openSUSE: 2020:2324-1 critical: MozillaThunderbird

An update that fixes 8 vulnerabilities is now available.

   openSUSE Security Update: Security update for MozillaThunderbird
______________________________________________________________________________

Announcement ID:    openSUSE-SU-2020:2324-1
Rating:             critical
References:         #1180039 
Cross-References:   CVE-2020-16042 CVE-2020-26971 CVE-2020-26973
                    CVE-2020-26974 CVE-2020-26978 CVE-2020-35111
                    CVE-2020-35112 CVE-2020-35113
Affected Products:
                    openSUSE Leap 15.1
______________________________________________________________________________

   An update that fixes 8 vulnerabilities is now available.

Description:

   This update for MozillaThunderbird fixes the following issues:

   - Mozilla Thunderbird 78.6
     * new: MailExtensions: Added browser.windows.openDefaultBrowser()
       (bmo#1664708)
     * changed: Thunderbird now only shows quota exceeded indications on the
       main window (bmo#1671748)
     * changed: MailExtensions: menus API enabled in messages being composed
       (bmo#1670832)
     * changed: MailExtensions: Honor allowScriptsToClose argument in
       windows.create API function (bmo#1675940)
     * changed: MailExtensions: APIs that returned an accountId will reflect
       the account the message belongs to, not what is stored in message
       headers (bmo#1644032)
     * fixed: Keyboard shortcut for toggling message "read" status not shown
       in menus (bmo#1619248)
     * fixed: OpenPGP: After importing a secret key, Key Manager displayed
       properties of the wrong key (bmo#1667054)
     * fixed: OpenPGP: Inline PGP parsing improvements (bmo#1660041)
     * fixed: OpenPGP: Discovering keys online via Key Manager sometimes
       failed on Linux (bmo#1634053)
     * fixed: OpenPGP: Encrypted attachment "Decrypt and Open/Save As" did
       not work (bmo#1663169)
     * fixed: OpenPGP: Importing keys failed on macOS (bmo#1680757)
     * fixed: OpenPGP: Verification of clear signed UTF-8 text failed
       (bmo#1679756)
     * fixed: Address book: Some columns incorrectly displayed no data
       (bmo#1631201)
     * fixed: Address book: The address book view did not update after
       changing the name format in the menu (bmo#1678555)
     * fixed: Calendar: Could not import an ICS file into a CalDAV calendar
       (bmo#1652984)
     * fixed: Calendar: Two "Home" calendars were visible on a new profile
       (bmo#1656782)
     * fixed: Calendar: Dark theme was incomplete on Linux (bmo#1655543)
     * fixed: Dark theme did not apply to new mail notification popups
       (bmo#1681083)
     * fixed: Folder icon, message list, and contact side bar visual
       improvements (bmo#1679436)
     * fixed: MailExtensions: HTTP refresh in browser content tabs did not
       work (bmo#1667774)
     * fixed: MailExtensions: messageDisplayScripts failed to run in main
       window (bmo#1674932)
     * fixed: Various security fixes MFSA 2020-56 (bsc#1180039)
     * CVE-2020-16042 (bmo#1679003) Operations on a BigInt could have caused
       uninitialized memory to be exposed
     * CVE-2020-26971 (bmo#1663466) Heap buffer overflow in WebGL
     * CVE-2020-26973 (bmo#1680084) CSS Sanitizer performed incorrect
       sanitization
     * CVE-2020-26974 (bmo#1681022) Incorrect cast of StyleGenericFlexBasis
       resulted in a heap use-after-free
     * CVE-2020-26978 (bmo#1677047) Internal network hosts could have been
       probed by a malicious webpage
     * CVE-2020-35111 (bmo#1657916) The proxy.onRequest API did not catch
       view-source URLs
     * CVE-2020-35112 (bmo#1661365) Opening an extension-less download may
       have inadvertently launched an executable instead
     * CVE-2020-35113 (bmo#1664831, bmo#1673589) Memory safety bugs fixed in
       Thunderbird 78.6

   This update was imported from the SUSE:SLE-15:Update update project.


Patch Instructions:

   To install this openSUSE Security Update use the SUSE recommended installation methods
   like YaST online_update or "zypper patch".

   Alternatively you can run the command listed for your product:

   - openSUSE Leap 15.1:

      zypper in -t patch openSUSE-2020-2324=1



Package List:

   - openSUSE Leap 15.1 (x86_64):

      MozillaThunderbird-78.6.0-lp151.2.63.1
      MozillaThunderbird-debuginfo-78.6.0-lp151.2.63.1
      MozillaThunderbird-debugsource-78.6.0-lp151.2.63.1
      MozillaThunderbird-translations-common-78.6.0-lp151.2.63.1
      MozillaThunderbird-translations-other-78.6.0-lp151.2.63.1


References:

   https://www.suse.com/security/cve/CVE-2020-16042.html
   https://www.suse.com/security/cve/CVE-2020-26971.html
   https://www.suse.com/security/cve/CVE-2020-26973.html
   https://www.suse.com/security/cve/CVE-2020-26974.html
   https://www.suse.com/security/cve/CVE-2020-26978.html
   https://www.suse.com/security/cve/CVE-2020-35111.html
   https://www.suse.com/security/cve/CVE-2020-35112.html
   https://www.suse.com/security/cve/CVE-2020-35113.html
   https://bugzilla.suse.com/1180039
_______________________________________________
openSUSE Security Announce mailing list -- This email address is being protected from spambots. You need JavaScript enabled to view it.
To unsubscribe, email This email address is being protected from spambots. You need JavaScript enabled to view it.
List Netiquette: https://en.opensuse.org/openSUSE:Mailing_list_netiquette
List Archives: https://lists.opensuse.org/archives/list/This email address is being protected from spambots. You need JavaScript enabled to view it.