This update for MozillaThunderbird fixes the following issues:
Update to version 102.6 (bsc#1206242):
- CVE-2022-46880: Use-after-free in WebGL
- CVE-2022-46872: Arbitrary file read from a compromised content process
- CVE-2022-46881: Memory corruption in WebGL
- CVE-2022-46874: Drag and Dropped Filenames could have been truncated to malicious extensions
- CVE-2022-46875: Download Protections were bypassed by .atloc and .ftploc files on Mac OS
- CVE-2022-46882: Use-after-free in WebGL
- CVE-2022-46878: Memory safety bugs fixed in Thunderbird 102.6
This update for MozillaThunderbird fixes the following issues:
Update to version 102.5.1:
- CVE-2022-45414: Quoting from an HTML email with certain tags will trigger network requests and load remote content, regardless of a configuration to block remote content (bsc#1205941).
This update for MozillaThunderbird fixes the following issues:
- Fixed various security issues (MFSA 2022-49, bsc#1205270):
* CVE-2022-45403 (bmo#1762078)
Service Workers might have learned size of cross-origin media
files
* CVE-2022-45404 (bmo#1790815)
Fullscreen notification bypass
* CVE-2022-45405 (bmo#1791314)
Use-after-free in InputStream implementation
* CVE-2022-45406 (bmo#1791975)
Use-after-free of a JavaScript Realm
* CVE-2022-45408 (bmo#1793829)
Fullscreen notification bypass via windowName
* CVE-2022-45409 (bmo#1796901)
Use-after-free in Garbage Collection
* CVE-2022-45410 (bmo#1658869)
This update for MozillaThunderbird fixes the following issues:
- Mozilla Thunderbird 102.4.0 (bsc#1204421)
* changed: Thunderbird will automatically detect and repair OpenPGP key storage corruption caused by using the profile import tool in Thunderbird 102
* fixed: POP message download into a large folder (~13000 messages) caused Thunderbird to temporarily freeze
* fixed: Forwarding messages with special characters in Subject failed on Windows
* fixed: Links for FileLink attachments were not added when attachment filename contained Unicode characters
* fixed: Address Book display pane continued to show contacts after deletion
This update for MozillaThunderbird fixes the following issues:
Updated to Mozilla Thunderbird 102.2.2:
- CVE-2022-3033: Fixed leaking of sensitive information when composing a response to an HTML email with a META refresh tag (bsc#1203007).
- CVE-2022-3032: Fixed missing blocking of remote content specified in an HTML document that was nested inside an iframe's srcdoc attribute (bsc#1203007).
- CVE-2022-3034: Fixed issue where iframe element in an HTML email could trigger a network request (bsc#1203007).
- CVE-2022-36059: Fixed DoS in Matrix SDK bundled with Thunderbird service attack (bsc#1203007).
- CVE-2022-38472: Fixed Address bar spoo
This update for MozillaThunderbird fixes the following issues:
- Mozilla Thunderbird 91.12
* changed: Support for Google Talk chat accounts removed
* fixed: OpenPGP signatures were broken when 'Primary Password'
dialog remained open
* fixed: Various security fixes
- Security fixes (MFSA 2022-31) (bsc#1201758):
- CVE-2022-36319: Fixed mouse Position spoofing with CSS transforms (bmo#1737722)
- CVE-2022-36318: Fixed directory indexes for bundled resources reflected URL parameters (bmo#1771774)
This update for MozillaThunderbird fixes the following issues:
- CVE-2022-2200: Undesired attributes could be set as part of prototype pollution (bmo#1771381)
- CVE-2022-2226: An email with a mismatching OpenPGP signature date was accepted as valid (bmo#1775441)
- CVE-2022-31744: CSP bypass enabling stylesheet injection (bmo#1757604)
- CVE-2022-34468: CSP sandbox header without `allow-scripts` can be bypassed via retargeted javascript: URI (bmo#1768537)
- CVE-2022-34470: Use-after-free in nsSHistory (bmo#1765951)
- CVE-2022-34472: Unavailable PAC file resulted in OCSP requests being blocked (bmo#1770123)
- CVE-2022-34478: Micro
This update for MozillaThunderbird fixes the following issues:
Update to Mozilla Thunderbird 91.9.1
MFSA 2022-19 (bsc#1199768):
- CVE-2022-1802: Prototype pollution in Top-Level Await implementation (bmo#1770137).
- CVE-2022-1529: Untrusted input used in JavaScript object indexing, leading to prototype pollution (bmo#1770048).
Update to Mozilla Thunderbird 91.10
MFSA 2022-22 (bsc#1200027):
- CVE-2022-31736: Cross-Origin resource's length leaked (bmo#1735923)
- CVE-2022-31737: Heap buffer overflow in WebGL (bmo#1743767)
- CVE-2022-31738: Browser window spoof using fullscreen mode (bmo#1756388)
- CVE-2022-31739: Attacker-influenced path
This update for MozillaThunderbird fixes the following issues:
- Updated to version 91.8 (bsc#1197903):
- CVE-2022-1097: Fixed a memory corruption issue with NSSToken objects.
- CVE-2022-28281: Fixed a memory corruption issue due to unexpected WebAuthN
Extensions.
- CVE-2022-1197: Fixed an issue where OpenPGP revocation information was ignored.
