Mageia: 2023-0034 Moderate: Thunderbird File Access Threats
mageia
February 7, 2023
libusrsctp library out of date
Summary
libusrsctp library out of date. (CVE-2022-46871)
Arbitrary file read from GTK drag and drop on Linux. (CVE-2023-23598)
URL being dragged from cross-origin iframe into same tab triggersnavigation. (CVE-2023-23601)
Content Security Policy wasn't being correctly applied to WebSockets in
WebWorkers. (CVE-2023-23602)
Fullscreen notification bypass. (CVE-2022-46877)
Calls to console.log allowed bypasing Content Security Policy
via format directive. (CVE-2023-23603)
Memory safety bugs fixed in Thunderbird 102.7. (CVE-2023-23605)
Revocation status of S/Mime signature certificates was not checked.
(CVE-2023-0430)
References
- https://bugs.mageia.org/show_bug.cgi?id=31438
- https://www.thunderbird.net/en-US/thunderbird/102.7.0/releasenotes/
- https://www.thunderbird.net/en-US/thunderbird/102.7.1/releasenotes/
- https://www.mozilla.org/en-US/security/advisories/mfsa2023-03/
- https://www.mozilla.org/en-US/security/advisories/mfsa2023-04/
- https://access.redhat.com/errata/RHSA-2023:0463
- https://access.redhat.com/errata/RHSA-2023:0456
- https://www.cve.org/CVERecord?id=CVE-2022-46871
- https://www.cve.org/CVERecord?id=CVE-2022-46877
- https://www.cve.org/CVERecord?id=CVE-2023-0430
- https://www.cve.org/CVERecord?id=CVE-2023-23598
- https://www.cve.org/CVERecord?id=CVE-2023-23601
- https://www.cve.org/CVERecord?id=CVE-2023-23602
- https://www.cve.org/CVERecord?id=CVE-2023-23603
- https://www.cve.org/CVERecord?id=CVE-2023-23605
Topics Covered
Resolution
SRPMS
- 8/core/thunderbird-102.7.1-1.mga8
- 8/core/thunderbird-l10n-102.7.1-1.mga8
PREVIOUS
NEXT
Publication date: 07 Feb 2023
URL: https://advisories.mageia.org/MGASA-2023-0034.html
Type: security
CVE: CVE-2022-46871,
CVE-2022-46877,
CVE-2023-0430,
CVE-2023-23598,
CVE-2023-23601,
CVE-2023-23602,
CVE-2023-23603,
CVE-2023-23605
Topics Covered
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Related News
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!