thunderbird-102.13.0-2.el8.ML.1

エラータID: AXSA:2023-6238:20

Release date: 
Wednesday, July 19, 2023 - 02:40
Subject: 
thunderbird-102.13.0-2.el8.ML.1
Affected Channels: 
Asianux Server 8 for x86_64
Severity: 
High
Description: 

Mozilla Thunderbird is a standalone mail and newsgroup client.

This update upgrades Thunderbird to version 102.13.0.

Security Fix(es):

* Mozilla: Use-after-free in WebRTC certificate generation (CVE-2023-37201)
* Mozilla: Potential use-after-free from compartment mismatch in SpiderMonkey (CVE-2023-37202)
* Mozilla: Memory safety bugs fixed in Firefox 115, Firefox ESR 102.13, and Thunderbird 102.13 (CVE-2023-37211)
* Mozilla: Fullscreen notification obscured (CVE-2023-37207)
* Mozilla: Lack of warning when opening Diagcab files (CVE-2023-37208)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

CVE-2023-37201
An attacker could have triggered a use-after-free condition when creating a WebRTC connection over HTTPS. This vulnerability affects Firefox < 115, Firefox ESR < 102.13, and Thunderbird < 102.13.
CVE-2023-37202
Cross-compartment wrappers wrapping a scripted proxy could have caused objects from other compartments to be stored in the main compartment resulting in a use-after-free. This vulnerability affects Firefox < 115, Firefox ESR < 102.13, and Thunderbird < 102.13.
CVE-2023-37207
A website could have obscured the fullscreen notification by using a URL with a scheme handled by an external program, such as a mailto URL. This could have led to user confusion and possible spoofing attacks. This vulnerability affects Firefox < 115, Firefox ESR < 102.13, and Thunderbird < 102.13.
CVE-2023-37208
When opening Diagcab files, Firefox did not warn the user that these files may contain malicious code. This vulnerability affects Firefox < 115, Firefox ESR < 102.13, and Thunderbird < 102.13.
CVE-2023-37211
Memory safety bugs present in Firefox 114, Firefox ESR 102.12, and Thunderbird 102.12. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 115, Firefox ESR < 102.13, and Thunderbird < 102.13.

Solution: 

Update packages.

Additional Info: 

N/A

Download: 

SRPMS
  1. thunderbird-102.13.0-2.el8.ML.1.src.rpm
    MD5: 77374478fe1f36cbe3ffeb2a02887431
    SHA-256: efcf15791f38509d55c7482017aed5926ac5690ea1540f7d6b171dad4e58e258
    Size: 616.67 MB

Asianux Server 8 for x86_64
  1. thunderbird-102.13.0-2.el8.ML.1.x86_64.rpm
    MD5: b619f1a6a6d6333eebde22edfd9bec44
    SHA-256: d28e9df60cbe3ef0c53210726e8ac450109cfc91aeb020d09074c11c673d250e
    Size: 105.01 MB