Advisories » MGASA-2021-0066

Updated thunderbird packages fix security vulnerabilities

Publication date: 04 Feb 2021
Modification date: 04 Feb 2021
Type: security
Affected Mageia releases : 7
CVE: CVE-2021-23953 , CVE-2021-23954 , CVE-2020-15685 , CVE-2020-26976 , CVE-2021-23960 , CVE-2021-23964

Description

Cross-origin information leakage via redirected PDF requests. (CVE-2021-23953)

Type confusion when using logical assignment operators in JavaScript switch
statements. (CVE-2021-23954)

IMAP Response Injection when using STARTTLS. (CVE-2020-15685)

HTTPS pages could have been intercepted by a registered service worker when
they should not have been. (CVE-2020-26976)

Use-after-poison for incorrectly redeclared JavaScript variables during GC.
(CVE-2021-23960)

Memory safety bugs fixed in Thunderbird 78.7. (CVE-2021-23964).
                

References

• https://bugs.mageia.org/show_bug.cgi?id=28247
• https://www.mozilla.org/en-US/security/advisories/mfsa2021-05/
• https://www.thunderbird.net/en-US/thunderbird/78.7.0/releasenotes/
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23953
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23954
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15685
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-26976
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23960
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23964

SRPMS

7/core

• thunderbird-78.7.0-1.mga7
• thunderbird-l10n-78.7.0-1.mga7