Advisories » MGASA-2023-0309

Updated thunderbird packages fix security vulnerabilities

Publication date: 06 Nov 2023
Modification date: 06 Nov 2023
Type: security
Affected Mageia releases : 9
CVE: CVE-2023-5721 , CVE-2023-5732 , CVE-2023-5724 , CVE-2023-5725 , CVE-2023-5728 , CVE-2023-5730

Description

The updated packages fix security vulnerabilities:

Queued up rendering could have allowed websites to clickjack.
(CVE-2023-5721)

Address bar spoofing via bidirectional characters. (CVE-2023-5732)

Large WebGL draw could have led to a crash. (CVE-2023-5724)

WebExtensions could open arbitrary URLs. (CVE-2023-5725)

Improper object tracking during GC in the JavaScript engine could have
led to a crash. (CVE-2023-5728)

Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4, and
Thunderbird 115.4.1. (CVE-2023-5730)
                

References

• https://bugs.mageia.org/show_bug.cgi?id=32478
• https://www.thunderbird.net/en-US/thunderbird/115.4.1/releasenotes/
• https://www.mozilla.org/en-US/security/advisories/mfsa2023-47/
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-5721
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-5732
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-5724
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-5725
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-5728
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-5730

SRPMS

9/core

• thunderbird-115.4.1-1.mga9
• thunderbird-l10n-115.4.1-1.mga9