.cve.org/CVERecord?id=CVE-2023-29541", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29541", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29541", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29541", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29541", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T14:01:57+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.src", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1802", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 8.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.src", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "Mozilla: Files with malicious extensions could have been downloaded unsafely on Linux", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "JunYoung Park", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29548", cwe: { id: "CWE-682", name: "Incorrect Calculation", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186110", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nA wrong lowering instruction in the ARM64 Ion compiler resulted in a wrong optimization result.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Incorrect optimization result on ARM64", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.src", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29548", }, { category: "external", summary: "RHBZ#2186110", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186110", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29548", url: "https://www.cve.org/CVERecord?id=CVE-2023-29548", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29548", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29548", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29548", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29548", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T14:01:57+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.src", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1802", }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "NONE", baseScore: 3.4, baseSeverity: "LOW", confidentialityImpact: "NONE", integrityImpact: "LOW", privilegesRequired: "NONE", scope: "CHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:N", version: "3.1", }, products: [ "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.src", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.x86_64", ], }, ], threats: [ { category: "impact", details: "Low", }, ], title: "Mozilla: Incorrect optimization result on ARM64", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Mozilla developers and community", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29550", cwe: { id: "CWE-120", name: "Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186111", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nMozilla developers Andrew Osmond, Sebastian Hengst, Andrew McCreight, and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 111 and Firefox ESR 102.9. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Memory safety bugs fixed in Firefox 112 and Firefox ESR 102.10", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.src", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29550", }, { category: "external", summary: "RHBZ#2186111", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186111", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29550", url: "https://www.cve.org/CVERecord?id=CVE-2023-29550", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29550", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29550", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29550", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29550", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T14:01:57+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.src", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1802", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 8.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.src", "AppStream-8.7.0.Z.MAIN:thunderbird-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debuginfo-0:102.10.0-2.el8_7.x86_64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.aarch64", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.ppc64le", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.s390x", "AppStream-8.7.0.Z.MAIN:thunderbird-debugsource-0:102.10.0-2.el8_7.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "Mozilla: Memory safety bugs fixed in Firefox 112 and Firefox ESR 102.10", }, ], }
RHSA-2023:1806
Vulnerability from csaf_redhat
Published
2023-04-17 15:05
Modified
2024-12-16 05:26
Summary
Red Hat Security Advisory: thunderbird security update
Notes
Topic
An update for thunderbird is now available for Red Hat Enterprise Linux 7.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Mozilla Thunderbird is a standalone mail and newsgroup client.
This update upgrades Thunderbird to version 102.10.0.
Security Fix(es):
* Thunderbird: Revocation status of S/Mime recipient certificates was not checked (CVE-2023-0547)
* Mozilla: Matrix SDK bundled with Thunderbird vulnerable to denial-of-service attack (CVE-2023-28427)
* Mozilla: Fullscreen notification obscured (CVE-2023-29533)
* Mozilla: Potential Memory Corruption following Garbage Collector compaction (CVE-2023-29535)
* Mozilla: Invalid free from JavaScript code (CVE-2023-29536)
* Mozilla: Memory safety bugs fixed in Firefox 112 and Firefox ESR 102.10 (CVE-2023-29550)
* Mozilla: Memory Corruption in Safe Browsing Code (CVE-2023-1945)
* Thunderbird: Hang when processing certain OpenPGP messages (CVE-2023-29479)
* Mozilla: Content-Disposition filename truncation leads to Reflected File Download (CVE-2023-29539)
* Mozilla: Files with malicious extensions could have been downloaded unsafely on Linux (CVE-2023-29541)
* Mozilla: Incorrect optimization result on ARM64 (CVE-2023-29548)
* MFSA-TMP-2023-0001 Mozilla: Double-free in libwebp (BZ#2186102)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ document: { aggregate_severity: { namespace: "https://access.redhat.com/security/updates/classification/", text: "Important", }, category: "csaf_security_advisory", csaf_version: "2.0", distribution: { text: "Copyright © Red Hat, Inc. All rights reserved.", tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "en", notes: [ { category: "summary", text: "An update for thunderbird is now available for Red Hat Enterprise Linux 7.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", title: "Topic", }, { category: "general", text: "Mozilla Thunderbird is a standalone mail and newsgroup client.\n\nThis update upgrades Thunderbird to version 102.10.0.\n\nSecurity Fix(es):\n\n* Thunderbird: Revocation status of S/Mime recipient certificates was not checked (CVE-2023-0547)\n\n* Mozilla: Matrix SDK bundled with Thunderbird vulnerable to denial-of-service attack (CVE-2023-28427)\n\n* Mozilla: Fullscreen notification obscured (CVE-2023-29533)\n\n* Mozilla: Potential Memory Corruption following Garbage Collector compaction (CVE-2023-29535)\n\n* Mozilla: Invalid free from JavaScript code (CVE-2023-29536)\n\n* Mozilla: Memory safety bugs fixed in Firefox 112 and Firefox ESR 102.10 (CVE-2023-29550)\n\n* Mozilla: Memory Corruption in Safe Browsing Code (CVE-2023-1945)\n\n* Thunderbird: Hang when processing certain OpenPGP messages (CVE-2023-29479)\n\n* Mozilla: Content-Disposition filename truncation leads to Reflected File Download (CVE-2023-29539)\n\n* Mozilla: Files with malicious extensions could have been downloaded unsafely on Linux (CVE-2023-29541)\n\n* Mozilla: Incorrect optimization result on ARM64 (CVE-2023-29548)\n\n* MFSA-TMP-2023-0001 Mozilla: Double-free in libwebp (BZ#2186102)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", title: "Details", }, { category: "legal_disclaimer", text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", title: "Terms of Use", }, ], publisher: { category: "vendor", contact_details: "https://access.redhat.com/security/team/contact/", issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", name: "Red Hat Product Security", namespace: "https://www.redhat.com", }, references: [ { category: "self", summary: "https://access.redhat.com/errata/RHSA-2023:1806", url: "https://access.redhat.com/errata/RHSA-2023:1806", }, { category: "external", summary: "https://access.redhat.com/security/updates/classification/#important", url: "https://access.redhat.com/security/updates/classification/#important", }, { category: "external", summary: "2183278", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2183278", }, { category: "external", summary: "2186101", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186101", }, { category: "external", summary: "2186102", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186102", }, { category: "external", summary: "2186103", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186103", }, { category: "external", summary: "2186104", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186104", }, { category: "external", summary: "2186105", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186105", }, { category: "external", summary: "2186106", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186106", }, { category: "external", summary: "2186109", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186109", }, { category: "external", summary: "2186110", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186110", }, { category: "external", summary: "2186111", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186111", }, { category: "external", summary: "2186734", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186734", }, { category: "external", summary: "2186735", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186735", }, { category: "self", summary: "Canonical URL", url: "https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_1806.json", }, ], title: "Red Hat Security Advisory: thunderbird security update", tracking: { current_release_date: "2024-12-16T05:26:29+00:00", generator: { date: "2024-12-16T05:26:29+00:00", engine: { name: "Red Hat SDEngine", version: "4.2.3", }, }, id: "RHSA-2023:1806", initial_release_date: "2023-04-17T15:05:37+00:00", revision_history: [ { date: "2023-04-17T15:05:37+00:00", number: "1", summary: "Initial version", }, { date: "2023-04-17T15:05:37+00:00", number: "2", summary: "Last updated version", }, { date: "2024-12-16T05:26:29+00:00", number: "3", summary: "Last generated version", }, ], status: "final", version: "3", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_name", name: "Red Hat Enterprise Linux Client (v. 7)", product: { name: "Red Hat Enterprise Linux Client (v. 7)", product_id: "7Client-7.9.Z", product_identification_helper: { cpe: "cpe:/o:redhat:enterprise_linux:7::client", }, }, }, { category: "product_name", name: "Red Hat Enterprise Linux Server Optional (v. 7)", product: { name: "Red Hat Enterprise Linux Server Optional (v. 7)", product_id: "7Server-optional-7.9.Z", product_identification_helper: { cpe: "cpe:/o:redhat:enterprise_linux:7::server", }, }, }, { category: "product_name", name: "Red Hat Enterprise Linux Workstation (v. 7)", product: { name: "Red Hat Enterprise Linux Workstation (v. 7)", product_id: "7Workstation-7.9.Z", product_identification_helper: { cpe: "cpe:/o:redhat:enterprise_linux:7::workstation", }, }, }, ], category: "product_family", name: "Red Hat Enterprise Linux", }, { branches: [ { category: "product_version", name: "thunderbird-0:102.10.0-2.el7_9.src", product: { name: "thunderbird-0:102.10.0-2.el7_9.src", product_id: "thunderbird-0:102.10.0-2.el7_9.src", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird@102.10.0-2.el7_9?arch=src", }, }, }, ], category: "architecture", name: "src", }, { branches: [ { category: "product_version", name: "thunderbird-0:102.10.0-2.el7_9.x86_64", product: { name: "thunderbird-0:102.10.0-2.el7_9.x86_64", product_id: "thunderbird-0:102.10.0-2.el7_9.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird@102.10.0-2.el7_9?arch=x86_64", }, }, }, { category: "product_version", name: "thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", product: { name: "thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", product_id: "thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird-debuginfo@102.10.0-2.el7_9?arch=x86_64", }, }, }, ], category: "architecture", name: "x86_64", }, { branches: [ { category: "product_version", name: "thunderbird-0:102.10.0-2.el7_9.ppc64le", product: { name: "thunderbird-0:102.10.0-2.el7_9.ppc64le", product_id: "thunderbird-0:102.10.0-2.el7_9.ppc64le", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird@102.10.0-2.el7_9?arch=ppc64le", }, }, }, { category: "product_version", name: "thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", product: { name: "thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", product_id: "thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird-debuginfo@102.10.0-2.el7_9?arch=ppc64le", }, }, }, ], category: "architecture", name: "ppc64le", }, ], category: "vendor", name: "Red Hat", }, ], relationships: [ { category: "default_component_of", full_product_name: { name: "thunderbird-0:102.10.0-2.el7_9.ppc64le as a component of Red Hat Enterprise Linux Client (v. 7)", product_id: "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", }, product_reference: "thunderbird-0:102.10.0-2.el7_9.ppc64le", relates_to_product_reference: "7Client-7.9.Z", }, { category: "default_component_of", full_product_name: { name: "thunderbird-0:102.10.0-2.el7_9.src as a component of Red Hat Enterprise Linux Client (v. 7)", product_id: "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", }, product_reference: "thunderbird-0:102.10.0-2.el7_9.src", relates_to_product_reference: "7Client-7.9.Z", }, { category: "default_component_of", full_product_name: { name: "thunderbird-0:102.10.0-2.el7_9.x86_64 as a component of Red Hat Enterprise Linux Client (v. 7)", product_id: "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", }, product_reference: "thunderbird-0:102.10.0-2.el7_9.x86_64", relates_to_product_reference: "7Client-7.9.Z", }, { category: "default_component_of", full_product_name: { name: "thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le as a component of Red Hat Enterprise Linux Client (v. 7)", product_id: "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", }, product_reference: "thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", relates_to_product_reference: "7Client-7.9.Z", }, { category: "default_component_of", full_product_name: { name: "thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64 as a component of Red Hat Enterprise Linux Client (v. 7)", product_id: "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", }, product_reference: "thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", relates_to_product_reference: "7Client-7.9.Z", }, { category: "default_component_of", full_product_name: { name: "thunderbird-0:102.10.0-2.el7_9.ppc64le as a component of Red Hat Enterprise Linux Server Optional (v. 7)", product_id: "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", }, product_reference: "thunderbird-0:102.10.0-2.el7_9.ppc64le", relates_to_product_reference: "7Server-optional-7.9.Z", }, { category: "default_component_of", full_product_name: { name: "thunderbird-0:102.10.0-2.el7_9.src as a component of Red Hat Enterprise Linux Server Optional (v. 7)", product_id: "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", }, product_reference: "thunderbird-0:102.10.0-2.el7_9.src", relates_to_product_reference: "7Server-optional-7.9.Z", }, { category: "default_component_of", full_product_name: { name: "thunderbird-0:102.10.0-2.el7_9.x86_64 as a component of Red Hat Enterprise Linux Server Optional (v. 7)", product_id: "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", }, product_reference: "thunderbird-0:102.10.0-2.el7_9.x86_64", relates_to_product_reference: "7Server-optional-7.9.Z", }, { category: "default_component_of", full_product_name: { name: "thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le as a component of Red Hat Enterprise Linux Server Optional (v. 7)", product_id: "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", }, product_reference: "thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", relates_to_product_reference: "7Server-optional-7.9.Z", }, { category: "default_component_of", full_product_name: { name: "thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64 as a component of Red Hat Enterprise Linux Server Optional (v. 7)", product_id: "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", }, product_reference: "thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", relates_to_product_reference: "7Server-optional-7.9.Z", }, { category: "default_component_of", full_product_name: { name: "thunderbird-0:102.10.0-2.el7_9.ppc64le as a component of Red Hat Enterprise Linux Workstation (v. 7)", product_id: "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", }, product_reference: "thunderbird-0:102.10.0-2.el7_9.ppc64le", relates_to_product_reference: "7Workstation-7.9.Z", }, { category: "default_component_of", full_product_name: { name: "thunderbird-0:102.10.0-2.el7_9.src as a component of Red Hat Enterprise Linux Workstation (v. 7)", product_id: "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", }, product_reference: "thunderbird-0:102.10.0-2.el7_9.src", relates_to_product_reference: "7Workstation-7.9.Z", }, { category: "default_component_of", full_product_name: { name: "thunderbird-0:102.10.0-2.el7_9.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 7)", product_id: "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", }, product_reference: "thunderbird-0:102.10.0-2.el7_9.x86_64", relates_to_product_reference: "7Workstation-7.9.Z", }, { category: "default_component_of", full_product_name: { name: "thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le as a component of Red Hat Enterprise Linux Workstation (v. 7)", product_id: "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", }, product_reference: "thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", relates_to_product_reference: "7Workstation-7.9.Z", }, { category: "default_component_of", full_product_name: { name: "thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 7)", product_id: "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", }, product_reference: "thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", relates_to_product_reference: "7Workstation-7.9.Z", }, ], }, vulnerabilities: [ { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Paul Menzel", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-0547", cwe: { id: "CWE-356", name: "Product UI does not Warn User of Unsafe Actions", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186734", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nOCSP revocation status of recipient certificates was not checked when sending S/Mime encrypted email, and revoked certificates would be accepted. Thunderbird versions from 68 to 102.9.1 were affected by this bug.", title: "Vulnerability description", }, { category: "summary", text: "Thunderbird: Revocation status of S/Mime recipient certificates was not checked", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-0547", }, { category: "external", summary: "RHBZ#2186734", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186734", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-0547", url: "https://www.cve.org/CVERecord?id=CVE-2023-0547", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-0547", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-0547", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-15/#CVE-2023-0547", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-15/#CVE-2023-0547", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T15:05:37+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1806", }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 7.5, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "Thunderbird: Revocation status of S/Mime recipient certificates was not checked", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Gabriele Svelto", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-1945", cwe: { id: "CWE-119", name: "Improper Restriction of Operations within the Bounds of a Memory Buffer", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186109", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nUnexpected data returned from the Safe Browsing API could have led to memory corruption and a potentially exploitable crash.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Memory Corruption in Safe Browsing Code", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-1945", }, { category: "external", summary: "RHBZ#2186109", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186109", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-1945", url: "https://www.cve.org/CVERecord?id=CVE-2023-1945", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-1945", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-1945", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-1945", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-1945", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T15:05:37+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1806", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "NONE", baseScore: 6.1, baseSeverity: "MEDIUM", confidentialityImpact: "LOW", integrityImpact: "LOW", privilegesRequired: "NONE", scope: "CHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", version: "3.1", }, products: [ "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "Mozilla: Memory Corruption in Safe Browsing Code", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Irvan Kurniawan", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-1999", cwe: { id: "CWE-415", name: "Double Free", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186102", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nA double-free in libwebp could have led to memory corruption and a potentially exploitable crash.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: libwebp: Double-free in libwebp", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-1999", }, { category: "external", summary: "RHBZ#2186102", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186102", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-1999", url: "https://www.cve.org/CVERecord?id=CVE-2023-1999", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-1999", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-1999", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-1999", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-1999", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-15/#CVE-2023-1999", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-15/#CVE-2023-1999", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T15:05:37+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1806", }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 7.5, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "Mozilla: libwebp: Double-free in libwebp", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Matrix Security Team", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-28427", cwe: { id: "CWE-1321", name: "Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')", }, discovery_date: "2023-03-28T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2183278", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nThunderbird users who use the Matrix chat protocol were vulnerable to a denial-of-service attack.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Matrix SDK bundled with Thunderbird vulnerable to denial-of-service attack", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-28427", }, { category: "external", summary: "RHBZ#2183278", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2183278", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-28427", url: "https://www.cve.org/CVERecord?id=CVE-2023-28427", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-28427", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-28427", }, { category: "external", summary: "https://github.com/matrix-org/matrix-js-sdk/security/advisories/GHSA-mwq8-fjpf-c2gr", url: "https://github.com/matrix-org/matrix-js-sdk/security/advisories/GHSA-mwq8-fjpf-c2gr", }, { category: "external", summary: "https://matrix.org/blog/2023/03/28/security-releases-matrix-js-sdk-24-0-0-and-matrix-react-sdk-3-69-0", url: "https://matrix.org/blog/2023/03/28/security-releases-matrix-js-sdk-24-0-0-and-matrix-react-sdk-3-69-0", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-12/#CVE-2023-28427", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-12/#CVE-2023-28427", }, ], release_date: "2023-03-28T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T15:05:37+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1806", }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 7.5, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "Mozilla: Matrix SDK bundled with Thunderbird vulnerable to denial-of-service attack", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Ribose RNP Team", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29479", cwe: { id: "CWE-400", name: "Uncontrolled Resource Consumption", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186735", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nCertain malformed OpenPGP messages could trigger incorrect parsing of PKESK/SKESK packets due to a bug in the Ribose RNP library used by Thunderbird up to version 102.9.1, which would cause the Thunderbird user interface to hang. The issue was discovered using Google's oss-fuzz.", title: "Vulnerability description", }, { category: "summary", text: "Thunderbird: Hang when processing certain OpenPGP messages", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29479", }, { category: "external", summary: "RHBZ#2186735", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186735", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29479", url: "https://www.cve.org/CVERecord?id=CVE-2023-29479", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29479", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29479", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-15/#CVE-2023-29479", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-15/#CVE-2023-29479", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T15:05:37+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1806", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 6.5, baseSeverity: "MEDIUM", confidentialityImpact: "NONE", integrityImpact: "NONE", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", version: "3.1", }, products: [ "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "Thunderbird: Hang when processing certain OpenPGP messages", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Irvan Kurniawan", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29533", cwe: { id: "CWE-425", name: "Direct Request ('Forced Browsing')", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186101", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nA website could have obscured the fullscreen notification by using a combination of `window.open`, fullscreen requests, `window.name` assignments, and `setInterval` calls. This could have led to user confusion and possible spoofing attacks.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Fullscreen notification obscured", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29533", }, { category: "external", summary: "RHBZ#2186101", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186101", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29533", url: "https://www.cve.org/CVERecord?id=CVE-2023-29533", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29533", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29533", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29533", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29533", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T15:05:37+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1806", }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 7.5, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "Mozilla: Fullscreen notification obscured", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Lukas Bernhard", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29535", cwe: { id: "CWE-119", name: "Improper Restriction of Operations within the Bounds of a Memory Buffer", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186103", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nFollowing a Garbage Collector compaction, weak maps may have been accessed before they were correctly traced. This resulted in memory corruption and a potentially exploitable crash.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Potential Memory Corruption following Garbage Collector compaction", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29535", }, { category: "external", summary: "RHBZ#2186103", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186103", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29535", url: "https://www.cve.org/CVERecord?id=CVE-2023-29535", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29535", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29535", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29535", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29535", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T15:05:37+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1806", }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 7.5, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "Mozilla: Potential Memory Corruption following Garbage Collector compaction", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "zx from qriousec", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29536", cwe: { id: "CWE-617", name: "Reachable Assertion", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186104", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nAn attacker could cause the memory manager to incorrectly free a pointer that addresses attacker-controlled memory, resulting in an assertion, memory corruption, or a potentially exploitable crash.