Linux Security
    Linux Security
    Linux Security

    openSUSE: 2020:2324-1 critical: MozillaThunderbird

    Date 25 Dec 2020
    424
    Posted By LinuxSecurity Advisories
    An update that fixes 8 vulnerabilities is now available.
    
       openSUSE Security Update: Security update for MozillaThunderbird
    ______________________________________________________________________________
    
    Announcement ID:    openSUSE-SU-2020:2324-1
    Rating:             critical
    References:         #1180039 
    Cross-References:   CVE-2020-16042 CVE-2020-26971 CVE-2020-26973
                        CVE-2020-26974 CVE-2020-26978 CVE-2020-35111
                        CVE-2020-35112 CVE-2020-35113
    Affected Products:
                        openSUSE Leap 15.1
    ______________________________________________________________________________
    
       An update that fixes 8 vulnerabilities is now available.
    
    Description:
    
       This update for MozillaThunderbird fixes the following issues:
    
       - Mozilla Thunderbird 78.6
         * new: MailExtensions: Added browser.windows.openDefaultBrowser()
           (bmo#1664708)
         * changed: Thunderbird now only shows quota exceeded indications on the
           main window (bmo#1671748)
         * changed: MailExtensions: menus API enabled in messages being composed
           (bmo#1670832)
         * changed: MailExtensions: Honor allowScriptsToClose argument in
           windows.create API function (bmo#1675940)
         * changed: MailExtensions: APIs that returned an accountId will reflect
           the account the message belongs to, not what is stored in message
           headers (bmo#1644032)
         * fixed: Keyboard shortcut for toggling message "read" status not shown
           in menus (bmo#1619248)
         * fixed: OpenPGP: After importing a secret key, Key Manager displayed
           properties of the wrong key (bmo#1667054)
         * fixed: OpenPGP: Inline PGP parsing improvements (bmo#1660041)
         * fixed: OpenPGP: Discovering keys online via Key Manager sometimes
           failed on Linux (bmo#1634053)
         * fixed: OpenPGP: Encrypted attachment "Decrypt and Open/Save As" did
           not work (bmo#1663169)
         * fixed: OpenPGP: Importing keys failed on macOS (bmo#1680757)
         * fixed: OpenPGP: Verification of clear signed UTF-8 text failed
           (bmo#1679756)
         * fixed: Address book: Some columns incorrectly displayed no data
           (bmo#1631201)
         * fixed: Address book: The address book view did not update after
           changing the name format in the menu (bmo#1678555)
         * fixed: Calendar: Could not import an ICS file into a CalDAV calendar
           (bmo#1652984)
         * fixed: Calendar: Two "Home" calendars were visible on a new profile
           (bmo#1656782)
         * fixed: Calendar: Dark theme was incomplete on Linux (bmo#1655543)
         * fixed: Dark theme did not apply to new mail notification popups
           (bmo#1681083)
         * fixed: Folder icon, message list, and contact side bar visual
           improvements (bmo#1679436)
         * fixed: MailExtensions: HTTP refresh in browser content tabs did not
           work (bmo#1667774)
         * fixed: MailExtensions: messageDisplayScripts failed to run in main
           window (bmo#1674932)
         * fixed: Various security fixes MFSA 2020-56 (bsc#1180039)
         * CVE-2020-16042 (bmo#1679003) Operations on a BigInt could have caused
           uninitialized memory to be exposed
         * CVE-2020-26971 (bmo#1663466) Heap buffer overflow in WebGL
         * CVE-2020-26973 (bmo#1680084) CSS Sanitizer performed incorrect
           sanitization
         * CVE-2020-26974 (bmo#1681022) Incorrect cast of StyleGenericFlexBasis
           resulted in a heap use-after-free
         * CVE-2020-26978 (bmo#1677047) Internal network hosts could have been
           probed by a malicious webpage
         * CVE-2020-35111 (bmo#1657916) The proxy.onRequest API did not catch
           view-source URLs
         * CVE-2020-35112 (bmo#1661365) Opening an extension-less download may
           have inadvertently launched an executable instead
         * CVE-2020-35113 (bmo#1664831, bmo#1673589) Memory safety bugs fixed in
           Thunderbird 78.6
    
       This update was imported from the SUSE:SLE-15:Update update project.
    
    
    Patch Instructions:
    
       To install this openSUSE Security Update use the SUSE recommended installation methods
       like YaST online_update or "zypper patch".
    
       Alternatively you can run the command listed for your product:
    
       - openSUSE Leap 15.1:
    
          zypper in -t patch openSUSE-2020-2324=1
    
    
    
    Package List:
    
       - openSUSE Leap 15.1 (x86_64):
    
          MozillaThunderbird-78.6.0-lp151.2.63.1
          MozillaThunderbird-debuginfo-78.6.0-lp151.2.63.1
          MozillaThunderbird-debugsource-78.6.0-lp151.2.63.1
          MozillaThunderbird-translations-common-78.6.0-lp151.2.63.1
          MozillaThunderbird-translations-other-78.6.0-lp151.2.63.1
    
    
    References:
    
       https://www.suse.com/security/cve/CVE-2020-16042.html
       https://www.suse.com/security/cve/CVE-2020-26971.html
       https://www.suse.com/security/cve/CVE-2020-26973.html
       https://www.suse.com/security/cve/CVE-2020-26974.html
       https://www.suse.com/security/cve/CVE-2020-26978.html
       https://www.suse.com/security/cve/CVE-2020-35111.html
       https://www.suse.com/security/cve/CVE-2020-35112.html
       https://www.suse.com/security/cve/CVE-2020-35113.html
       https://bugzilla.suse.com/1180039
    _______________________________________________
    openSUSE Security Announce mailing list -- This email address is being protected from spambots. You need JavaScript enabled to view it.
    To unsubscribe, email This email address is being protected from spambots. You need JavaScript enabled to view it.
    List Netiquette: https://en.opensuse.org/openSUSE:Mailing_list_netiquette
    List Archives: https://lists.opensuse.org/archives/list/This email address is being protected from spambots. You need JavaScript enabled to view it.
    

    LinuxSecurity Poll

    'Tis the season of giving! How have you given back to the open-source community?

    No answer selected. Please try again.
    Please select either existing option or enter your own, however not both.
    Please select minimum 0 answer(s) and maximum 3 answer(s).
    /main-polls/49-tis-the-season-of-giving-how-have-you-given-back-to-the-open-source-community?task=poll.vote&format=json
    49
    radio
    [{"id":"171","title":"I've contributed to the development of an open-source project.","votes":"22","type":"x","order":"1","pct":34.92,"resources":[]},{"id":"172","title":"I've reviewed open-source code for security bugs.","votes":"13","type":"x","order":"2","pct":20.63,"resources":[]},{"id":"173","title":"I've made a donation to an open-source project.","votes":"28","type":"x","order":"3","pct":44.44,"resources":[]}] ["#ff5b00","#4ac0f2","#b80028","#eef66c","#60bb22","#b96a9a","#62c2cc"] ["rgba(255,91,0,0.7)","rgba(74,192,242,0.7)","rgba(184,0,40,0.7)","rgba(238,246,108,0.7)","rgba(96,187,34,0.7)","rgba(185,106,154,0.7)","rgba(98,194,204,0.7)"] 350

    Please vote first in order to view vote results.


    VIEW MORE POLLS

    bottom 200

    Please enable / Bitte aktiviere JavaScript!
    Veuillez activer / Por favor activa el Javascript![ ? ]

    We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.