Alerts This Week
Warning Icon 1 764
Alerts This Week
Warning Icon 1 764

openSUSE: 2023:4016-1 Critical: MozillaThunderbird Multiple Security Issues

opensuse
Calendar Grey October 9, 2023
Dist Opensuse Esm H88
Apply this essential MozillaThunderbird patch for openSUSE to resolve several significant security vulnerabilities promptly and efficiently.
This update for MozillaThunderbird fixes the following issues: Security fixes: \- CVE-2023-5217: Fixed a heap buffer overflow in libvpx

Description

This update for MozillaThunderbird fixes the following issues:

Security fixes: \- CVE-2023-5217: Fixed a heap buffer overflow in libvpx.

(bsc#1215814) \- CVE-2023-5168: Out-of-bounds write in FilterNodeD2D1.

(bsc#1215575) \- CVE-2023-5169: Out-of-bounds write in PathOps. (bsc#1215575) \-

CVE-2023-5171: Use-after-free in Ion Compiler. (bsc#1215575) \- CVE-2023-5174:

Double-free in process spawning on Windows. (bsc#1215575) \- CVE-2023-5176:

Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3, and Thunderbird

115.3. (bsc#1215575)

Other fixes:

* Mozilla Thunderbird 115.3.1

* fixed: In Unified Folders view, some folders had incorrect unified folder

parent (bmo#1852525)

* fixed: "Edit message as new" did not restore encrypted subject from selected

message (bmo#1788534)

* fixed: Importing some CalDAV calendars with yearly recurrence events caused

Thunderbird to freeze (bmo#1850732)

* fixed: Security fixes MFSA 2023-44 (bsc#1215814)

* CVE-2023-5217...

Read the Full Advisory

Topics%20covered

Topics Covered

security advisory critical issue heap overflow memory safety openSUSE MozillaThunderbird out-of-bounds write

Patch

## Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like

YaST online_update or "zypper patch".

Alternatively you can run the command listed for your product:

* openSUSE Leap 15.4

zypper in -t patch openSUSE-SLE-15.4-2023-4016=1

* openSUSE Leap 15.5

zypper in -t patch openSUSE-SLE-15.5-2023-4016=1

* SUSE Package Hub 15 15-SP4

zypper in -t patch SUSE-SLE-Module-Packagehub-Subpackages-15-SP4-2023-4016=1

* SUSE Package Hub 15 15-SP5

zypper in -t patch SUSE-SLE-Module-Packagehub-Subpackages-15-SP5-2023-4016=1

* SUSE Linux Enterprise Workstation Extension 15 SP4

zypper in -t patch SUSE-SLE-Product-WE-15-SP4-2023-4016=1

* SUSE Linux Enterprise Workstation Extension 15 SP5

zypper in -t patch SUSE-SLE-Product-WE-15-SP5-2023-4016=1

Package List

* openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64)

* MozillaThunderbird-debuginfo-115.3.1-150200.8.133.1

* MozillaThunderbird-translations-other-115.3.1-150200.8.133.1

* MozillaThunderbird-translations-common-115.3.1-150200.8.133.1

* MozillaThunderbird-debugsource-115.3.1-150200.8.133.1

* MozillaThunderbird-115.3.1-150200.8.133.1

* openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64)

* MozillaThunderbird-debuginfo-115.3.1-150200.8.133.1

* MozillaThunderbird-translations-other-115.3.1-150200.8.133.1

* MozillaThunderbird-translations-common-115.3.1-150200.8.133.1

* MozillaThunderbird-debugsource-115.3.1-150200.8.133.1

* MozillaThunderbird-115.3.1-150200.8.133.1

* SUSE Package Hub 15 15-SP4 (aarch64 ppc64le s390x)

* MozillaThunderbird-debuginfo-115.3.1-150200.8.133.1

* MozillaThunderbird-translations-other-115.3.1-150200.8.133.1

* MozillaThunderbird-translations-common-115.3.1-150200.8.133.1

* MozillaThunderbird-debugsource-115.3.1-150200.8.133.1

* MozillaThunderbird-115.3.1-150200.8.133.1

* SUSE Package...

Read the Full Advisory

References

* #1210168

* #1215309

* #1215575

* #1215814

## References:

* https://www.suse.com/security/cve/CVE-2023-5168.html

* https://www.suse.com/security/cve/CVE-2023-5169.html

* https://www.suse.com/security/cve/CVE-2023-5171.html

* https://www.suse.com/security/cve/CVE-2023-5174.html

* https://www.suse.com/security/cve/CVE-2023-5176.html

* https://www.suse.com/security/cve/CVE-2023-5217.html

* https://bugzilla.suse.com/show_bug.cgi?id=1210168

* https://bugzilla.suse.com/show_bug.cgi?id=1215309

* https://bugzilla.suse.com/show_bug.cgi?id=1215575

* https://bugzilla.suse.com/show_bug.cgi?id=1215814

Severity
critical
Lowest
Low
Medium
High
Critical

Announcement ID: SUSE-SU-2023:4016-1
Rating: critical

Topics%20covered

Topics Covered

security advisory critical issue heap overflow memory safety openSUSE MozillaThunderbird out-of-bounds write

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here