-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

====================================================================                   Red Hat Security Advisory

Synopsis:          Important: thunderbird security update
Advisory ID:       RHSA-2020:2615-01
Product:           Red Hat Enterprise Linux
Advisory URL:      https://access.redhat.com/errata/RHSA-2020:2615
Issue date:        2020-06-22
CVE Names:         CVE-2020-12398 CVE-2020-12405 CVE-2020-12406 
                   CVE-2020-12410 
====================================================================
1. Summary:

An update for thunderbird is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat Enterprise Linux Client (v. 7) - x86_64
Red Hat Enterprise Linux Server Optional (v. 7) - ppc64le, x86_64
Red Hat Enterprise Linux Workstation (v. 7) - x86_64

3. Description:

Mozilla Thunderbird is a standalone mail and newsgroup client.

This update upgrades Thunderbird to version 68.9.0.

Security Fix(es):

* Mozilla: Security downgrade with IMAP STARTTLS leads to information
leakage (CVE-2020-12398)

* Mozilla: Use-after-free in SharedWorkerService (CVE-2020-12405)

* Mozilla: JavaScript Type confusion with NativeTypes (CVE-2020-12406)

* Mozilla: Memory safety bugs fixed in Firefox 77 and Firefox ESR 68.9
(CVE-2020-12410)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.

4. Solution:

For details on how to apply this update, which includes the changes
described in this advisory, refer to:

https://access.redhat.com/articles/11258

All running instances of Thunderbird must be restarted for the update to
take effect.

5. Bugs fixed (https://bugzilla.redhat.com/):

1843030 - CVE-2020-12410 Mozilla: Memory safety bugs fixed in Firefox 77 and Firefox ESR 68.9
1843312 - CVE-2020-12406 Mozilla: JavaScript Type confusion with NativeTypes
1843313 - CVE-2020-12405 Mozilla: Use-after-free in SharedWorkerService
1846556 - CVE-2020-12398 Mozilla: Security downgrade with IMAP STARTTLS leads to information leakage

6. Package List:

Red Hat Enterprise Linux Client (v. 7):

Source:
thunderbird-68.9.0-1.el7_8.src.rpm

x86_64:
thunderbird-68.9.0-1.el7_8.x86_64.rpm
thunderbird-debuginfo-68.9.0-1.el7_8.x86_64.rpm

Red Hat Enterprise Linux Server Optional (v. 7):

Source:
thunderbird-68.9.0-1.el7_8.src.rpm

ppc64le:
thunderbird-68.9.0-1.el7_8.ppc64le.rpm
thunderbird-debuginfo-68.9.0-1.el7_8.ppc64le.rpm

x86_64:
thunderbird-68.9.0-1.el7_8.x86_64.rpm
thunderbird-debuginfo-68.9.0-1.el7_8.x86_64.rpm

Red Hat Enterprise Linux Workstation (v. 7):

Source:
thunderbird-68.9.0-1.el7_8.src.rpm

x86_64:
thunderbird-68.9.0-1.el7_8.x86_64.rpm
thunderbird-debuginfo-68.9.0-1.el7_8.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2020-12398
https://access.redhat.com/security/cve/CVE-2020-12405
https://access.redhat.com/security/cve/CVE-2020-12406
https://access.redhat.com/security/cve/CVE-2020-12410
https://access.redhat.com/security/updates/classification/#important

8. Contact:

The Red Hat security contact is . More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2020 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIVAwUBXvB8RdzjgjWX9erEAQjgihAApy/bFmUFRttiL2sv3ISHPM0uPEXeq8xT
V9wXV3ECYWL8ANr9LOvfy5SlWwDO5Vat+hwqqT21pQvil9Y5WTmweQQxh9OUDOqx
v7un4o4tNbul8RwtRsZxZAvncXOeEoTB0SXfmTiqA5yt9ELdZhawE1Ze4MR4aCRV
AjFQ4VF2unzvJcCPjvXNEoqFxm8sM+hFzKclN4dJ0SJ5WSldm5/Sc7L+zL5ZNU+5
dlds2Vi7ggMJm1/dZz6Rkhr4Iqeee4ektWdoGx/P2A+UUhqAy0dHAt+0kcXLRu6G
QOmr1cNxQeinpnpLCAxIw1uiXFUeBc7zzuOi2rfsE6TaroFJmHE76pkzfYUTS4fc
siE77ZTw2NSHZOuHVKy28HRVbjse7M4vk2B6IJR4hfAHYK/C3CCsIVP1C4s+0AQL
SV6aOsxFAV6k1aMaU3sreeBnc9rWhEgtRE8nYg5s5AVrQoyMAciCTnpWOi2DvFDV
Vn6KaLHSmoQA0bSUDOEKbjewmXbdLLkkXPbDStExyiDfM+Uc7ZoP0wj7SR5ropuH
lUwopvUS8Nchri6o3RBxTz50kMM0imFspPIx8mGOXCwJY5F815kC3rssQ/LP2LwA
gh0GD/8Q8F3jC5w4p+I6xOe8uXHDle7xmFkn1xVdU4y6GUOza2hDgUcMRKkf/PEc
VVLIRYR7RXU=vkE/
-----END PGP SIGNATURE-----

