This update for MozillaThunderbird fixes the following issues:
- Update to version 91.4 MFSA 2021-54 (bsc#1193485)
- CVE-2021-43536: URL leakage when navigating while executing asynchronous function
- CVE-2021-43537: Heap buffer overflow when using structured clone
- CVE-2021-43538: Missing fullscreen and pointer lock notification when requesting both
- CVE-2021-43539: GC rooting failure when calling wasm instance methods
- CVE-2021-43541: External protocol handler parameters were unescaped
- CVE-2021-43542: XMLHttpRequest error codes could have leaked the existence of an external protocol handler
- CVE-2021-43543: Bypass of CSP sandbox dire
This update for MozillaThunderbird fixes the following issues:
Update to version 78.13 (MFSA 2021-35, bsc#1188891)
- CVE-2021-29986: Race condition when resolving DNS names could have led to memory corruption
- CVE-2021-29988: Memory corruption as a result of incorrect style treatment
- CVE-2021-29984: Incorrect instruction reordering during JIT optimization
- CVE-2021-29980: Uninitialized memory in a canvas object could have led to memory corruption
- CVE-2021-29985: Use-after-free media channels
- CVE-2021-29989: Memory safety bugs fixed in Thunderbird 78.13
This update for MozillaThunderbird fixes the following issues:
Mozilla Thunderbird 78.12
* fixed: Sending an email containing HTML links with spaces in
the URL sometimes resulted in broken links
* fixed: Folder Pane display theme fixes for macOS
* fixed: Chat account settings did not always save as expected
* fixed: RSS feed subscriptions sometimes lost
* fixed: Calendar: A parsing error for alarm triggers of type
'DURATION' caused sync problems for some users
* fixed: Various security fixes
MFSA 2021-30 (bsc#1188275)
* CVE-2021-29969: IMAP server responses sent by a MITM prior to STARTTLS could be processed
* CVE-2021
This update for MozillaThunderbird fixes the following issues:
Mozilla Thunderbird 78.11 (bsc#1186696)
Security issues fixed:
- CVE-2021-29964: Out of bounds-read when parsing a `WM_COPYDATA` message
- CVE-2021-29967: Memory safety bugs fixed in Thunderbird 78.11
General improvements:
- OpenPGP could not be disabled for an account if a key was previously configured
- Recipients were unable to decrypt some messages when the sender had changed the message encryption from OpenPGP to S/MIME
- Contacts moved between CardDAV address books were not synced to the new server
- CardDAV compatibility fixes for Google Contacts
- Folder pane had no c
This update for MozillaThunderbird fixes the following issues:
- Mozilla Thunderbird 78.10.2
- CVE-2021-29957: Fixed partial protection of inline OpenPGP message not indicated (bsc#1186198).
- CVE-2021-29956: Fixed Thunderbird stored OpenPGP secret keys without master password protection (bsc#1186199).
- CVE-2021-29951: Fixed Thunderbird Maintenance Service could have been started or stopped by domain users (bsc#1185633).
- CVE-2021-29950: Fixed logic issue potentially leaves key material unlocked (bsc#1185086).
This update for MozillaThunderbird fixes the following issues:
- Firefox was updated to 78.10.0 ESR (bsc#1184960)
* CVE-2021-23994: Out of bound write due to lazy initialization
* CVE-2021-23995: Use-after-free in Responsive Design Mode
* CVE-2021-23998: Secure Lock icon could have been spoofed
* CVE-2021-23961: More internal network hosts could have been probed by a malicious webpage
* CVE-2021-23999: Blob URLs may have been granted additional privileges
* CVE-2021-24002: Arbitrary FTP command execution on FTP servers using an encoded URL
* CVE-2021-29945: Incorrect size computation in WebAssembly JIT could lead to null-reads
This update for MozillaThunderbird fixes the following issues:
- Mozilla Thunderbird was updated to version 78.9.1 (MFSA 2021-12,MFSA 2021-13, bsc#1183942, bsc#1184536)
* CVE-2021-23981: Texture upload into an unbound backing buffer resulted in an out-of-bound read
* CVE-2021-23982: Internal network hosts could have been probed by a malicious webpage
* CVE-2021-23984: Malicious extensions could have spoofed popup information
* CVE-2021-23987: Memory safety bugs
* CVE-2021-23991: An attacker may use Thunderbird's OpenPGP key refresh mechanism to poison an existing key
* CVE-2021-23993: Inability to send encrypted OpenPGP email aft
This update for MozillaThunderbird fixes the following issues:
- Mozilla Thunderbird 78.8
* fixed: Importing an address book from a CSV file always reported an error
* fixed: Security information for S/MIME messages was not displayed correctly prior to a draft being saved
* fixed: Calendar: FileLink UI fixes for Caldav calendars
* fixed: Recurring tasks were always marked incomplete; unable to use filters
* fixed: Various UI widgets not working
* fixed: Dark theme improvements
* fixed: Extension manager was missing link to addon support web page
* fixed: Various security fixes
MFSA 2021-09 (bsc#1182614)
* CVE-2021-23969:
This update for MozillaThunderbird fixes the following issues:
- Mozilla Thunderbird was updated to 78.7.0 ESR (MFSA 2021-05, bsc#1181414)
* CVE-2021-23953: Fixed a Cross-origin information leakage via redirected PDF requests
* CVE-2021-23954: Fixed a type confusion when using logical assignment operators in JavaScript switch statements
* CVE-2020-26976: Fixed an issue where HTTPS pages could have been intercepted by a registered service worker when they should not have been