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Invalid free from JavaScript code", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29536", }, { category: "external", summary: "RHBZ#2186104", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186104", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29536", url: "https://www.cve.org/CVERecord?id=CVE-2023-29536", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29536", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29536", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29536", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29536", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T15:05:37+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1806", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 8.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "Mozilla: Invalid free from JavaScript code", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Trung Pham", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29539", cwe: { id: "CWE-159", name: "Improper Handling of Invalid Use of Special Elements", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186105", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nWhen handling the filename directive in the Content-Disposition header, the filename would be truncated if the filename contained a NULL character. This could have led to reflected file download attacks potentially tricking users to install malware.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Content-Disposition filename truncation leads to Reflected File Download", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29539", }, { category: "external", summary: "RHBZ#2186105", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186105", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29539", url: "https://www.cve.org/CVERecord?id=CVE-2023-29539", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29539", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29539", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29539", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29539", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T15:05:37+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1806", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 8.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "Mozilla: Content-Disposition filename truncation leads to Reflected File Download", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Ameen Basha M K", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29541", cwe: { id: "CWE-434", name: "Unrestricted Upload of File with Dangerous Type", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186106", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nFirefox did not properly handle downloads of files ending in `.desktop`, which can be interpreted to run attacker-controlled commands.\r\n\r\n*This bug only affects Firefox for Linux on certain Distributions. Other operating systems are unaffected, and Mozilla is unable to enumerate all affected Linux Distributions.*", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Files with malicious extensions could have been downloaded unsafely on Linux", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29541", }, { category: "external", summary: "RHBZ#2186106", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186106", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29541", url: "https://www.cve.org/CVERecord?id=CVE-2023-29541", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29541", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29541", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29541", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29541", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T15:05:37+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1806", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 8.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "Mozilla: Files with malicious extensions could have been downloaded unsafely on Linux", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "JunYoung Park", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29548", cwe: { id: "CWE-682", name: "Incorrect Calculation", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186110", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nA wrong lowering instruction in the ARM64 Ion compiler resulted in a wrong optimization result.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Incorrect optimization result on ARM64", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29548", }, { category: "external", summary: "RHBZ#2186110", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186110", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29548", url: "https://www.cve.org/CVERecord?id=CVE-2023-29548", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29548", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29548", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29548", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29548", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T15:05:37+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1806", }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "NONE", baseScore: 3.4, baseSeverity: "LOW", confidentialityImpact: "NONE", integrityImpact: "LOW", privilegesRequired: "NONE", scope: "CHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:N", version: "3.1", }, products: [ "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", ], }, ], threats: [ { category: "impact", details: "Low", }, ], title: "Mozilla: Incorrect optimization result on ARM64", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Mozilla developers and community", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29550", cwe: { id: "CWE-120", name: "Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186111", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nMozilla developers Andrew Osmond, Sebastian Hengst, Andrew McCreight, and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 111 and Firefox ESR 102.9. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Memory safety bugs fixed in Firefox 112 and Firefox ESR 102.10", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29550", }, { category: "external", summary: "RHBZ#2186111", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186111", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29550", url: "https://www.cve.org/CVERecord?id=CVE-2023-29550", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29550", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29550", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29550", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29550", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T15:05:37+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1806", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 8.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Client-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Server-optional-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.src", "7Workstation-7.9.Z:thunderbird-0:102.10.0-2.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-debuginfo-0:102.10.0-2.el7_9.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "Mozilla: Memory safety bugs fixed in Firefox 112 and Firefox ESR 102.10", }, ], }
rhsa-2023_1804
Vulnerability from csaf_redhat
Published
2023-04-17 14:04
Modified
2024-12-16 05:26
Summary
Red Hat Security Advisory: thunderbird security update
Notes
Topic
An update for thunderbird is now available for Red Hat Enterprise Linux 8.4 Extended Update Support.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Mozilla Thunderbird is a standalone mail and newsgroup client.
This update upgrades Thunderbird to version 102.10.0.
Security Fix(es):
* Thunderbird: Revocation status of S/Mime recipient certificates was not checked (CVE-2023-0547)
* Mozilla: Matrix SDK bundled with Thunderbird vulnerable to denial-of-service attack (CVE-2023-28427)
* Mozilla: Fullscreen notification obscured (CVE-2023-29533)
* Mozilla: Potential Memory Corruption following Garbage Collector compaction (CVE-2023-29535)
* Mozilla: Invalid free from JavaScript code (CVE-2023-29536)
* Mozilla: Memory safety bugs fixed in Firefox 112 and Firefox ESR 102.10 (CVE-2023-29550)
* Mozilla: Memory Corruption in Safe Browsing Code (CVE-2023-1945)
* Thunderbird: Hang when processing certain OpenPGP messages (CVE-2023-29479)
* Mozilla: Content-Disposition filename truncation leads to Reflected File Download (CVE-2023-29539)
* Mozilla: Files with malicious extensions could have been downloaded unsafely on Linux (CVE-2023-29541)
* Mozilla: Incorrect optimization result on ARM64 (CVE-2023-29548)
* MFSA-TMP-2023-0001 Mozilla: Double-free in libwebp (BZ#2186102)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ document: { aggregate_severity: { namespace: "https://access.redhat.com/security/updates/classification/", text: "Important", }, category: "csaf_security_advisory", csaf_version: "2.0", distribution: { text: "Copyright © Red Hat, Inc. All rights reserved.", tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "en", notes: [ { category: "summary", text: "An update for thunderbird is now available for Red Hat Enterprise Linux 8.4 Extended Update Support.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", title: "Topic", }, { category: "general", text: "Mozilla Thunderbird is a standalone mail and newsgroup client.\n\nThis update upgrades Thunderbird to version 102.10.0.\n\nSecurity Fix(es):\n\n* Thunderbird: Revocation status of S/Mime recipient certificates was not checked (CVE-2023-0547)\n\n* Mozilla: Matrix SDK bundled with Thunderbird vulnerable to denial-of-service attack (CVE-2023-28427)\n\n* Mozilla: Fullscreen notification obscured (CVE-2023-29533)\n\n* Mozilla: Potential Memory Corruption following Garbage Collector compaction (CVE-2023-29535)\n\n* Mozilla: Invalid free from JavaScript code (CVE-2023-29536)\n\n* Mozilla: Memory safety bugs fixed in Firefox 112 and Firefox ESR 102.10 (CVE-2023-29550)\n\n* Mozilla: Memory Corruption in Safe Browsing Code (CVE-2023-1945)\n\n* Thunderbird: Hang when processing certain OpenPGP messages (CVE-2023-29479)\n\n* Mozilla: Content-Disposition filename truncation leads to Reflected File Download (CVE-2023-29539)\n\n* Mozilla: Files with malicious extensions could have been downloaded unsafely on Linux (CVE-2023-29541)\n\n* Mozilla: Incorrect optimization result on ARM64 (CVE-2023-29548)\n\n* MFSA-TMP-2023-0001 Mozilla: Double-free in libwebp (BZ#2186102)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", title: "Details", }, { category: "legal_disclaimer", text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", title: "Terms of Use", }, ], publisher: { category: "vendor", contact_details: "https://access.redhat.com/security/team/contact/", issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", name: "Red Hat Product Security", namespace: "https://www.redhat.com", }, references: [ { category: "self", summary: "https://access.redhat.com/errata/RHSA-2023:1804", url: "https://access.redhat.com/errata/RHSA-2023:1804", }, { category: "external", summary: "https://access.redhat.com/security/updates/classification/#important", url: "https://access.redhat.com/security/updates/classification/#important", }, { category: "external", summary: "2183278", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2183278", }, { category: "external", summary: "2186101", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186101", }, { category: "external", summary: "2186102", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186102", }, { category: "external", summary: "2186103", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186103", }, { category: "external", summary: "2186104", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186104", }, { category: "external", summary: "2186105", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186105", }, { category: "external", summary: "2186106", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186106", }, { category: "external", summary: "2186109", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186109", }, { category: "external", summary: "2186110", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186110", }, { category: "external", summary: "2186111", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186111", }, { category: "external", summary: "2186734", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186734", }, { category: "external", summary: "2186735", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186735", }, { category: "self", summary: "Canonical URL", url: "https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_1804.json", }, ], title: "Red Hat Security Advisory: thunderbird security update", tracking: { current_release_date: "2024-12-16T05:26:46+00:00", generator: { date: "2024-12-16T05:26:46+00:00", engine: { name: "Red Hat SDEngine", version: "4.2.3", }, }, id: "RHSA-2023:1804", initial_release_date: "2023-04-17T14:04:25+00:00", revision_history: [ { date: "2023-04-17T14:04:25+00:00", number: "1", summary: "Initial version", }, { date: "2023-04-17T14:04:25+00:00", number: "2", summary: "Last updated version", }, { date: "2024-12-16T05:26:46+00:00", number: "3", summary: "Last generated version", }, ], status: "final", version: "3", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_name", name: "Red Hat Enterprise Linux AppStream EUS (v.8.4)", product: { name: "Red Hat Enterprise Linux AppStream EUS (v.8.4)", product_id: "AppStream-8.4.0.Z.EUS", product_identification_helper: { cpe: "cpe:/a:redhat:rhel_eus:8.4::appstream", }, }, }, ], category: "product_family", name: "Red Hat Enterprise Linux", }, { branches: [ { category: "product_version", name: "thunderbird-0:102.10.0-2.el8_4.src", product: { name: "thunderbird-0:102.10.0-2.el8_4.src", product_id: "thunderbird-0:102.10.0-2.el8_4.src", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird@102.10.0-2.el8_4?arch=src", }, }, }, ], category: "architecture", name: "src", }, { branches: [ { category: "product_version", name: "thunderbird-0:102.10.0-2.el8_4.aarch64", product: { name: "thunderbird-0:102.10.0-2.el8_4.aarch64", product_id: "thunderbird-0:102.10.0-2.el8_4.aarch64", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird@102.10.0-2.el8_4?arch=aarch64", }, }, }, { category: "product_version", name: "thunderbird-debugsource-0:102.10.0-2.el8_4.aarch64", product: { name: "thunderbird-debugsource-0:102.10.0-2.el8_4.aarch64", product_id: "thunderbird-debugsource-0:102.10.0-2.el8_4.aarch64", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird-debugsource@102.10.0-2.el8_4?arch=aarch64", }, }, }, { category: "product_version", name: "thunderbird-debuginfo-0:102.10.0-2.el8_4.aarch64", product: { name: "thunderbird-debuginfo-0:102.10.0-2.el8_4.aarch64", product_id: "thunderbird-debuginfo-0:102.10.0-2.el8_4.aarch64", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird-debuginfo@102.10.0-2.el8_4?arch=aarch64", }, }, }, ], category: "architecture", name: "aarch64", }, { branches: [ { category: "product_version", name: "thunderbird-0:102.10.0-2.el8_4.ppc64le", product: { name: "thunderbird-0:102.10.0-2.el8_4.ppc64le", product_id: "thunderbird-0:102.10.0-2.el8_4.ppc64le", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird@102.10.0-2.el8_4?arch=ppc64le", }, }, }, { category: "product_version", name: "thunderbird-debugsource-0:102.10.0-2.el8_4.ppc64le", product: { name: "thunderbird-debugsource-0:102.10.0-2.el8_4.ppc64le", product_id: "thunderbird-debugsource-0:102.10.0-2.el8_4.ppc64le", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird-debugsource@102.10.0-2.el8_4?arch=ppc64le", }, }, }, { category: "product_version", name: "thunderbird-debuginfo-0:102.10.0-2.el8_4.ppc64le", product: { name: "thunderbird-debuginfo-0:102.10.0-2.el8_4.ppc64le", product_id: "thunderbird-debuginfo-0:102.10.0-2.el8_4.ppc64le", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird-debuginfo@102.10.0-2.el8_4?arch=ppc64le", }, }, }, ], category: "architecture", name: "ppc64le", }, { branches: [ { category: "product_version", name: "thunderbird-0:102.10.0-2.el8_4.x86_64", product: { name: "thunderbird-0:102.10.0-2.el8_4.x86_64", product_id: "thunderbird-0:102.10.0-2.el8_4.