[SUSE-SU-2019:0338-1] Security update for MozillaThunderbird
Severity
Important
CVEs
10
Security update for MozillaThunderbird
This update for MozillaThunderbird to version 60.5 fixes the following issues:
Security vulnerabilities addressed (MSFA 2019-03 MSFA 2018-31 bsc#1122983 bsc#1119105):
- CVE-2018-18500: Use-after-free parsing HTML5 stream
- CVE-2018-18505: Privilege escalation through IPC channel messages
- CVE-2016-5824 DoS (use-after-free) via a crafted ics file
- CVE-2018-18501: Memory safety bugs fixed in Firefox 65 and Firefox ESR 60.5
- CVE-2018-17466: Buffer overflow and out-of-bounds read in ANGLE library with TextureStorage11
- CVE-2018-18492: Use-after-free with select element
- CVE-2018-18493: Buffer overflow in accelerated 2D canvas with Skia
- CVE-2018-18494: Same-origin policy violation using location attribute and performance.getEntries to steal cross-origin URLs
- CVE-2018-18498: Integer overflow when calculating buffer sizes for images
- CVE-2018-12405: Memory safety bugs fixed in Firefox 64, 60.4, and Thunderbird 60.4
Other bug fixes and changes:
- FileLink provider WeTransfer to upload large attachments
- Thunderbird now allows the addition of OpenSearch search engines from a local XML file using a minimal user interface: [+] button to select a file an add, [-] to remove.
- More search engines: Google and DuckDuckGo available by default in some locales
- During account creation, Thunderbird will now detect servers using the Microsoft Exchange protocol. It will offer the installation of a 3rd party add-on (Owl) which supports that protocol.
- Thunderbird now compatible with other WebExtension-based FileLink add-ons like the Dropbox add-on
- New WebExtensions FileLink API to facilitate add-ons
- Fix decoding problems for messages with less common charsets (cp932, cp936)
- New messages in the drafts folder (and other special or virtual folders) will no longer be included in the new messages notification
- Thunderbird 60 will migrate security databases (key3.db, cert8.db to key4.db, cert9.db).
- Address book search and auto-complete slowness
- Plain text markup with * for bold, / for italics, _ for underline and | for code did not work when the enclosed text contained non-ASCII characters
- While composing a message, a link not removed when link location was removed in the link properties panel
- Encoding problems when exporting address books or messages using the system charset. Messages are now always exported using the UTF-8 encoding
- If the 'Date' header of a message was invalid, Jan 1970 or Dec 1969 was displayed. Now using date from 'Received' header instead.
- Body search/filtering didn't reliably ignore content of tags
- Inappropriate warning 'Thunderbird prevented the site (addons.thunderbird.net) from asking you to install software on your computer' when installing add-ons
- Incorrect display of correspondents column since own email address was not always detected
- Spurious (encoded newline) inserted into drafts and sent email
- Double-clicking on a word in the Write window sometimes launched the Advanced Property Editor or Link Properties dialog
- Fixe Cookie removal
- 'Download rest of message' was not working if global inbox was used
- Fix Encoding problems for users (especially in Poland) when a file was sent via a folder using 'Sent to > Mail recipient' due to a problem in the Thunderbird MAPI interface
- According to RFC 4616 and RFC 5721, passwords containing non-ASCII characters are encoded using UTF-8 which can lead to problems with non-compliant providers, for example office365.com. The SMTP LOGIN and POP3 USER/PASS authentication methods are now using a Latin-1 encoding again to work around this issue
- Fix shutdown crash/hang after entering an empty IMAP password
- ID
- SUSE-SU-2019:0338-1
- Severity
- important
- URL
- https://www.suse.com/support/update/announcement/2019/suse-su-20190338-1/
- Published
-
2019-02-12T14:59:10
(5 years ago) - Modified
-
2019-02-12T14:59:10
(5 years ago) - Rights
- Copyright 2024 SUSE LLC. All rights reserved.
- Other Advisories
-
- ALAS2-2019-1168
- ALPINE:CVE-2018-18500
- ALPINE:CVE-2018-18501
- ALPINE:CVE-2018-18505
- ASA-201810-12
- ASA-201812-9
- ASA-201902-2
- DSA-4330-1
- DSA-4354-1
- DSA-4362-1
- DSA-4376-1
- DSA-4392-1
- ELSA-2018-3831
- ELSA-2018-3833
- ELSA-2019-0159
- ELSA-2019-0160
- ELSA-2019-0218
- ELSA-2019-0219
- ELSA-2019-0269
- ELSA-2019-0270
- FEDORA-2018-34f7f68029
- FEDORA-2018-fd194a1f14
- FREEBSD:B1F7D52F-FC42-48E8-8403-87D4C9D26229
- FREEBSD:D10B49B2-8D02-49E8-AFDE-0844626317AF
- GLSA-201811-10
- GLSA-201903-04
- GLSA-201904-02
- GLSA-201904-07
- MFSA-2018-29
- MFSA-2018-30
- MFSA-2018-31
- MFSA-2019-01
- MFSA-2019-02
- MFSA-2019-03
- openSUSE-SU-2018:3835-1
- openSUSE-SU-2019:0132-1
- openSUSE-SU-2019:0249-1
- openSUSE-SU-2019:0251-1
- openSUSE-SU-2019:1758-1
- RHSA-2018:3004
- RHSA-2018:3831
- RHSA-2018:3833
- RHSA-2019:0159
- RHSA-2019:0160
- RHSA-2019:0218
- RHSA-2019:0219
- RHSA-2019:0269
- RHSA-2019:0270
- SSA:2018-345-01
- SSA:2019-029-01
- SUSE-SU-2017:1989-1
- SUSE-SU-2018:0119-1
- SUSE-SU-2018:4235-1
- SUSE-SU-2018:4236-1
- SUSE-SU-2018:4236-2
- SUSE-SU-2019:0273-1
- SUSE-SU-2019:0336-1
- SUSE-SU-2019:0336-2
- USN-3844-1
- USN-3868-1
- USN-3874-1
- USN-3897-1
# CVE | Description | CVSS | EPSS | EPSS Trend (30 days) | Affected Products | Weaknesses | Security Advisories | Exploits | PoC | Pubblication Date | Modification Date |
---|---|---|---|---|---|---|---|---|---|---|---|
# CVE | Description | CVSS | EPSS | EPSS Trend (30 days) | Affected Products | Weaknesses | Security Advisories | PoC | Pubblication Date | Modification Date |