openSUSE: 2016:3019-1 Important: MozillaThunderbird Security Risk

This update for MozillaThunderbird fixes some potential security issues

and bugs.

The following security flaws cannot be exploited through email because

scripting is disabled when reading mail, but are potentially risks in

browser or browser-like contexts:

- CVE-2016-9079: SVG Animation Remote Code Execution (MFSA 2016-92,

bsc#1012964)

- CVE-2016-5296: Heap-buffer-overflow WRITE in rasterize_edges_1

(bsc#1010411)

- CVE-2016-5297: Incorrect argument length checking in Javascript

(bsc#1010401)

- CVE-2016-9066: Integer overflow leading to a buffer overflow in

nsScriptLoadHandler (bsc#1010404)

- CVE-2016-5291: Same-origin policy violation using local HTML file and

saved shortcut file (bsc#1010410)

- CVE-2016-5290: Memory safety bugs fixed in Thunderbird ESR 45.5

(bsc#1010427)

The update contains changes in behavior:

- Changed recipient address entry: Arrow-keys now copy the pop-up value to

the input field....