[ALSA-2024:1494] thunderbird security update

Severity Moderate

Affected Packages 2

CVEs 9

thunderbird security update

Mozilla Thunderbird is a standalone mail and newsgroup client.

This update upgrades Thunderbird to version 115.9.0.

Security Fix(es):

nss: timing attack against RSA decryption (CVE-2023-5388)
Mozilla: Crash in NSS TLS method (CVE-2024-0743)
Mozilla: Leaking of encrypted email subjects to other conversations (CVE-2024-1936)
Mozilla: JIT code failed to save return registers on Armv7-A (CVE-2024-2607)
Mozilla: Integer overflow could have led to out of bounds write (CVE-2024-2608)
Mozilla: Improper handling of html and body tags enabled CSP nonce leakage (CVE-2024-2610)
Mozilla: Clickjacking vulnerability could have led to a user accidentally granting permissions (CVE-2024-2611)
Mozilla: Self referencing object could have potentially led to a use-after-free (CVE-2024-2612)
Mozilla: Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9, and Thunderbird 115.9 (CVE-2024-2614)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Package	Affected Version
pkg:rpm/almalinux/thunderbird?arch=x86_64&distro=almalinux-8.9	< 115.9.0-1.el8_9.alma.1
pkg:rpm/almalinux/thunderbird?arch=aarch64&distro=almalinux-8.9	< 115.9.0-1.el8_9.alma.1

ID

ALSA-2024:1494

Severity

moderate

URL

https://errata.almalinux.org/ALSA-2024:1494.html

Published

2024-03-25T00:00:00
(5 months ago)

Modified

2024-04-04T14:02:37
(5 months ago)

Rights

Other Advisories

Source	# ID	URL
RHSA	RHSA-2024:1494	https://access.redhat.com/errata/RHSA-2024:1494
CVE	CVE-2023-5388	https://access.redhat.com/security/cve/CVE-2023-5388
CVE	CVE-2024-0743	https://access.redhat.com/security/cve/CVE-2024-0743
CVE	CVE-2024-1936	https://access.redhat.com/security/cve/CVE-2024-1936
CVE	CVE-2024-2607	https://access.redhat.com/security/cve/CVE-2024-2607
CVE	CVE-2024-2608	https://access.redhat.com/security/cve/CVE-2024-2608
CVE	CVE-2024-2610	https://access.redhat.com/security/cve/CVE-2024-2610
CVE	CVE-2024-2611	https://access.redhat.com/security/cve/CVE-2024-2611
CVE	CVE-2024-2612	https://access.redhat.com/security/cve/CVE-2024-2612
CVE	CVE-2024-2614	https://access.redhat.com/security/cve/CVE-2024-2614
Bugzilla	2243644	https://bugzilla.redhat.com/2243644
Bugzilla	2260012	https://bugzilla.redhat.com/2260012
Bugzilla	2268171	https://bugzilla.redhat.com/2268171
Bugzilla	2270660	https://bugzilla.redhat.com/2270660
Bugzilla	2270661	https://bugzilla.redhat.com/2270661
Bugzilla	2270663	https://bugzilla.redhat.com/2270663
Bugzilla	2270664	https://bugzilla.redhat.com/2270664
Bugzilla	2270665	https://bugzilla.redhat.com/2270665
Bugzilla	2270666	https://bugzilla.redhat.com/2270666
Self	ALSA-2024:1494	https://errata.almalinux.org/8/ALSA-2024-1494.html

Type	Package URL	Namespace	Name / Product	Version	Distribution / Platform	Arch	Patch / Fix
Affected	pkg:rpm/almalinux/thunderbird?arch=x86_64&distro=almalinux-8.9	almalinux	thunderbird	< 115.9.0-1.el8_9.alma.1	almalinux-8.9	x86_64
Affected	pkg:rpm/almalinux/thunderbird?arch=aarch64&distro=almalinux-8.9	almalinux	thunderbird	< 115.9.0-1.el8_9.alma.1	almalinux-8.9	aarch64

# CVE	Description	CVSS	EPSS	EPSS Trend (30 days)	Affected Products	Weaknesses	Security Advisories	Exploits	PoC	Pubblication Date	Modification Date
# CVE	Description	CVSS	EPSS	EPSS Trend (30 days)	Affected Products	Weaknesses	Security Advisories	PoC	Pubblication Date	Modification Date