Advisories » MGASA-2020-0034

Updated thunderbird packages fix security vulnerabilities

Publication date: 11 Jan 2020
Modification date: 11 Jan 2020
Type: security
Affected Mageia releases : 7
CVE: CVE-2019-17016 , CVE-2019-17017 , CVE-2019-17022 , CVE-2019-17024 , CVE-2019-17026

Description

Updated thunderbird packages fix security vulnerabilities:

Bypass of @namespace CSS sanitization during pasting (CVE-2019-17016)

Type Confusion in XPCVariant.cpp (CVE-2019-17017)

CSS sanitization does not escape HTML tags (CVE-2019-17022)

Memory safety bugs fixed in Thunderbird 68.4.1 (CVE-2019-17024)

IonMonkey type confusion with StoreElementHole and FallibleStoreElement
(CVE-2019-17026)

Enigmail has been updated to 2.15
                

References

• https://bugs.mageia.org/show_bug.cgi?id=26047
• https://www.mozilla.org/en-US/security/advisories/mfsa2020-04/
• https://www.thunderbird.net/en-US/thunderbird/68.4.1/releasenotes/
• https://enigmail.net/index.php/en/download/changelog#enig2.1.5
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17016
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17017
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17022
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17024
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17026

SRPMS

7/core

• thunderbird-68.4.1-1.mga7
• thunderbird-l10n-68.4.1-1.mga7