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird@102.10.0-2.el8_4?arch=x86_64", }, }, }, { category: "product_version", name: "thunderbird-debugsource-0:102.10.0-2.el8_4.x86_64", product: { name: "thunderbird-debugsource-0:102.10.0-2.el8_4.x86_64", product_id: "thunderbird-debugsource-0:102.10.0-2.el8_4.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird-debugsource@102.10.0-2.el8_4?arch=x86_64", }, }, }, { category: "product_version", name: "thunderbird-debuginfo-0:102.10.0-2.el8_4.x86_64", product: { name: "thunderbird-debuginfo-0:102.10.0-2.el8_4.x86_64", product_id: "thunderbird-debuginfo-0:102.10.0-2.el8_4.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird-debuginfo@102.10.0-2.el8_4?arch=x86_64", }, }, }, ], category: "architecture", name: "x86_64", }, { branches: [ { category: "product_version", name: "thunderbird-0:102.10.0-2.el8_4.s390x", product: { name: "thunderbird-0:102.10.0-2.el8_4.s390x", product_id: "thunderbird-0:102.10.0-2.el8_4.s390x", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird@102.10.0-2.el8_4?arch=s390x", }, }, }, { category: "product_version", name: "thunderbird-debugsource-0:102.10.0-2.el8_4.s390x", product: { name: "thunderbird-debugsource-0:102.10.0-2.el8_4.s390x", product_id: "thunderbird-debugsource-0:102.10.0-2.el8_4.s390x", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird-debugsource@102.10.0-2.el8_4?arch=s390x", }, }, }, { category: "product_version", name: "thunderbird-debuginfo-0:102.10.0-2.el8_4.s390x", product: { name: "thunderbird-debuginfo-0:102.10.0-2.el8_4.s390x", product_id: "thunderbird-debuginfo-0:102.10.0-2.el8_4.s390x", product_identification_helper: { purl: "pkg:rpm/redhat/thunderbird-debuginfo@102.10.0-2.el8_4?arch=s390x", }, }, }, ], category: "architecture", name: "s390x", }, ], category: "vendor", name: "Red Hat", }, ], relationships: [ { category: "default_component_of", full_product_name: { name: "thunderbird-0:102.10.0-2.el8_4.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", product_id: "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.aarch64", }, product_reference: "thunderbird-0:102.10.0-2.el8_4.aarch64", relates_to_product_reference: "AppStream-8.4.0.Z.EUS", }, { category: "default_component_of", full_product_name: { name: "thunderbird-0:102.10.0-2.el8_4.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", product_id: "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.ppc64le", }, product_reference: "thunderbird-0:102.10.0-2.el8_4.ppc64le", relates_to_product_reference: "AppStream-8.4.0.Z.EUS", }, { category: "default_component_of", full_product_name: { name: "thunderbird-0:102.10.0-2.el8_4.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", product_id: "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.s390x", }, product_reference: "thunderbird-0:102.10.0-2.el8_4.s390x", relates_to_product_reference: "AppStream-8.4.0.Z.EUS", }, { category: "default_component_of", full_product_name: { name: "thunderbird-0:102.10.0-2.el8_4.src as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", product_id: "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.src", }, product_reference: "thunderbird-0:102.10.0-2.el8_4.src", relates_to_product_reference: "AppStream-8.4.0.Z.EUS", }, { category: "default_component_of", full_product_name: { name: "thunderbird-0:102.10.0-2.el8_4.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", product_id: "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.x86_64", }, product_reference: "thunderbird-0:102.10.0-2.el8_4.x86_64", relates_to_product_reference: "AppStream-8.4.0.Z.EUS", }, { category: "default_component_of", full_product_name: { name: "thunderbird-debuginfo-0:102.10.0-2.el8_4.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", product_id: "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.aarch64", }, product_reference: "thunderbird-debuginfo-0:102.10.0-2.el8_4.aarch64", relates_to_product_reference: "AppStream-8.4.0.Z.EUS", }, { category: "default_component_of", full_product_name: { name: "thunderbird-debuginfo-0:102.10.0-2.el8_4.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", product_id: "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.ppc64le", }, product_reference: "thunderbird-debuginfo-0:102.10.0-2.el8_4.ppc64le", relates_to_product_reference: "AppStream-8.4.0.Z.EUS", }, { category: "default_component_of", full_product_name: { name: "thunderbird-debuginfo-0:102.10.0-2.el8_4.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", product_id: "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.s390x", }, product_reference: "thunderbird-debuginfo-0:102.10.0-2.el8_4.s390x", relates_to_product_reference: "AppStream-8.4.0.Z.EUS", }, { category: "default_component_of", full_product_name: { name: "thunderbird-debuginfo-0:102.10.0-2.el8_4.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", product_id: "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.x86_64", }, product_reference: "thunderbird-debuginfo-0:102.10.0-2.el8_4.x86_64", relates_to_product_reference: "AppStream-8.4.0.Z.EUS", }, { category: "default_component_of", full_product_name: { name: "thunderbird-debugsource-0:102.10.0-2.el8_4.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", product_id: "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.aarch64", }, product_reference: "thunderbird-debugsource-0:102.10.0-2.el8_4.aarch64", relates_to_product_reference: "AppStream-8.4.0.Z.EUS", }, { category: "default_component_of", full_product_name: { name: "thunderbird-debugsource-0:102.10.0-2.el8_4.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", product_id: "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.ppc64le", }, product_reference: "thunderbird-debugsource-0:102.10.0-2.el8_4.ppc64le", relates_to_product_reference: "AppStream-8.4.0.Z.EUS", }, { category: "default_component_of", full_product_name: { name: "thunderbird-debugsource-0:102.10.0-2.el8_4.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", product_id: "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.s390x", }, product_reference: "thunderbird-debugsource-0:102.10.0-2.el8_4.s390x", relates_to_product_reference: "AppStream-8.4.0.Z.EUS", }, { category: "default_component_of", full_product_name: { name: "thunderbird-debugsource-0:102.10.0-2.el8_4.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", product_id: "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.x86_64", }, product_reference: "thunderbird-debugsource-0:102.10.0-2.el8_4.x86_64", relates_to_product_reference: "AppStream-8.4.0.Z.EUS", }, ], }, vulnerabilities: [ { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Paul Menzel", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-0547", cwe: { id: "CWE-356", name: "Product UI does not Warn User of Unsafe Actions", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186734", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nOCSP revocation status of recipient certificates was not checked when sending S/Mime encrypted email, and revoked certificates would be accepted. Thunderbird versions from 68 to 102.9.1 were affected by this bug.", title: "Vulnerability description", }, { category: "summary", text: "Thunderbird: Revocation status of S/Mime recipient certificates was not checked", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.src", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-0547", }, { category: "external", summary: "RHBZ#2186734", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186734", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-0547", url: "https://www.cve.org/CVERecord?id=CVE-2023-0547", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-0547", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-0547", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-15/#CVE-2023-0547", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-15/#CVE-2023-0547", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T14:04:25+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.src", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1804", }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 7.5, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.src", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "Thunderbird: Revocation status of S/Mime recipient certificates was not checked", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Gabriele Svelto", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-1945", cwe: { id: "CWE-119", name: "Improper Restriction of Operations within the Bounds of a Memory Buffer", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186109", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nUnexpected data returned from the Safe Browsing API could have led to memory corruption and a potentially exploitable crash.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Memory Corruption in Safe Browsing Code", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.src", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-1945", }, { category: "external", summary: "RHBZ#2186109", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186109", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-1945", url: "https://www.cve.org/CVERecord?id=CVE-2023-1945", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-1945", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-1945", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-1945", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-1945", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T14:04:25+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.src", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1804", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "NONE", baseScore: 6.1, baseSeverity: "MEDIUM", confidentialityImpact: "LOW", integrityImpact: "LOW", privilegesRequired: "NONE", scope: "CHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", version: "3.1", }, products: [ "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.src", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "Mozilla: Memory Corruption in Safe Browsing Code", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Irvan Kurniawan", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-1999", cwe: { id: "CWE-415", name: "Double Free", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186102", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nA double-free in libwebp could have led to memory corruption and a potentially exploitable crash.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: libwebp: Double-free in libwebp", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.src", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-1999", }, { category: "external", summary: "RHBZ#2186102", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186102", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-1999", url: "https://www.cve.org/CVERecord?id=CVE-2023-1999", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-1999", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-1999", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-1999", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-1999", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-15/#CVE-2023-1999", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-15/#CVE-2023-1999", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T14:04:25+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.src", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1804", }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 7.5, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.src", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "Mozilla: libwebp: Double-free in libwebp", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Matrix Security Team", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-28427", cwe: { id: "CWE-1321", name: "Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')", }, discovery_date: "2023-03-28T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2183278", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nThunderbird users who use the Matrix chat protocol were vulnerable to a denial-of-service attack.