MGASA-2023-0057 - Updated thunderbird packages fix security vulnerability

Publication date: 20 Feb 2023
URL: https://advisories.mageia.org/MGASA-2023-0057.html
Type: security
Affected Mageia releases: 8
CVE: CVE-2023-0616,
     CVE-2023-0767,
     CVE-2023-25728,
     CVE-2023-25729,
     CVE-2023-25730,
     CVE-2023-25732,
     CVE-2023-25735,
     CVE-2023-25737,
     CVE-2023-25739,
     CVE-2023-25742,
     CVE-2023-25746

User Interface lockup with messages combining S/MIME and OpenPGP.
(CVE-2023-0616)

Content security policy leak in violation reports using iframes.
(CVE-2023-25728)

Screen hijack via browser fullscreen mode. (CVE-2023-25730)

Arbitrary memory write via PKCS 12 in NSS. (CVE-2023-0767)

Potential use-after-free from compartment mismatch in SpiderMonkey.
(CVE-2023-25735)

Invalid downcast in SVGUtils::SetupStrokeGeometry. (CVE-2023-25737)

Use-after-free in mozilla::dom::ScriptLoadContext::~ScriptLoadContext.
(CVE-2023-25739)

Extensions could have opened external schemes without user knowledge.
(CVE-2023-25729)

Out of bounds memory write from EncodeInputStream. (CVE-2023-25732)

Web Crypto ImportKey crashes tab. (CVE-2023-25742)

Memory safety bugs fixed in Thunderbird 102.8. (CVE-2023-25746)

References:
- https://bugs.mageia.org/show_bug.cgi?id=31561
- https://www.thunderbird.net/en-US/thunderbird/102.8.0/releasenotes/
- https://www.mozilla.org/en-US/security/advisories/mfsa2023-07/
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-0616
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-0767
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-25728
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-25729
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-25730
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-25732
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-25735
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-25737
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-25739
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-25742
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-25746

SRPMS:
- 8/core/thunderbird-102.8.0-1.mga8
- 8/core/thunderbird-l10n-102.8.0-1.mga8