Alerts This Week
Warning Icon 1 727
Alerts This Week
Warning Icon 1 727

SUSE: 2024:4326-1 moderate: MozillaThunderbird path traversal fix

suse
Calendar Grey December 16, 2024
Dist Suse Esm H88
MozillaThunderbird patch release SUSE-SU-2024:4326-1 rectifying a directory traversal vulnerability with a moderate threat level.
* bsc#1234413 Cross-References: * CVE-2024-50336

Summary

## This update for MozillaThunderbird fixes the following issues: * CVE-2024-50336: Fixed insufficient MXC URI validation which could allow client-side path traversal (bsc#1234413) Other fixes: \- Updated to Mozilla Thunderbird 128.5.2i (bsc#1234413): * fixed: Large virtual folders could be very slow * fixed: Message could disappear after moving from IMAP folder followed by Undo and Redo * fixed: XMPP chat did not display messages sent inside a CDATA element * fixed: Selected calendar day did not move forward at midnight * fixed: Today pane agenda sometimes scrolled for no apparent reason * fixed: CalDAV calendars without offline support could degrade start-up performance * fixed: Visual and UX improvements * fixed: Security fixes * Updated to Mozilla Thunderbird 128.5.1: * new: Add end of year donation appeal

Topics%20covered

Topics Covered

security advisory moderate update fix SUSE path traversal MozillaThunderbird

References

* bsc#1234413

Cross-

* CVE-2024-50336

CVSS scores:

* CVE-2024-50336 ( SUSE ): 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

* CVE-2024-50336 ( NVD ): 5.3

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected Products:

* openSUSE Leap 15.5

* openSUSE Leap 15.6

* SUSE Linux Enterprise Desktop 15 SP5

* SUSE Linux Enterprise Desktop 15 SP6

* SUSE Linux Enterprise High Performance Computing 15 SP5

* SUSE Linux Enterprise Micro 5.5

* SUSE Linux Enterprise Real Time 15 SP5

* SUSE Linux Enterprise Real Time 15 SP6

* SUSE Linux Enterprise Server 15 SP5

* SUSE Linux Enterprise Server 15 SP6

* SUSE Linux Enterprise Server for SAP Applications 15 SP5

Announcement ID: SUSE-SU-2024:4326-1
Release Date: 2024-12-16T13:11:21Z
Rating: moderate

Topics%20covered

Topics Covered

security advisory moderate update fix SUSE path traversal MozillaThunderbird

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here