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Matrix SDK bundled with Thunderbird vulnerable to denial-of-service attack", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.src", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-28427", }, { category: "external", summary: "RHBZ#2183278", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2183278", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-28427", url: "https://www.cve.org/CVERecord?id=CVE-2023-28427", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-28427", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-28427", }, { category: "external", summary: "https://github.com/matrix-org/matrix-js-sdk/security/advisories/GHSA-mwq8-fjpf-c2gr", url: "https://github.com/matrix-org/matrix-js-sdk/security/advisories/GHSA-mwq8-fjpf-c2gr", }, { category: "external", summary: "https://matrix.org/blog/2023/03/28/security-releases-matrix-js-sdk-24-0-0-and-matrix-react-sdk-3-69-0", url: "https://matrix.org/blog/2023/03/28/security-releases-matrix-js-sdk-24-0-0-and-matrix-react-sdk-3-69-0", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-12/#CVE-2023-28427", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-12/#CVE-2023-28427", }, ], release_date: "2023-03-28T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T14:04:25+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.src", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1804", }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 7.5, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.src", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "Mozilla: Matrix SDK bundled with Thunderbird vulnerable to denial-of-service attack", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Ribose RNP Team", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29479", cwe: { id: "CWE-400", name: "Uncontrolled Resource Consumption", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186735", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nCertain malformed OpenPGP messages could trigger incorrect parsing of PKESK/SKESK packets due to a bug in the Ribose RNP library used by Thunderbird up to version 102.9.1, which would cause the Thunderbird user interface to hang. The issue was discovered using Google's oss-fuzz.", title: "Vulnerability description", }, { category: "summary", text: "Thunderbird: Hang when processing certain OpenPGP messages", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.src", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29479", }, { category: "external", summary: "RHBZ#2186735", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186735", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29479", url: "https://www.cve.org/CVERecord?id=CVE-2023-29479", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29479", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29479", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-15/#CVE-2023-29479", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-15/#CVE-2023-29479", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T14:04:25+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.src", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1804", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 6.5, baseSeverity: "MEDIUM", confidentialityImpact: "NONE", integrityImpact: "NONE", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", version: "3.1", }, products: [ "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.src", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "Thunderbird: Hang when processing certain OpenPGP messages", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Irvan Kurniawan", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29533", cwe: { id: "CWE-425", name: "Direct Request ('Forced Browsing')", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186101", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nA website could have obscured the fullscreen notification by using a combination of `window.open`, fullscreen requests, `window.name` assignments, and `setInterval` calls. This could have led to user confusion and possible spoofing attacks.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Fullscreen notification obscured", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.src", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29533", }, { category: "external", summary: "RHBZ#2186101", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186101", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29533", url: "https://www.cve.org/CVERecord?id=CVE-2023-29533", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29533", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29533", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29533", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29533", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T14:04:25+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.src", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1804", }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 7.5, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.src", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "Mozilla: Fullscreen notification obscured", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Lukas Bernhard", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29535", cwe: { id: "CWE-119", name: "Improper Restriction of Operations within the Bounds of a Memory Buffer", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186103", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nFollowing a Garbage Collector compaction, weak maps may have been accessed before they were correctly traced. This resulted in memory corruption and a potentially exploitable crash.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Potential Memory Corruption following Garbage Collector compaction", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.src", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29535", }, { category: "external", summary: "RHBZ#2186103", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186103", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29535", url: "https://www.cve.org/CVERecord?id=CVE-2023-29535", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29535", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29535", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29535", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29535", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T14:04:25+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.src", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1804", }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 7.5, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.src", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "Mozilla: Potential Memory Corruption following Garbage Collector compaction", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "zx from qriousec", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29536", cwe: { id: "CWE-617", name: "Reachable Assertion", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186104", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nAn attacker could cause the memory manager to incorrectly free a pointer that addresses attacker-controlled memory, resulting in an assertion, memory corruption, or a potentially exploitable crash.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Invalid free from JavaScript code", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.src", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29536", }, { category: "external", summary: "RHBZ#2186104", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186104", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29536", url: "https://www.cve.org/CVERecord?id=CVE-2023-29536", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29536", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29536", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29536", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29536", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T14:04:25+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.src", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1804", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 8.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.src", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "Mozilla: Invalid free from JavaScript code", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Trung Pham", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29539", cwe: { id: "CWE-159", name: "Improper Handling of Invalid Use of Special Elements", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186105", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nWhen handling the filename directive in the Content-Disposition header, the filename would be truncated if the filename contained a NULL character. This could have led to reflected file download attacks potentially tricking users to install malware.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Content-Disposition filename truncation leads to Reflected File Download", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.src", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29539", }, { category: "external", summary: "RHBZ#2186105", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186105", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29539", url: "https://www.cve.org/CVERecord?id=CVE-2023-29539", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29539", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29539", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29539", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29539", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T14:04:25+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.src", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1804", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 8.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.src", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "Mozilla: Content-Disposition filename truncation leads to Reflected File Download", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Ameen Basha M K", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29541", cwe: { id: "CWE-434", name: "Unrestricted Upload of File with Dangerous Type", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186106", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nFirefox did not properly handle downloads of files ending in `.desktop`, which can be interpreted to run attacker-controlled commands.\r\n\r\n*This bug only affects Firefox for Linux on certain Distributions. Other operating systems are unaffected, and Mozilla is unable to enumerate all affected Linux Distributions.*", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Files with malicious extensions could have been downloaded unsafely on Linux", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.src", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29541", }, { category: "external", summary: "RHBZ#2186106", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186106", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29541", url: "https://www.cve.org/CVERecord?id=CVE-2023-29541", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29541", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29541", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29541", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29541", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T14:04:25+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.src", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1804", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 8.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.src", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "Mozilla: Files with malicious extensions could have been downloaded unsafely on Linux", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "JunYoung Park", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29548", cwe: { id: "CWE-682", name: "Incorrect Calculation", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186110", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nA wrong lowering instruction in the ARM64 Ion compiler resulted in a wrong optimization result.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Incorrect optimization result on ARM64", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.src", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29548", }, { category: "external", summary: "RHBZ#2186110", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186110", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29548", url: "https://www.cve.org/CVERecord?id=CVE-2023-29548", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29548", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29548", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29548", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29548", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T14:04:25+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.src", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1804", }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "NONE", baseScore: 3.4, baseSeverity: "LOW", confidentialityImpact: "NONE", integrityImpact: "LOW", privilegesRequired: "NONE", scope: "CHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:N", version: "3.1", }, products: [ "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.src", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.x86_64", ], }, ], threats: [ { category: "impact", details: "Low", }, ], title: "Mozilla: Incorrect optimization result on ARM64", }, { acknowledgments: [ { names: [ "the Mozilla project", ], }, { names: [ "Mozilla developers and community", ], summary: "Acknowledged by upstream.", }, ], cve: "CVE-2023-29550", cwe: { id: "CWE-120", name: "Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')", }, discovery_date: "2023-04-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2186111", }, ], notes: [ { category: "description", text: "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nMozilla developers Andrew Osmond, Sebastian Hengst, Andrew McCreight, and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 111 and Firefox ESR 102.9. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.", title: "Vulnerability description", }, { category: "summary", text: "Mozilla: Memory safety bugs fixed in Firefox 112 and Firefox ESR 102.10", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.src", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-29550", }, { category: "external", summary: "RHBZ#2186111", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2186111", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-29550", url: "https://www.cve.org/CVERecord?id=CVE-2023-29550", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-29550", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-29550", }, { category: "external", summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29550", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29550", }, ], release_date: "2023-04-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-04-17T14:04:25+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", product_ids: [ "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.src", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:1804", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 8.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.src", "AppStream-8.4.0.Z.EUS:thunderbird-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.10.0-2.el8_4.x86_64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.aarch64", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.ppc64le", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.s390x", "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.10.0-2.el8_4.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "Mozilla: Memory safety bugs fixed in Firefox 112 and Firefox ESR 102.10", }, ], }
WID-SEC-W-2023-0789
Vulnerability from csaf_certbund
Published
2023-03-28 22:00
Modified
2023-05-29 22:00
Summary
Mozilla Thunderbird: Schwachstelle ermöglicht Denial of Service
Notes
Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.
Produktbeschreibung
Thunderbird ist ein Open Source E-Mail Client.
Angriff
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Mozilla Thunderbird ausnutzen, um einen Denial of Service Angriff durchzuführen.