* CVE-2021-23960: Fixed a use-after-poison for incorrectly redeclared JavaScript variables during GC
* CVE-2021-23964: Fixed Memory safety bugs
* CVE-2020-1
This update for MozillaThunderbird fixes the following issues:
- Mozilla Thunderbird 78.6.1
* changed: MailExtensions: browserAction, composeAction, and
messageDisplayAction toolbar buttons now support label and
default_label properties (bmo#1583478)
* fixed: Running a quicksearch that returned no results did not
offer to re-run as a global search (bmo#1663153)
* fixed: Message search toolbar fixes (bmo#1681010)
* fixed: Very long subject lines distorted the message compose
and display windows, making them unusable (bmo#77806)
* fixed: Compose window: Recipient addresses that had not yet
been autocompleted were
This update for MozillaThunderbird fixes the following issues:
- Mozilla Thunderbird 78.6
* new: MailExtensions: Added
browser.windows.openDefaultBrowser() (bmo#1664708)
* changed: Thunderbird now only shows quota exceeded
indications on the main window (bmo#1671748)
* changed: MailExtensions: menus API enabled in messages being
composed (bmo#1670832)
* changed: MailExtensions: Honor allowScriptsToClose argument
in windows.create API function (bmo#1675940)
* changed: MailExtensions: APIs that returned an accountId will
reflect the account the message belongs to, not what is
stored in message headers (bmo#164
This update for MozillaThunderbird fixes the following issues:
TODO
- Mozilla Thunderbird 78.5.0
* new: OpenPGP: Added option to disable attaching the public
key to a signed message (bmo#1654950)
* new: MailExtensions: 'compose_attachments' context added to
Menus API (bmo#1670822)
* new: MailExtensions: Menus API now available on displayed
messages (bmo#1670825)
* changed: MailExtensions: browser.tabs.create will now wait
for 'mail-delayed-startup-finished' event (bmo#1674407)
* fixed: OpenPGP: Support for inline PGP messages improved
(bmo#1672851)
* fixed: OpenPGP: Message security dialog showed unverifie
This update for MozillaThunderbird fixes the following issues:
- Mozilla Thunderbird 78.4.2
MFSA 2020-49 (bsc#1178611)
* CVE-2020-26950 (bmo#1675905)
Write side effects in MCallGetProperty opcode not accounted
for
- Mozilla Thunderbird 78.4.1
* new: Thunderbird prompts for an address to use when starting
an email from an address book entry with multiple addresses
(bmo#84028)
* fixed: Searching global search results did not work
(bmo#1664761)
* fixed: Link location was not focused by default when adding a
hyperlink in message composer (bmo#1670660)
* fixed: Advanced address book search dialog was unusable
Security update for MozillaThunderbird and mozilla-nspr
This update for MozillaThunderbird and mozilla-nspr fixes the following issues:
- Mozilla Thunderbird 78.4
* new: MailExtensions: browser.tabs.sendMessage API added
* new: MailExtensions: messageDisplayScripts API added
* changed: Yahoo and AOL mail users using password authentication will be migrated to OAuth2
* changed: MailExtensions: messageDisplay APIs extended to support multiple selected messages
* changed: MailExtensions: compose.begin functions now support creating a message with attachments
* fixed: Thunderbird could freeze when updating global search index
* fixed: Multiple issues with handling of self-signed SSL cer
This update for MozillaThunderbird fixes the following issues:
- Mozilla Thunderbird was updated to 68.12 (bsc#1175686)
- CVE-2020-15663: Downgrade attack on the Mozilla Maintenance Service could
have resulted in escalation of privilege
- CVE-2020-15664: Attacker-induced prompt for extension installation
- CVE-2020-15669: Use-After-Free when aborting an operation
This update for MozillaThunderbird fixes the following issues:
- Updated to Mozilla Thunderbird 68.11:
* Fixed various security issues (MFSA-2020-35, bsc#1174538).
* Fixed CVE-2020-15652: Potential leak of redirect targets when loading scripts in a worker (bsc#1174538).
* Fixed CVE-2020-6514: WebRTC data channel leaks internal address to peer (bsc#1174538).
* Fixed CVE-2020-6463: Use-after-free in ANGLE gl::Texture::onUnbindAsSamplerTexture (bsc#1174538).
* Fixed CVE-2020-15659: Memory safety bugs fixed in Thunderbird 68.11 (bsc#1174538).
* Fixed a bug with FileLink attachments included as a link and file when added from a networ
This update for MozillaThunderbird to version 68.10.0 ESR fixes the following issues:
- CVE-2020-12417: Memory corruption due to missing sign-extension for ValueTags on ARM64 (bsc#1173576).
- CVE-2020-12418: Information disclosure due to manipulated URL object (bsc#1173576).
- CVE-2020-12419: Use-after-free in nsGlobalWindowInner (bsc#1173576).
- CVE-2020-12420: Use-After-Free when trying to connect to a STUN server (bsc#1173576).
- CVE-2020-12421: Add-On updates did not respect the same certificate trust rules as software updates (bsc#1173576).
This update for MozillaThunderbird fixes the following issues:
Mozilla Thunderbird 68.9.0 (bsc#1172402)
- CVE-2020-12405: Fixed a use-after-free in SharedWorkerService.
- CVE-2020-12406: Fixed a JavaScript Type confusion with NativeTypes.
- CVE-2020-12410: Fixed multiple memory safety issues
- CVE-2020-12398: Fixed a potential information leak due to security downgrade
with IMAP STARTTLS
- Use a symbolic icon from branding internals