An update for thunderbird is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Important: thunderbird security update Advisory ID: RHSA-2020:5624-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2020:5624 Issue date: 2020-12-17 CVE Names: CVE-2020-16042 CVE-2020-26971 CVE-2020-26973 CVE-2020-26974 CVE-2020-26978 CVE-2020-35111 CVE-2020-35113 ==================================================================== 1. Summary: An update for thunderbird is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux AppStream (v. 8) - aarch64, ppc64le, x86_64 3. Description: Mozilla Thunderbird is a standalone mail and newsgroup client. This update upgrades Thunderbird to version 78.6.0. Security Fix(es): * chromium-browser: Uninitialized Use in V8 (CVE-2020-16042) * Mozilla: Heap buffer overflow in WebGL (CVE-2020-26971) * Mozilla: CSS Sanitizer performed incorrect sanitization (CVE-2020-26973) * Mozilla: Incorrect cast of StyleGenericFlexBasis resulted in a heap use-after-free (CVE-2020-26974) * Mozilla: Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6 (CVE-2020-35113) * Mozilla: Internal network hosts could have been probed by a malicious webpage (CVE-2020-26978) *Mozilla: The proxy.onRequest API did not catch view-source URLs (CVE-2020-35111) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 All running instances of Thunderbird must be restarted for the update to take effect. 5. Bugs fixed (https://bugzilla.redhat.com/): 1904515 - CVE-2020-16042 chromium-browser: Uninitialized Use in V8 1908022 - CVE-2020-26971 Mozilla: Heap buffer overflow in WebGL 1908023 - CVE-2020-26973 Mozilla: CSS Sanitizer performed incorrect sanitization 1908024 - CVE-2020-26974 Mozilla: Incorrect cast of StyleGenericFlexBasis resulted in a heap use-after-free 1908025 - CVE-2020-26978 Mozilla: Internal network hosts could have been probed by a malicious webpage 1908027 - CVE-2020-35111 Mozilla: The proxy.onRequest API did not catch view-source URLs 1908029 - CVE-2020-35113 Mozilla: Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6 6. Package List: Red Hat Enterprise Linux AppStream (v. 8): Source: thunderbird-78.6.0-1.el8_3.src.rpm aarch64: thunderbird-78.6.0-1.el8_3.aarch64.rpm thunderbird-debuginfo-78.6.0-1.el8_3.aarch64.rpm thunderbird-debugsource-78.6.0-1.el8_3.aarch64.rpm ppc64le: thunderbird-78.6.0-1.el8_3.ppc64le.rpm thunderbird-debuginfo-78.6.0-1.el8_3.ppc64le.rpm thunderbird-debugsource-78.6.0-1.el8_3.ppc64le.rpm x86_64: thunderbird-78.6.0-1.el8_3.x86_64.rpm thunderbird-debuginfo-78.6.0-1.el8_3.x86_64.rpm thunderbird-debugsource-78.6.0-1.el8_3.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7.References: https://access.redhat.com/security/cve/CVE-2020-16042 https://access.redhat.com/security/cve/CVE-2020-26971 https://access.redhat.com/security/cve/CVE-2020-26973 https://access.redhat.com/security/cve/CVE-2020-26974 https://access.redhat.com/security/cve/CVE-2020-26978 https://access.redhat.com/security/cve/CVE-2020-35111 https://access.redhat.com/security/cve/CVE-2020-35113 https://access.redhat.com/security/updates/classification/#important 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2020 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBX9uGMdzjgjWX9erEAQj6MA//bY/3ndKRUb3DtKb1Ht860cMSG2TCZB63 FwKuRd0NPIMr+MwrOM1Bz38sRDn+Y5Y0GWotJ6C2A7zahSK1g72VbWy9VfLubqW6 NNM3xQ73ef9qejG/T/NSonU4PDojMikUbfH2d4vZJFISDwOuiGrmtq/kBw6RwfQp JQ9LmuEcj9LxMDB6wlKcH/drBWmLOfpbMVDzQv9+f4B7TW3a2zhkzO7+PWxkD8xD mHrR2SaWtFGzJMuB0a5Y6jZTEynJ1SyILDS1ptVE0NIrHMbUu4BOLfeHdg1UqNLP PRPUATlrWc6NeW06vJHTPWb99zsnmTv6XrhSUs+SVX1kUX4i7gAGJxxO+maeKg+A RZySwOX0TIBC5CeQyIRNkzG+g+wdopgVfIhkZGF06I/HZpa2pcsiCAVqXeK/gf15 8MxFcKkb1gML70wo0n5VkAkR3oFjf+7Hi+1H9btvApYVKl73J4n+ZUlcCULT+kCB VqFG6Dr782QZz4iAWYbMI/sJqylqobgRCG0aVRrysNQ5IYzPGi03yG5jHdsf/Rp6 l7F01kRJBoFGe/FdYvWLJTmo5EwEjUpFNwYviIgZJwz2p14kZl7Lnt+qjk8h7X7I 7qS1D7URWonMefrbSo2vkAy1iqta7BfZVzpv8CBYpScAtPdhQ1JyRfJBYaypiTD1 VavDsCfRqsI=ShIU -----END PGP SIGNATURE----- -- RHSA-announce mailing list
Security fix for CVE-2020-14954. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2020-1cb4c3697b 2020-07-03 01:17:34.896862 --------------------------------------------------------------------------------Name : mutt Product : Fedora 32 Version : 1.14.5 Release : 1.fc32 URL : http://www.mutt.org Summary : A text mode mail user agent Description : Mutt is a small but very powerful text-based MIME mail client. Mutt is highly configurable, and is well suited to the mail power user with advanced features like key bindings, keyboard macros, mail threading, regular expression searches and a powerful pattern matching language for selecting groups of messages. --------------------------------------------------------------------------------Update Information: Security fix for CVE-2020-14954 --------------------------------------------------------------------------------ChangeLog: * Wed Jun 24 2020 Fabio Alessandro Locati - 5:1.14.5-1 - Upgrade to 1.14.5 * Fri Jun 19 2020 Fabio Alessandro Locati - 5:1.14.4-1 - Upgrade to 1.14.4 - Resolves: #1848768 --------------------------------------------------------------------------------References: [ 1 ] Bug #1850170 - CVE-2020-14954 mutt: response Injection via STARTTLS in SMTP, POP3 and IMAP https://bugzilla.redhat.com/show_bug.cgi?id=1850170 --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2020-1cb4c3697b' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be foundat --------------------------------------------------------------------------------_______________________________________________ package-announce mailing list --
Get the latest Linux and open source security news straight to your inbox.