- CVE-2022-1196: Fixed a memory corruption issue after VR process destruction.
- CVE-2022-28282: Fixed a memory corruption issue in document translation.
- CVE-2022-28285: Fixed a memory corruption issue in JIT code generation.
- CVE-2022-28286: Fixed an iframe layout issue that coul
This update for MozillaThunderbird fixes the following issues:
Updated to version 91.7 (bsc#1196900):
- CVE-2022-26381: Fixed an invalid memory access due to text reflow when SVG
objects were present.
- CVE-2022-26383: Fixed an issue where, when resizing a popup after requesting
fullscreen access, the popup would not display the fullscreen notification.
- CVE-2022-26384: Fixed an iframe XSS sandbox bypass when allow-popups was used
on the iframe.
- CVE-2022-26386: Fixed an issue where downloadable temporary files were
accessible to other local users.
- CVE-2022-26387: Fixed a potential add-on signature verification
This update for MozillaThunderbird fixes the following issues:
Mozilla Thunderbird 91.6.2 (bsc#1196809):
- CVE-2022-26485: Use-after-free in XSLT parameter processing
- CVE-2022-26486: Use-after-free in WebGPU IPC Framework
This update for MozillaThunderbird fixes the following issues:
- Mozilla Thunderbird 91.6.1 / MFSA 2022-07 (bsc#1196072)
* CVE-2022-0566 (bmo#1753094)
Crafted email could trigger an out-of-bounds write
- Mozilla Thunderbird 91.6 / MFSA 2022-06 (bsc#1195682)
* CVE-2022-22753 (bmo#1732435)
Privilege Escalation to SYSTEM on Windows via Maintenance
Service
* CVE-2022-22754 (bmo#1750565)
Extensions could have bypassed permission confirmation during
update
* CVE-2022-22756 (bmo#1317873)
Drag and dropping an image could have resulted in the dropped
object being an executable
* CVE-2022-22759 (bmo#1739957)
This update for MozillaThunderbird fixes the following issues:
- Mozilla Thunderbird 91.4.1
- CVE-2021-4126: OpenPGP signature status doesn't consider additional message content. (bsc#1194215)
- CVE-2021-44538: Matrix chat library libolm bundled with Thunderbird vulnerable to a buffer overflow. (bsc#1194020)
This update for MozillaThunderbird fixes the following issues:
- Update to version 91.4 MFSA 2021-54 (bsc#1193485)
- CVE-2021-43536: URL leakage when navigating while executing asynchronous function
- CVE-2021-43537: Heap buffer overflow when using structured clone
- CVE-2021-43538: Missing fullscreen and pointer lock notification when requesting both
- CVE-2021-43539: GC rooting failure when calling wasm instance methods
- CVE-2021-43541: External protocol handler parameters were unescaped
- CVE-2021-43542: XMLHttpRequest error codes could have leaked the existence of an external protocol handler
- CVE-2021-43543: Bypass of CSP sandbox dire
This update for MozillaThunderbird fixes the following issues:
Update to version 78.13 (MFSA 2021-35, bsc#1188891)
- CVE-2021-29986: Race condition when resolving DNS names could have led to memory corruption
- CVE-2021-29988: Memory corruption as a result of incorrect style treatment
- CVE-2021-29984: Incorrect instruction reordering during JIT optimization
- CVE-2021-29980: Uninitialized memory in a canvas object could have led to memory corruption
- CVE-2021-29985: Use-after-free media channels
- CVE-2021-29989: Memory safety bugs fixed in Thunderbird 78.13
This update for MozillaThunderbird fixes the following issues:
Mozilla Thunderbird 78.12
* fixed: Sending an email containing HTML links with spaces in
the URL sometimes resulted in broken links
* fixed: Folder Pane display theme fixes for macOS
* fixed: Chat account settings did not always save as expected
* fixed: RSS feed subscriptions sometimes lost
* fixed: Calendar: A parsing error for alarm triggers of type
'DURATION' caused sync problems for some users
* fixed: Various security fixes
MFSA 2021-30 (bsc#1188275)
* CVE-2021-29969: IMAP server responses sent by a MITM prior to STARTTLS could be processed
* CVE-2021
This update for MozillaThunderbird fixes the following issues:
- Mozilla Thunderbird 78.10.2
- CVE-2021-29957: Fixed partial protection of inline OpenPGP message not indicated (bsc#1186198).
- CVE-2021-29956: Fixed Thunderbird stored OpenPGP secret keys without master password protection (bsc#1186199).
- CVE-2021-29951: Fixed Thunderbird Maintenance Service could have been started or stopped by domain users (bsc#1185633).
- CVE-2021-29950: Fixed logic issue potentially leaves key material unlocked (bsc#1185086).
This update for MozillaThunderbird fixes the following issues:
Mozilla Thunderbird 78.11 (bsc#1186696)
Security issues fixed:
- CVE-2021-29964: Out of bounds-read when parsing a `WM_COPYDATA` message
- CVE-2021-29967: Memory safety bugs fixed in Thunderbird 78.11
General improvements:
- OpenPGP could not be disabled for an account if a key was previously configured
- Recipients were unable to decrypt some messages when the sender had changed the message encryption from OpenPGP to S/MIME
- Contacts moved between CardDAV address books were not synced to the new server
- CardDAV compatibility fixes for Google Contacts
- Folder pane had no c