--
RHSA-announce mailing list
RHSA-announce@redhat.com
https://www.redhat.com/mailman/listinfo/rhsa-announce

RedHat: RHSA-2020-2615:01 Important: thunderbird security update

An update for thunderbird is now available for Red Hat Enterprise Linux 7

Summary

Mozilla Thunderbird is a standalone mail and newsgroup client.
This update upgrades Thunderbird to version 68.9.0.
Security Fix(es):
* Mozilla: Security downgrade with IMAP STARTTLS leads to information leakage (CVE-2020-12398)
* Mozilla: Use-after-free in SharedWorkerService (CVE-2020-12405)
* Mozilla: JavaScript Type confusion with NativeTypes (CVE-2020-12406)
* Mozilla: Memory safety bugs fixed in Firefox 77 and Firefox ESR 68.9 (CVE-2020-12410)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.



Summary


Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258
All running instances of Thunderbird must be restarted for the update to take effect.

References

https://access.redhat.com/security/cve/CVE-2020-12398 https://access.redhat.com/security/cve/CVE-2020-12405 https://access.redhat.com/security/cve/CVE-2020-12406 https://access.redhat.com/security/cve/CVE-2020-12410 https://access.redhat.com/security/updates/classification/#important

Package List

Red Hat Enterprise Linux Client (v. 7):
Source: thunderbird-68.9.0-1.el7_8.src.rpm
x86_64: thunderbird-68.9.0-1.el7_8.x86_64.rpm thunderbird-debuginfo-68.9.0-1.el7_8.x86_64.rpm
Red Hat Enterprise Linux Server Optional (v. 7):
Source: thunderbird-68.9.0-1.el7_8.src.rpm
ppc64le: thunderbird-68.9.0-1.el7_8.ppc64le.rpm thunderbird-debuginfo-68.9.0-1.el7_8.ppc64le.rpm
x86_64: thunderbird-68.9.0-1.el7_8.x86_64.rpm thunderbird-debuginfo-68.9.0-1.el7_8.x86_64.rpm
Red Hat Enterprise Linux Workstation (v. 7):
Source: thunderbird-68.9.0-1.el7_8.src.rpm
x86_64: thunderbird-68.9.0-1.el7_8.x86_64.rpm thunderbird-debuginfo-68.9.0-1.el7_8.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/


Severity
Advisory ID: RHSA-2020:2615-01
Product: Red Hat Enterprise Linux
Advisory URL: https://access.redhat.com/errata/RHSA-2020:2615
Issued Date: : 2020-06-22
CVE Names: CVE-2020-12398 CVE-2020-12405 CVE-2020-12406 CVE-2020-12410

Topic

An update for thunderbird is now available for Red Hat Enterprise Linux 7.Red Hat Product Security has rated this update as having a security impactof Important. A Common Vulnerability Scoring System (CVSS) base score,which gives a detailed severity rating, is available for each vulnerabilityfrom the CVE link(s) in the References section.


Topic


 

Relevant Releases Architectures

Red Hat Enterprise Linux Client (v. 7) - x86_64

Red Hat Enterprise Linux Server Optional (v. 7) - ppc64le, x86_64

Red Hat Enterprise Linux Workstation (v. 7) - x86_64


Bugs Fixed

1843030 - CVE-2020-12410 Mozilla: Memory safety bugs fixed in Firefox 77 and Firefox ESR 68.9

1843312 - CVE-2020-12406 Mozilla: JavaScript Type confusion with NativeTypes

1843313 - CVE-2020-12405 Mozilla: Use-after-free in SharedWorkerService

1846556 - CVE-2020-12398 Mozilla: Security downgrade with IMAP STARTTLS leads to information leakage


Related News