Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Loading...
Explore Latest Linux Security advisories
We found -6 articles for you...
98
security advisoryRed Hatheap overflowRed Hat Enterprise Linux 8: RHSA-2022:4887-01 Important: Email Bugs
An update for thunderbird is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Important: thunderbird security update Advisory ID: RHSA-2022:4887-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2022:4887 Issue date: 2022-06-03 CVE Names: CVE-2022-1834 CVE-2022-31736 CVE-2022-31737 CVE-2022-31738 CVE-2022-31740 CVE-2022-31741 CVE-2022-31742 CVE-2022-31747 ==================================================================== 1. Summary: An update for thunderbird is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux AppStream (v. 8) - aarch64, ppc64le, s390x, x86_64 3. Description: Mozilla Thunderbird is a standalone mail and newsgroup client. This update upgrades Thunderbird to version 91.10.0. Security Fix(es): * Mozilla: Braille space character caused incorrect sender email to be shown for a digitally signed email (CVE-2022-1834) * Mozilla: Cross-Origin resource's length leaked (CVE-2022-31736) * Mozilla: Heap buffer overflow in WebGL (CVE-2022-31737) * Mozilla: Browser window spoof using fullscreen mode (CVE-2022-31738) * Mozilla: Register allocation problem in WASM on arm64 (CVE-2022-31740) * Mozilla: Uninitialized variable leads to invalid memoryread (CVE-2022-31741) * Mozilla: Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10 (CVE-2022-31747) * Mozilla: Querying a WebAuthn token with a large number of allowCredential entries may have leaked cross-origin information (CVE-2022-31742) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 All running instances of Thunderbird must be restarted for the update to take effect. 5. Bugs fixed (https://bugzilla.redhat.com/): 2092018 - CVE-2022-31736 Mozilla: Cross-Origin resource's length leaked 2092019 - CVE-2022-31737 Mozilla: Heap buffer overflow in WebGL 2092021 - CVE-2022-31738 Mozilla: Browser window spoof using fullscreen mode 2092023 - CVE-2022-31740 Mozilla: Register allocation problem in WASM on arm64 2092024 - CVE-2022-31741 Mozilla: Uninitialized variable leads to invalid memory read 2092025 - CVE-2022-31742 Mozilla: Querying a WebAuthn token with a large number of allowCredential entries may have leaked cross-origin information 2092026 - CVE-2022-31747 Mozilla: Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10 2092416 - CVE-2022-1834 Mozilla: Braille space character caused incorrect sender email to be shown for a digitally signed email 6. Package List: Red Hat Enterprise Linux AppStream (v.8): Source: thunderbird-91.10.0-1.el8_6.src.rpm aarch64: thunderbird-91.10.0-1.el8_6.aarch64.rpm thunderbird-debuginfo-91.10.0-1.el8_6.aarch64.rpm thunderbird-debugsource-91.10.0-1.el8_6.aarch64.rpm ppc64le: thunderbird-91.10.0-1.el8_6.ppc64le.rpm thunderbird-debuginfo-91.10.0-1.el8_6.ppc64le.rpm thunderbird-debugsource-91.10.0-1.el8_6.ppc64le.rpm s390x: thunderbird-91.10.0-1.el8_6.s390x.rpm thunderbird-debuginfo-91.10.0-1.el8_6.s390x.rpm thunderbird-debugsource-91.10.0-1.el8_6.s390x.rpm x86_64: thunderbird-91.10.0-1.el8_6.x86_64.rpm thunderbird-debuginfo-91.10.0-1.el8_6.x86_64.rpm thunderbird-debugsource-91.10.0-1.el8_6.