[RLSA-2024:1494] thunderbird security update

Severity Moderate

Affected Packages 2

CVEs 9

An update is available for thunderbird. This update affects Rocky Linux 8. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list

Mozilla Thunderbird is a standalone mail and newsgroup client.

This update upgrades Thunderbird to version 115.9.0.

Security Fix(es):

nss: timing attack against RSA decryption (CVE-2023-5388)
Mozilla: Crash in NSS TLS method (CVE-2024-0743)
Mozilla: Leaking of encrypted email subjects to other conversations (CVE-2024-1936)
Mozilla: JIT code failed to save return registers on Armv7-A (CVE-2024-2607)
Mozilla: Integer overflow could have led to out of bounds write
(CVE-2024-2608)
Mozilla: Improper handling of html and body tags enabled CSP nonce leakage
(CVE-2024-2610)
Mozilla: Clickjacking vulnerability could have led to a user accidentally
granting permissions (CVE-2024-2611)
Mozilla: Self referencing object could have potentially led to a
use-after-free (CVE-2024-2612)
Mozilla: Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9, and
Thunderbird 115.9 (CVE-2024-2614)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Package	Affected Version
pkg:rpm/rockylinux/thunderbird?arch=x86_64&distro=rockylinux-8.9	< 115.9.0-1.el8_9
pkg:rpm/rockylinux/thunderbird?arch=aarch64&distro=rockylinux-8.9	< 115.9.0-1.el8_9

ID

RLSA-2024:1494

Severity

moderate

URL

https://errata.rockylinux.org/RLSA-2024:1494

Published

2024-03-27T04:34:32
(5 months ago)

Modified

2024-03-27T04:36:48
(5 months ago)

Rights

Other Advisories

Source	# ID	URL
CVE	CVE-2023-5388	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-5388
CVE	CVE-2024-0743	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-0743
CVE	CVE-2024-1936	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-1936
CVE	CVE-2024-2607	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-2607
CVE	CVE-2024-2608	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-2608
CVE	CVE-2024-2610	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-2610
CVE	CVE-2024-2611	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-2611
CVE	CVE-2024-2612	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-2612
CVE	CVE-2024-2614	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-2614
Bugzilla	2243644	https://bugzilla.redhat.com/show_bug.cgi?id=2243644
Bugzilla	2260012	https://bugzilla.redhat.com/show_bug.cgi?id=2260012
Bugzilla	2268171	https://bugzilla.redhat.com/show_bug.cgi?id=2268171
Bugzilla	2270660	https://bugzilla.redhat.com/show_bug.cgi?id=2270660
Bugzilla	2270661	https://bugzilla.redhat.com/show_bug.cgi?id=2270661
Bugzilla	2270663	https://bugzilla.redhat.com/show_bug.cgi?id=2270663
Bugzilla	2270664	https://bugzilla.redhat.com/show_bug.cgi?id=2270664
Bugzilla	2270665	https://bugzilla.redhat.com/show_bug.cgi?id=2270665
Bugzilla	2270666	https://bugzilla.redhat.com/show_bug.cgi?id=2270666
Self	RLSA-2024:1494	https://errata.rockylinux.org/RLSA-2024:1494

Type	Package URL	Namespace	Name / Product	Version	Distribution / Platform	Arch	Patch / Fix
Affected	pkg:rpm/rockylinux/thunderbird?arch=x86_64&distro=rockylinux-8.9	rockylinux	thunderbird	< 115.9.0-1.el8_9	rockylinux-8.9	x86_64
Affected	pkg:rpm/rockylinux/thunderbird?arch=aarch64&distro=rockylinux-8.9	rockylinux	thunderbird	< 115.9.0-1.el8_9	rockylinux-8.9	aarch64

# CVE	Description	CVSS	EPSS	EPSS Trend (30 days)	Affected Products	Weaknesses	Security Advisories	Exploits	PoC	Pubblication Date	Modification Date
# CVE	Description	CVSS	EPSS	EPSS Trend (30 days)	Affected Products	Weaknesses	Security Advisories	PoC	Pubblication Date	Modification Date