Betroffene Betriebssysteme
- UNIX
- Linux
- MacOS X
- Windows
{ document: { aggregate_severity: { text: "mittel", }, category: "csaf_base", csaf_version: "2.0", distribution: { tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "de-DE", notes: [ { category: "legal_disclaimer", text: "Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.", }, { category: "description", text: "Thunderbird ist ein Open Source E-Mail Client.", title: "Produktbeschreibung", }, { category: "summary", text: "Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Mozilla Thunderbird ausnutzen, um einen Denial of Service Angriff durchzuführen.", title: "Angriff", }, { category: "general", text: "- UNIX\n- Linux\n- MacOS X\n- Windows", title: "Betroffene Betriebssysteme", }, ], publisher: { category: "other", contact_details: "csaf-provider@cert-bund.de", name: "Bundesamt für Sicherheit in der Informationstechnik", namespace: "https://www.bsi.bund.de", }, references: [ { category: "self", summary: "WID-SEC-W-2023-0789 - CSAF Version", url: "https://wid.cert-bund.de/.well-known/csaf/white/2023/wid-sec-w-2023-0789.json", }, { category: "self", summary: "WID-SEC-2023-0789 - Portal Version", url: "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2023-0789", }, { category: "external", summary: "Gentoo Linux Security Advisory GLSA-202305-36 vom 2023-05-30", url: "https://security.gentoo.org/glsa/202305-36", }, { category: "external", summary: "CentOS Security Advisory CESA-2023:1806 vom 2023-04-24", url: "https://lists.centos.org/pipermail/centos-announce/2023-April/086395.html", }, { category: "external", summary: "Debian Security Advisory DSA-5392 vom 2023-04-23", url: "https://www.debian.org/security/2023/dsa-5392", }, { category: "external", summary: "Red Hat Security Advisory RHSA-2023:1811 vom 2023-04-17", url: "https://access.redhat.com/errata/RHSA-2023:1811", }, { category: "external", summary: "Red Hat Security Advisory RHSA-2023:1809 vom 2023-04-17", url: "https://access.redhat.com/errata/RHSA-2023:1809", }, { category: "external", summary: "Red Hat Security Advisory RHSA-2023:1804 vom 2023-04-17", url: "https://access.redhat.com/errata/RHSA-2023:1804", }, { category: "external", summary: "Red Hat Security Advisory RHSA-2023:1803 vom 2023-04-17", url: "https://access.redhat.com/errata/RHSA-2023:1803", }, { category: "external", summary: "Red Hat Security Advisory RHSA-2023:1806 vom 2023-04-17", url: "https://access.redhat.com/errata/RHSA-2023:1806", }, { category: "external", summary: "Red Hat Security Advisory RHSA-2023:1805 vom 2023-04-17", url: "https://access.redhat.com/errata/RHSA-2023:1805", }, { category: "external", summary: "Red Hat Security Advisory RHSA-2023:1802 vom 2023-04-17", url: "https://access.redhat.com/errata/RHSA-2023:1802", }, { category: "external", summary: "Red Hat Security Advisory RHSA-2023:1810 vom 2023-04-17", url: "https://access.redhat.com/errata/RHSA-2023:1810", }, { category: "external", summary: "SUSE Security Update SUSE-SU-2023:1736-1 vom 2023-04-03", url: "https://lists.suse.com/pipermail/sle-security-updates/2023-April/014339.html", }, { category: "external", summary: "Fedora Security Advisory FEDORA-2023-0E1AE0D5F6 vom 2023-03-30", url: "https://bodhi.fedoraproject.org/updates/FEDORA-2023-0e1ae0d5f6", }, { category: "external", summary: "Fedora Security Advisory FEDORA-2023-A9C17DFF60 vom 2023-03-30", url: "https://bodhi.fedoraproject.org/updates/FEDORA-2023-a9c17dff60", }, { category: "external", summary: "Fedora Security Advisory FEDORA-2023-D093C0CD27 vom 2023-03-30", url: "https://bodhi.fedoraproject.org/updates/FEDORA-2023-d093c0cd27", }, { category: "external", summary: "Mozilla Firefox Security Advisory MFSA2023-12 vom 2023-03-28", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-12/", }, ], source_lang: "en-US", title: "Mozilla Thunderbird: Schwachstelle ermöglicht Denial of Service", tracking: { current_release_date: "2023-05-29T22:00:00.000+00:00", generator: { date: "2024-08-15T17:47:31.482+00:00", engine: { name: "BSI-WID", version: "1.3.5", }, }, id: "WID-SEC-W-2023-0789", initial_release_date: "2023-03-28T22:00:00.000+00:00", revision_history: [ { date: "2023-03-28T22:00:00.000+00:00", number: "1", summary: "Initiale Fassung", }, { date: "2023-03-29T22:00:00.000+00:00", number: "2", summary: "Neue Updates von Fedora aufgenommen", }, { date: "2023-04-03T22:00:00.000+00:00", number: "3", summary: "Neue Updates von SUSE aufgenommen", }, { date: "2023-04-17T22:00:00.000+00:00", number: "4", summary: "Neue Updates von Red Hat aufgenommen", }, { date: "2023-04-23T22:00:00.000+00:00", number: "5", summary: "Neue Updates von Debian aufgenommen", }, { date: "2023-04-24T22:00:00.000+00:00", number: "6", summary: "Neue Updates von CentOS aufgenommen", }, { date: "2023-05-29T22:00:00.000+00:00", number: "7", summary: "Neue Updates von Gentoo aufgenommen", }, ], status: "final", version: "7", }, }, product_tree: { branches: [ { branches: [ { category: "product_name", name: "Debian Linux", product: { name: "Debian Linux", product_id: "2951", product_identification_helper: { cpe: "cpe:/o:debian:debian_linux:-", }, }, }, ], category: "vendor", name: "Debian", }, { branches: [ { category: "product_name", name: "Fedora Linux", product: { name: "Fedora Linux", product_id: "74185", product_identification_helper: { cpe: "cpe:/o:fedoraproject:fedora:-", }, }, }, ], category: "vendor", name: "Fedora", }, { branches: [ { category: "product_name", name: "Gentoo Linux", product: { name: "Gentoo Linux", product_id: "T012167", product_identification_helper: { cpe: "cpe:/o:gentoo:linux:-", }, }, }, ], category: "vendor", name: "Gentoo", }, { branches: [ { category: "product_name", name: "Mozilla Thunderbird < 102.9.1", product: { name: "Mozilla Thunderbird < 102.9.1", product_id: "T026963", product_identification_helper: { cpe: "cpe:/a:mozilla:thunderbird:102.9.1", }, }, }, ], category: "vendor", name: "Mozilla", }, { branches: [ { category: "product_name", name: "Open Source CentOS", product: { name: "Open Source CentOS", product_id: "1727", product_identification_helper: { cpe: "cpe:/o:centos:centos:-", }, }, }, ], category: "vendor", name: "Open Source", }, { branches: [ { category: "product_name", name: "Red Hat Enterprise Linux", product: { name: "Red Hat Enterprise Linux", product_id: "67646", product_identification_helper: { cpe: "cpe:/o:redhat:enterprise_linux:-", }, }, }, ], category: "vendor", name: "Red Hat", }, { branches: [ { category: "product_name", name: "SUSE Linux", product: { name: "SUSE Linux", product_id: "T002207", product_identification_helper: { cpe: "cpe:/o:suse:suse_linux:-", }, }, }, ], category: "vendor", name: "SUSE", }, ], }, vulnerabilities: [ { cve: "CVE-2023-28427", notes: [ { category: "description", text: "Es existiert eine Schwachstelle in Mozilla Thunderbird in Verbindung mit dem Matrix Chat Protokoll. Ein entfernter, anonymer Angreifer kann diese Schwachstelle ausnutzen, um einen Denial of Service Zustand herbeizuführen. Zur erfolgreichen Ausnutzung ist eine Benutzeraktion erforderlich.", }, ], product_status: { known_affected: [ "2951", "T002207", "67646", "T012167", "1727", "74185", ], }, release_date: "2023-03-28T22:00:00.000+00:00", title: "CVE-2023-28427", }, ], }
wid-sec-w-2023-0789
Vulnerability from csaf_certbund
Published
2023-03-28 22:00
Modified
2023-05-29 22:00
Summary
Mozilla Thunderbird: Schwachstelle ermöglicht Denial of Service
Notes
Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.
Produktbeschreibung
Thunderbird ist ein Open Source E-Mail Client.
Angriff
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Mozilla Thunderbird ausnutzen, um einen Denial of Service Angriff durchzuführen.
Betroffene Betriebssysteme
- UNIX
- Linux
- MacOS X
- Windows
{ document: { aggregate_severity: { text: "mittel", }, category: "csaf_base", csaf_version: "2.0", distribution: { tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "de-DE", notes: [ { category: "legal_disclaimer", text: "Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.", }, { category: "description", text: "Thunderbird ist ein Open Source E-Mail Client.", title: "Produktbeschreibung", }, { category: "summary", text: "Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Mozilla Thunderbird ausnutzen, um einen Denial of Service Angriff durchzuführen.", title: "Angriff", }, { category: "general", text: "- UNIX\n- Linux\n- MacOS X\n- Windows", title: "Betroffene Betriebssysteme", }, ], publisher: { category: "other", contact_details: "csaf-provider@cert-bund.de", name: "Bundesamt für Sicherheit in der Informationstechnik", namespace: "https://www.bsi.bund.de", }, references: [ { category: "self", summary: "WID-SEC-W-2023-0789 - CSAF Version", url: "https://wid.cert-bund.de/.well-known/csaf/white/2023/wid-sec-w-2023-0789.json", }, { category: "self", summary: "WID-SEC-2023-0789 - Portal Version", url: "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2023-0789", }, { category: "external", summary: "Gentoo Linux Security Advisory GLSA-202305-36 vom 2023-05-30", url: "https://security.gentoo.org/glsa/202305-36", }, { category: "external", summary: "CentOS Security Advisory CESA-2023:1806 vom 2023-04-24", url: "https://lists.centos.org/pipermail/centos-announce/2023-April/086395.html", }, { category: "external", summary: "Debian Security Advisory DSA-5392 vom 2023-04-23", url: "https://www.debian.org/security/2023/dsa-5392", }, { category: "external", summary: "Red Hat Security Advisory RHSA-2023:1811 vom 2023-04-17", url: "https://access.redhat.com/errata/RHSA-2023:1811", }, { category: "external", summary: "Red Hat Security Advisory RHSA-2023:1809 vom 2023-04-17", url: "https://access.redhat.com/errata/RHSA-2023:1809", }, { category: "external", summary: "Red Hat Security Advisory RHSA-2023:1804 vom 2023-04-17", url: "https://access.redhat.com/errata/RHSA-2023:1804", }, { category: "external", summary: "Red Hat Security Advisory RHSA-2023:1803 vom 2023-04-17", url: "https://access.redhat.com/errata/RHSA-2023:1803", }, { category: "external", summary: "Red Hat Security Advisory RHSA-2023:1806 vom 2023-04-17", url: "https://access.redhat.com/errata/RHSA-2023:1806", }, { category: "external", summary: "Red Hat Security Advisory RHSA-2023:1805 vom 2023-04-17", url: "https://access.redhat.com/errata/RHSA-2023:1805", }, { category: "external", summary: "Red Hat Security Advisory RHSA-2023:1802 vom 2023-04-17", url: "https://access.redhat.com/errata/RHSA-2023:1802", }, { category: "external", summary: "Red Hat Security Advisory RHSA-2023:1810 vom 2023-04-17", url: "https://access.redhat.com/errata/RHSA-2023:1810", }, { category: "external", summary: "SUSE Security Update SUSE-SU-2023:1736-1 vom 2023-04-03", url: "https://lists.suse.com/pipermail/sle-security-updates/2023-April/014339.html", }, { category: "external", summary: "Fedora Security Advisory FEDORA-2023-0E1AE0D5F6 vom 2023-03-30", url: "https://bodhi.fedoraproject.org/updates/FEDORA-2023-0e1ae0d5f6", }, { category: "external", summary: "Fedora Security Advisory FEDORA-2023-A9C17DFF60 vom 2023-03-30", url: "https://bodhi.fedoraproject.org/updates/FEDORA-2023-a9c17dff60", }, { category: "external", summary: "Fedora Security Advisory FEDORA-2023-D093C0CD27 vom 2023-03-30", url: "https://bodhi.fedoraproject.org/updates/FEDORA-2023-d093c0cd27", }, { category: "external", summary: "Mozilla Firefox Security Advisory MFSA2023-12 vom 2023-03-28", url: "https://www.mozilla.org/en-US/security/advisories/mfsa2023-12/", }, ], source_lang: "en-US", title: "Mozilla Thunderbird: Schwachstelle ermöglicht Denial of Service", tracking: { current_release_date: "2023-05-29T22:00:00.000+00:00", generator: { date: "2024-08-15T17:47:31.482+00:00", engine: { name: "BSI-WID", version: "1.3.5", }, }, id: "WID-SEC-W-2023-0789", initial_release_date: "2023-03-28T22:00:00.000+00:00", revision_history: [ { date: "2023-03-28T22:00:00.000+00:00", number: "1", summary: "Initiale Fassung", }, { date: "2023-03-29T22:00:00.000+00:00", number: "2", summary: "Neue Updates von