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key 7. References: https://access.redhat.com/security/cve/CVE-2022-1834 https://access.redhat.com/security/cve/CVE-2022-31736 https://access.redhat.com/security/cve/CVE-2022-31737 https://access.redhat.com/security/cve/CVE-2022-31738 https://access.redhat.com/security/cve/CVE-2022-31740 https://access.redhat.com/security/cve/CVE-2022-31741 https://access.redhat.com/security/cve/CVE-2022-31742 https://access.redhat.com/security/cve/CVE-2022-31747 https://access.redhat.com/security/updates/classification#important 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact Copyright 2022 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPGv1 iQIVAwUBYpp1ktzjgjWX9erEAQgiMA/+KBViY5emF6OCnnfQ7QrCmnVuqyND8QeO YYpv7QHaqe7dlntp07D2BdD6EadT/4f/Irk+SJzcBE3jwMRb6ySWnRBRgzN+YN3p ritAfqzpQ/4gi+eLqRb08VsU/BrW5IUEueqb7MuPmi0Hy2+wBu78tJHlaySRpOi9 aISw2PFdD4P0srAXYxNXXz4THjLGSbfYS8SYx1qt7p3ZC+JIDiq2jrcAin+3Jxu9 4WP1Fzaaieq0sJe6Xf0z9jw4E6B7MWwE4zBYZ1V1rZzQpg3IKgEyarwTkvORSHiC fLyd3eB9yUH/DGSmcglo7N1sMRcPUwaUt9K64fnyW6XrPpm+S02cQ7byZu8ETtLU NWnlXh8ruteJektiIjEOInPlIfYHHKoGo9GjQw77MlUXt6NBKUXa01g225fppyKb Cdt1SnsnCU5+2rVQ7YNf8VvysB8eQMshUsp9j2MnKYEj6/zOChDgqOWm1rf6uP/F SJhW93fv0WLJ37bXPmxPPdK8t3uMHVYT1nMUrQIaY+1C6fdg/vS3ouvN/ISOHpmH Sp4arsaZqgF3XEj85WbDOdKojYbrHdOxsEbOMhAlDxL+P7oeH0kDkvpV55kvDurW bf0jv9mwdW3xx6pZ81kgldwEEt8BeMBRlnLjj36GQRTHueyMYpuEGym6LrWTUnLg +3Y8PPfmnPU=ZARL -----END PGP SIGNATURE----- -- RHSA-announce mailing list
Jun 03, 2022 •Important Red Hat 100
security advisorymoderatebuffer overflowSUSE: 2018:2174-1 Moderate: Mozilla Thunderbird Security Fixes
An update that fixes 11 vulnerabilities is now available. . SUSE Security Update: Security update for Mozilla Thunderbird ______________________________________________________________________________ Announcement ID: SUSE-SU-2018:2174-1 Rating: moderate References: #1076907 #1085780 #1091376 #1098998 #1100079 #1100081 #1100082 #1100780 Cross-References: CVE-2018-12359 CVE-2018-12360 CVE-2018-12362 CVE-2018-12363 CVE-2018-12364 CVE-2018-12365 CVE-2018-12366 CVE-2018-12372 CVE-2018-12373 CVE-2018-12374 CVE-2018-5188 Affected Products: SUSE Linux Enterprise Workstation Extension 15 ______________________________________________________________________________ An update that fixes 11 vulnerabilities is now available. Description: This update for Mozilla Thunderbird to version 52.9.1 fixes multiple issues. Security issues fixed, inherited from the Mozilla common code base (MFSA 2018-16, bsc#1098998): - CVE-2018-12359: Buffer overflow using computed size of canvas element - CVE-2018-12360: Use-after-free when using focus() - CVE-2018-12362: Integer overflow in SSSE3 scaler - CVE-2018-12363: Use-after-free when appending DOM nodes - CVE-2018-12364: CSRF attacks through 307 redirects and NPAPI plugins - CVE-2018-12365: Compromised IPC child process can list local filenames - CVE-2018-12366: Invalid data handling during QCMS transformations - CVE-2018-5188: Memory safety bugs fixed in Thunderbird 52.9.0 Security issues fixed that affect e-mail privacy and integrity (including EFAIL): - CVE-2018-12372: S/MIME and PGP decryption oracles can be built with HTML emails (bsc#1100082) - CVE-2018-12373: S/MIME plaintext can be leaked through HTML reply/forward (bsc#1100079) - CVE-2018-12374: Using form to exfiltrate encrypted mail part by pressing enter in form field (bsc#1100081) The following options are availablefor added security in certain scenarios: - Option for not decrypting subordinate message parts that otherwise might reveal decryted content to the attacker. Preference mailnews.p7m_subparts_external needs to be set to true for added security. The following upstream changes are included: - Thunderbird will now prompt to compact IMAP folders even if the account is online - Fix various problems when forwarding messages inline when using "simple" HTML view - Deleting or detaching attachments corrupted messages under certain circumstances (bsc#1100780) The following tracked packaging changes are included: - correct requires and provides handling (boo#1076907) - reduce memory footprint