Advisories » MGASA-2023-0034

Updated thunderbird packages fix security vulnerability

Publication date: 07 Feb 2023
Modification date: 06 Feb 2023
Type: security
Affected Mageia releases : 8
CVE: CVE-2022-46871 , CVE-2022-46877 , CVE-2023-0430 , CVE-2023-23598 , CVE-2023-23601 , CVE-2023-23602 , CVE-2023-23603 , CVE-2023-23605

Description

libusrsctp library out of date. (CVE-2022-46871)

Arbitrary file read from GTK drag and drop on Linux. (CVE-2023-23598)

URL being dragged from cross-origin iframe into same tab triggers
navigation. (CVE-2023-23601)

Content Security Policy wasn't being correctly applied to WebSockets in
WebWorkers. (CVE-2023-23602)

Fullscreen notification bypass. (CVE-2022-46877)

Calls to console.log allowed bypasing Content Security Policy
via format directive. (CVE-2023-23603)

Memory safety bugs fixed in Thunderbird 102.7. (CVE-2023-23605)

Revocation status of S/Mime signature certificates was not checked.
(CVE-2023-0430)
                

References

• https://bugs.mageia.org/show_bug.cgi?id=31438
• https://www.thunderbird.net/en-US/thunderbird/102.7.0/releasenotes/
• https://www.thunderbird.net/en-US/thunderbird/102.7.1/releasenotes/
• https://www.mozilla.org/en-US/security/advisories/mfsa2023-03/
• https://www.mozilla.org/en-US/security/advisories/mfsa2023-04/
• https://access.redhat.com/errata/RHSA-2023:0463
• https://access.redhat.com/errata/RHSA-2023:0456
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-46871
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-46877
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-0430
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-23598
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-23601
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-23602
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-23603
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-23605

SRPMS

8/core

• thunderbird-102.7.1-1.mga8
• thunderbird-l10n-102.7.1-1.mga8