Fedora aufgenommen", }, { date: "2023-04-03T22:00:00.000+00:00", number: "3", summary: "Neue Updates von SUSE aufgenommen", }, { date: "2023-04-17T22:00:00.000+00:00", number: "4", summary: "Neue Updates von Red Hat aufgenommen", }, { date: "2023-04-23T22:00:00.000+00:00", number: "5", summary: "Neue Updates von Debian aufgenommen", }, { date: "2023-04-24T22:00:00.000+00:00", number: "6", summary: "Neue Updates von CentOS aufgenommen", }, { date: "2023-05-29T22:00:00.000+00:00", number: "7", summary: "Neue Updates von Gentoo aufgenommen", }, ], status: "final", version: "7", }, }, product_tree: { branches: [ { branches: [ { category: "product_name", name: "Debian Linux", product: { name: "Debian Linux", product_id: "2951", product_identification_helper: { cpe: "cpe:/o:debian:debian_linux:-", }, }, }, ], category: "vendor", name: "Debian", }, { branches: [ { category: "product_name", name: "Fedora Linux", product: { name: "Fedora Linux", product_id: "74185", product_identification_helper: { cpe: "cpe:/o:fedoraproject:fedora:-", }, }, }, ], category: "vendor", name: "Fedora", }, { branches: [ { category: "product_name", name: "Gentoo Linux", product: { name: "Gentoo Linux", product_id: "T012167", product_identification_helper: { cpe: "cpe:/o:gentoo:linux:-", }, }, }, ], category: "vendor", name: "Gentoo", }, { branches: [ { category: "product_name", name: "Mozilla Thunderbird < 102.9.1", product: { name: "Mozilla Thunderbird < 102.9.1", product_id: "T026963", product_identification_helper: { cpe: "cpe:/a:mozilla:thunderbird:102.9.1", }, }, }, ], category: "vendor", name: "Mozilla", }, { branches: [ { category: "product_name", name: "Open Source CentOS", product: { name: "Open Source CentOS", product_id: "1727", product_identification_helper: { cpe: "cpe:/o:centos:centos:-", }, }, }, ], category: "vendor", name: "Open Source", }, { branches: [ { category: "product_name", name: "Red Hat Enterprise Linux", product: { name: "Red Hat Enterprise Linux", product_id: "67646", product_identification_helper: { cpe: "cpe:/o:redhat:enterprise_linux:-", }, }, }, ], category: "vendor", name: "Red Hat", }, { branches: [ { category: "product_name", name: "SUSE Linux", product: { name: "SUSE Linux", product_id: "T002207", product_identification_helper: { cpe: "cpe:/o:suse:suse_linux:-", }, }, }, ], category: "vendor", name: "SUSE", }, ], }, vulnerabilities: [ { cve: "CVE-2023-28427", notes: [ { category: "description", text: "Es existiert eine Schwachstelle in Mozilla Thunderbird in Verbindung mit dem Matrix Chat Protokoll. Ein entfernter, anonymer Angreifer kann diese Schwachstelle ausnutzen, um einen Denial of Service Zustand herbeizuführen. Zur erfolgreichen Ausnutzung ist eine Benutzeraktion erforderlich.", }, ], product_status: { known_affected: [ "2951", "T002207", "67646", "T012167", "1727", "74185", ], }, release_date: "2023-03-28T22:00:00.000+00:00", title: "CVE-2023-28427", }, ], }
ghsa-mwq8-fjpf-c2gr
Vulnerability from github
Published
2023-03-30 20:19
Modified
2023-03-30 20:19
Severity ?
Summary
Prototype pollution in matrix-js-sdk (part 2)
Details
Impact
In certain configurations, data sent by remote servers containing special strings in key locations could cause modifications of the Object.prototype, disrupting matrix-js-sdk functionality, causing denial of service and potentially affecting program logic.
(This is part 2, where CVE-2022-36059 / GHSA-rfv9-x7hh-xc32 is part 1. Part 2 covers remaining vectors not covered by part 1, found in a codebase audit scheduled after part 1.)
Patches
The issue has been patched in matrix-js-sdk 24.0.0.
Workarounds
None.
References
- Release blog post
- The advisory GHSA-rfv9-x7hh-xc32 (CVE-2022-36059) refers to an initial set of vulnerable locations discovered and patched in matrix-js-sdk 19.4.0. We opted not to disclose that advisory while we performed an audit of the codebase and are now disclosing it jointly with this one.
For more information
If you have any questions or comments about this advisory please email us at security at matrix.org.
{ affected: [ { package: { ecosystem: "npm", name: "matrix-js-sdk", }, ranges: [ { events: [ { introduced: "0", }, { fixed: "24.0.0", }, ], type: "ECOSYSTEM", }, ], }, ], aliases: [ "CVE-2023-28427", ], database_specific: { cwe_ids: [ "CWE-1321", ], github_reviewed: true, github_reviewed_at: "2023-03-30T20:19:18Z", nvd_published_at: "2023-03-28T21:15:00Z", severity: "HIGH", }, details: "### Impact\n\nIn certain configurations, data sent by remote servers containing special strings in key locations could cause modifications of the `Object.prototype`, disrupting matrix-js-sdk functionality, causing denial of service and potentially affecting program logic.\n\n(This is part 2, where [CVE-2022-36059](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-36059) / [GHSA-rfv9-x7hh-xc32](https://github.com/matrix-org/matrix-js-sdk/security/advisories/GHSA-rfv9-x7hh-xc32) is part 1. Part 2 covers remaining vectors not covered by part 1, found in a codebase audit scheduled after part 1.)\n\n### Patches\nThe issue has been patched in matrix-js-sdk 24.0.0.\n\n### Workarounds\nNone.\n\n### References\n\n- [Release blog post](https://matrix.org/blog/2023/03/28/security-releases-matrix-js-sdk-24-0-0-and-matrix-react-sdk-3-69-0)\n- The advisory [GHSA-rfv9-x7hh-xc32](https://github.com/matrix-org/matrix-js-sdk/security/advisories/GHSA-rfv9-x7hh-xc32) ([CVE-2022-36059](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-36059)) refers to an initial set of vulnerable locations discovered and patched in matrix-js-sdk 19.4.0. We opted not to disclose that advisory while we performed an audit of the codebase and are now disclosing it jointly with this one.\n\n### For more information\nIf you have any questions or comments about this advisory please email us at [security at matrix.org](mailto:security@matrix.org).\n", id: "GHSA-mwq8-fjpf-c2gr", modified: "2023-03-30T20:19:18Z", published: "2023-03-30T20:19:18Z", references: [ { type: "WEB", url: "https://github.com/matrix-org/matrix-js-sdk/security/advisories/GHSA-mwq8-fjpf-c2gr", }, { type: "WEB", url: "https://github.com/matrix-org/matrix-js-sdk/security/advisories/GHSA-rfv9-x7hh-xc32", }, { type: "ADVISORY", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-28427", }, { type: "PACKAGE", url: "https://github.com/matrix-org/matrix-js-sdk", }, { type: "WEB", url: "https://lists.debian.org/debian-lts-announce/2023/04/msg00027.html", }, { type: "WEB", url: "https://matrix.org/blog/2023/03/28/security-releases-matrix-js-sdk-24-0-0-and-matrix-react-sdk-3-69-0", }, { type: "WEB", url: "https://security.gentoo.org/glsa/202305-36", }, { type: "WEB", url: "https://www.debian.org/security/2023/dsa-5392", }, ], schema_version: "1.4.0", severity: [ { score: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H", type: "CVSS_V3", }, ], summary: "Prototype pollution in matrix-js-sdk (part 2)", }
fkie_cve-2023-28427
Vulnerability from fkie_nvd
Published
2023-03-28 21:15
Modified
2024-11-21 07:55
Severity ?
8.2 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
8.2 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
8.2 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
Summary
matrix-js-sdk is a Matrix messaging protocol Client-Server SDK for JavaScript. In versions prior to 24.0.0 events sent with special strings in key places can temporarily disrupt or impede the matrix-js-sdk from functioning properly, potentially impacting the consumer's ability to process data safely. Note that the matrix-js-sdk can appear to be operating normally but be excluding or corrupting runtime data presented to the consumer. This vulnerability is distinct from GHSA-rfv9-x7hh-xc32 which covers a similar issue. The issue has been patched in matrix-js-sdk 24.0.0 and users are advised to upgrade. There are no known workarounds for this vulnerability.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| matrix | javascript_sdk | * |
{ configurations: [ { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:a:matrix:javascript_sdk:*:*:*:*:*:node.js:*:*", matchCriteriaId: "F62FDB36-FCF3-46AF-B806-FB5ADD18B0FD", versionEndExcluding: "24.0.0", vulnerable: true, }, ], negate: false, operator: "OR", }, ], }, ], cveTags: [], descriptions: [ { lang: "en", value: "matrix-js-sdk is a Matrix messaging protocol Client-Server SDK for JavaScript. In versions prior to 24.0.0 events sent with special strings in key places can temporarily disrupt or impede the matrix-js-sdk from functioning properly, potentially impacting the consumer's ability to process data safely. Note that the matrix-js-sdk can appear to be operating normally but be excluding or corrupting runtime data presented to the consumer. This vulnerability is distinct from GHSA-rfv9-x7hh-xc32 which covers a similar issue. The issue has been patched in matrix-js-sdk 24.0.0 and users are advised to upgrade. There are no known workarounds for this vulnerability.", }, ], id: "CVE-2023-28427", lastModified: "2024-11-21T07:55:02.590", metrics: { cvssMetricV31: [ { cvssData: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 8.2, baseSeverity: "HIGH", confidentialityImpact: "NONE", integrityImpact: "LOW", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H", version: "3.1", }, exploitabilityScore: 3.9, impactScore: 4.2, source: "security-advisories@github.com", type: "Secondary", }, { cvssData: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 8.2, baseSeverity: "HIGH", confidentialityImpact: "NONE", integrityImpact: "LOW", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H", version: "3.1", }, exploitabilityScore: 3.9, impactScore: 4.2, source: "nvd@nist.gov", type: "Primary", }, ], }, published: "2023-03-28T21:15:11.057", references: [ { source: "security-advisories@github.com", tags: [ "Vendor Advisory", ], url: "https://github.com/matrix-org/matrix-js-sdk/security/advisories/GHSA-mwq8-fjpf-c2gr", }, { source: "security-advisories@github.com", url: "https://lists.debian.org/debian-lts-announce/2023/04/msg00027.html", }, { source: "security-advisories@github.com", tags: [ "Vendor Advisory", ], url: "https://matrix.org/blog/2023/03/28/security-releases-matrix-js-sdk-24-0-0-and-matrix-react-sdk-3-69-0", }, { source: "security-advisories@github.com", url: "https://security.gentoo.org/glsa/202305-36", }, { source: "security-advisories@github.com", url: "https://www.debian.org/security/2023/dsa-5392", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Vendor Advisory", ], url: "https://github.com/matrix-org/matrix-js-sdk/security/advisories/GHSA-mwq8-fjpf-c2gr", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "https://lists.debian.org/debian-lts-announce/2023/04/msg00027.html", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Vendor Advisory", ], url: "https://matrix.org/blog/2023/03/28/security-releases-matrix-js-sdk-24-0-0-and-matrix-react-sdk-3-69-0", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "https://security.gentoo.org/glsa/202305-36", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "https://www.debian.org/security/2023/dsa-5392", }, ], sourceIdentifier: "security-advisories@github.com", vulnStatus: "Modified", weaknesses: [ { description: [ { lang: "en", value: "CWE-1321", }, ], source: "security-advisories@github.com", type: "Primary", }, ], }
gsd-2023-28427
Vulnerability from gsd
Modified
2023-12-13 01:20
Details
matrix-js-sdk is a Matrix messaging protocol Client-Server SDK for JavaScript. In versions prior to 24.0.0 events sent with special strings in key places can temporarily disrupt or impede the matrix-js-sdk from functioning properly, potentially impacting the consumer's ability to process data safely. Note that the matrix-js-sdk can appear to be operating normally but be excluding or corrupting runtime data presented to the consumer. This vulnerability is distinct from GHSA-rfv9-x7hh-xc32 which covers a similar issue. The issue has been patched in matrix-js-sdk 24.0.0 and users are advised to upgrade. There are no known workarounds for this vulnerability.