with %ix86 at linking time via additional compiler flags (boo#1091376) - Build from upstream source archive and verify source signature (boo#1085780) Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Workstation Extension 15: zypper in -t patch SUSE-SLE-Product-WE-15-2018-1475=1 Package List: - SUSE Linux Enterprise Workstation Extension 15 (x86_64): MozillaThunderbird-52.9.1-3.7.1 MozillaThunderbird-debuginfo-52.9.1-3.7.1 MozillaThunderbird-debugsource-52.9.1-3.7.1 MozillaThunderbird-devel-52.9.1-3.7.1 MozillaThunderbird-translations-common-52.9.1-3.7.1 MozillaThunderbird-translations-other-52.9.1-3.7.1 References: https://www.suse.com/security/cve/CVE-2018-12359.html https://www.suse.com/security/cve/CVE-2018-12360.html https://www.suse.com/security/cve/CVE-2018-12362.html https://www.suse.com/security/cve/CVE-2018-12363.html https://www.suse.com/security/cve/CVE-2018-12364.html https://www.suse.com/security/cve/CVE-2018-12365.html https://www.suse.com/security/cve/CVE-2018-12366.html https://www.suse.com/security/cve/CVE-2018-12372.html https://www.suse.com/security/cve/CVE-2018-12373.html https://www.suse.com/security/cve/CVE-2018-12374.html https://www.suse.com/security/cve/CVE-2018-5188.html https://bugzilla.suse.com/1076907 https://bugzilla.suse.com/1085780 https://bugzilla.suse.com/1091376 https://bugzilla.suse.com/1098998 https://bugzilla.suse.com/1100079 https://bugzilla.suse.com/1100081 https://bugzilla.suse.com/1100082 https://bugzilla.suse.com/1100780 . SUSE Security Advisory: Mozilla Firefox Update Addressing 12 Vulnerabilities and Improvements.. Mozilla Thunderbird, SUSE Security Update, email security. . LinuxSecurity.com Team
Aug 02, 2018 SuSE 
89
security advisorymoderatefedoraFedora 27: 2018-fd67c19256 Moderate: Thunderbird Enigmail Security Fix
Security fix CVE-2018-12019. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2018-fd67c19256 2018-06-22 14:09:01.795118 --------------------------------------------------------------------------------Name : thunderbird-enigmail Product : Fedora 27 Version : 2.0.7 Release : 1.fc27 URL : https://enigmail.net/index.php/en/ Summary : Authentication and encryption extension for Mozilla Thunderbird Description : Enigmail is an extension to the mail client Mozilla Thunderbird which allows users to access the authentication and encryption features provided by GnuPG --------------------------------------------------------------------------------Update Information: Security fix CVE-2018-12019 --------------------------------------------------------------------------------ChangeLog: * Thu Jun 14 2018 Christian Dersch - 2.0.7-1 - new version * Mon May 28 2018 Christian Dersch - 2.0.6-1 - new version * Sat May 19 2018 Christian Dersch - 2.0.4-1 - new version fixing efail vulnerability * Fri Feb 9 2018 Fedora Release Engineering - 1.9.9-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild * Fri Dec 22 2017 Christian Dersch - 1.9.9-1 - new version --------------------------------------------------------------------------------References: [ 1 ] Bug #1591099 - CVE-2018-12019 thunderbird-enigmail: Signature verification does not handle user ids correctly allowing attackers to spoof arbitrary email signatures [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1591099 --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2018-fd67c19256' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPGkey. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ -------------------------------------------------------------------------------- _______________________________________________ package-announce mailing list --
Jun 22, 2018 •Important Fedora 
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!