Aliases
Aliases
{ GSD: { alias: "CVE-2023-28427", id: "GSD-2023-28427", }, gsd: { metadata: { exploitCode: "unknown", remediation: "unknown", reportConfidence: "confirmed", type: "vulnerability", }, osvSchema: { aliases: [ "CVE-2023-28427", ], details: "matrix-js-sdk is a Matrix messaging protocol Client-Server SDK for JavaScript. In versions prior to 24.0.0 events sent with special strings in key places can temporarily disrupt or impede the matrix-js-sdk from functioning properly, potentially impacting the consumer's ability to process data safely. Note that the matrix-js-sdk can appear to be operating normally but be excluding or corrupting runtime data presented to the consumer. This vulnerability is distinct from GHSA-rfv9-x7hh-xc32 which covers a similar issue. The issue has been patched in matrix-js-sdk 24.0.0 and users are advised to upgrade. There are no known workarounds for this vulnerability.", id: "GSD-2023-28427", modified: "2023-12-13T01:20:47.855184Z", schema_version: "1.4.0", }, }, namespaces: { "cve.org": { CVE_data_meta: { ASSIGNER: "security-advisories@github.com", ID: "CVE-2023-28427", STATE: "PUBLIC", }, affects: { vendor: { vendor_data: [ { product: { product_data: [ { product_name: "matrix-js-sdk", version: { version_data: [ { version_affected: "=", version_value: "< 24.0.0", }, ], }, }, ], }, vendor_name: "matrix-org", }, ], }, }, data_format: "MITRE", data_type: "CVE", data_version: "4.0", description: { description_data: [ { lang: "eng", value: "matrix-js-sdk is a Matrix messaging protocol Client-Server SDK for JavaScript. In versions prior to 24.0.0 events sent with special strings in key places can temporarily disrupt or impede the matrix-js-sdk from functioning properly, potentially impacting the consumer's ability to process data safely. Note that the matrix-js-sdk can appear to be operating normally but be excluding or corrupting runtime data presented to the consumer. This vulnerability is distinct from GHSA-rfv9-x7hh-xc32 which covers a similar issue. The issue has been patched in matrix-js-sdk 24.0.0 and users are advised to upgrade. There are no known workarounds for this vulnerability.", }, ], }, impact: { cvss: [ { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 8.2, baseSeverity: "HIGH", confidentialityImpact: "NONE", integrityImpact: "LOW", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H", version: "3.1", }, ], }, problemtype: { problemtype_data: [ { description: [ { cweId: "CWE-1321", lang: "eng", value: "CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')", }, ], }, ], }, references: { reference_data: [ { name: "https://github.com/matrix-org/matrix-js-sdk/security/advisories/GHSA-mwq8-fjpf-c2gr", refsource: "MISC", url: "https://github.com/matrix-org/matrix-js-sdk/security/advisories/GHSA-mwq8-fjpf-c2gr", }, { name: "https://matrix.org/blog/2023/03/28/security-releases-matrix-js-sdk-24-0-0-and-matrix-react-sdk-3-69-0", refsource: "MISC", url: "https://matrix.org/blog/2023/03/28/security-releases-matrix-js-sdk-24-0-0-and-matrix-react-sdk-3-69-0", }, { name: "https://www.debian.org/security/2023/dsa-5392", refsource: "MISC", url: "https://www.debian.org/security/2023/dsa-5392", }, { name: "https://lists.debian.org/debian-lts-announce/2023/04/msg00027.html", refsource: "MISC", url: "https://lists.debian.org/debian-lts-announce/2023/04/msg00027.html", }, { name: "https://security.gentoo.org/glsa/202305-36", refsource: "MISC", url: "https://security.gentoo.org/glsa/202305-36", }, ], }, source: { advisory: "GHSA-mwq8-fjpf-c2gr", discovery: "UNKNOWN", }, }, "gitlab.com": { advisories: [ { affected_range: "<24.0.0", affected_versions: "All versions before 24.0.0", cvss_v3: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H", cwe_ids: [], date: "2023-05-30", description: "matrix-js-sdk is a Matrix messaging protocol Client-Server SDK for JavaScript. In versions prior to 24.0.0 events sent with special strings in key places can temporarily disrupt or impede the matrix-js-sdk from functioning properly, potentially impacting the consumer's ability to process data safely. Note that the matrix-js-sdk can appear to be operating normally but be excluding or corrupting runtime data presented to the consumer. This vulnerability is distinct from GHSA-rfv9-x7hh-xc32 which covers a similar issue. The issue has been patched in matrix-js-sdk 24.0.0 and users are advised to upgrade. There are no known workarounds for this vulnerability.", fixed_versions: [ "24.0.0", ], identifier: "CVE-2023-28427", identifiers: [ "CVE-2023-28427", "GHSA-mwq8-fjpf-c2gr", ], not_impacted: "All versions starting from 24.0.0", package_slug: "npm/matrix-js-sdk", pubdate: "2023-03-28", solution: "Upgrade to version 24.0.0 or above.", title: "Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')", urls: [ "https://github.com/matrix-org/matrix-js-sdk/security/advisories/GHSA-mwq8-fjpf-c2gr", "https://github.com/matrix-org/matrix-js-sdk/security/advisories/GHSA-rfv9-x7hh-xc32", "https://nvd.nist.gov/vuln/detail/CVE-2023-28427", "https://matrix.org/blog/2023/03/28/security-releases-matrix-js-sdk-24-0-0-and-matrix-react-sdk-3-69-0", "https://github.com/advisories/GHSA-mwq8-fjpf-c2gr", ], uuid: "d8b8e502-1d12-47c4-9832-9f5ad7b0565a", }, ], }, "nvd.nist.gov": { configurations: { CVE_data_version: "4.0", nodes: [ { children: [], cpe_match: [ { cpe23Uri: "cpe:2.3:a:matrix:javascript_sdk:*:*:*:*:*:node.js:*:*", cpe_name: [], versionEndExcluding: "24.0.0", vulnerable: true, }, ], operator: "OR", }, ], }, cve: { CVE_data_meta: { ASSIGNER: "security-advisories@github.com", ID: "CVE-2023-28427", }, data_format: "MITRE", data_type: "CVE", data_version: "4.0", description: { description_data: [ { lang: "en", value: "matrix-js-sdk is a Matrix messaging protocol Client-Server SDK for JavaScript. In versions prior to 24.0.0 events sent with special strings in key places can temporarily disrupt or impede the matrix-js-sdk from functioning properly, potentially impacting the consumer's ability to process data safely. Note that the matrix-js-sdk can appear to be operating normally but be excluding or corrupting runtime data presented to the consumer. This vulnerability is distinct from GHSA-rfv9-x7hh-xc32 which covers a similar issue. The issue has been patched in matrix-js-sdk 24.0.0 and users are advised to upgrade. There are no known workarounds for this vulnerability.", }, ], }, problemtype: { problemtype_data: [ { description: [], }, ], }, references: { reference_data: [ { name: "https://matrix.org/blog/2023/03/28/security-releases-matrix-js-sdk-24-0-0-and-matrix-react-sdk-3-69-0", refsource: "MISC", tags: [ "Vendor Advisory", ], url: "https://matrix.org/blog/2023/03/28/security-releases-matrix-js-sdk-24-0-0-and-matrix-react-sdk-3-69-0", }, { name: "https://github.com/matrix-org/matrix-js-sdk/security/advisories/GHSA-mwq8-fjpf-c2gr", refsource: "MISC", tags: [ "Vendor Advisory", ], url: "https://github.com/matrix-org/matrix-js-sdk/security/advisories/GHSA-mwq8-fjpf-c2gr", }, { name: "https://www.debian.org/security/2023/dsa-5392", refsource: "MISC", tags: [], url: "https://www.debian.org/security/2023/dsa-5392", }, { name: "https://lists.debian.org/debian-lts-announce/2023/04/msg00027.html", refsource: "MISC", tags: [], url: "https://lists.debian.org/debian-lts-announce/2023/04/msg00027.html", }, { name: "https://security.gentoo.org/glsa/202305-36", refsource: "MISC", tags: [], url: "https://security.gentoo.org/glsa/202305-36", }, ], }, }, impact: { baseMetricV3: { cvssV3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 8.2, baseSeverity: "HIGH", confidentialityImpact: "NONE", integrityImpact: "LOW", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H", version: "3.1", }, exploitabilityScore: 3.9, impactScore: 4.2, }, }, lastModifiedDate: "2023-05-30T06:16Z", publishedDate: "2023-03-28T21:15Z", }, }, }
Log in or create an account to share your comment.
Security Advisory comment format.
This schema specifies the format of a comment related to a security advisory.
UUIDv4 of the comment
UUIDv4 of the Vulnerability-Lookup instance
When the comment was created originally
When the comment was last updated
Title of the comment
Description of the comment
The identifier of the vulnerability (CVE ID, GHSA-ID, PYSEC ID, etc.).
Loading…
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.