SUSE-SU-2020:3528-1

See a problem?
Please try reporting it to the source first.

Source

https://www.suse.com/support/update/announcement/2020/suse-su-20203528-1/

Import Source

https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2020:3528-1.json

JSON Data

https://api.osv.dev/v1/vulns/SUSE-SU-2020:3528-1

Related

Published

2020-11-26T10:52:39Z

Modified

2020-11-26T10:52:39Z

Summary

Security update for MozillaThunderbird

Details

This update for MozillaThunderbird fixes the following issues:

TODO

- Mozilla Thunderbird 78.5.0 * new: OpenPGP: Added option to disable attaching the public key to a signed message (bmo#1654950) * new: MailExtensions: 'compose_attachments' context added to Menus API (bmo#1670822) * new: MailExtensions: Menus API now available on displayed messages (bmo#1670825) * changed: MailExtensions: browser.tabs.create will now wait for 'mail-delayed-startup-finished' event (bmo#1674407) * fixed: OpenPGP: Support for inline PGP messages improved (bmo#1672851) * fixed: OpenPGP: Message security dialog showed unverified keys as unavailable (bmo#1675285) * fixed: Chat: New chat contact menu item did not function (bmo#1663321) * fixed: Various theme and usability improvements (bmo#1673861) * fixed: Various security fixes MFSA 2020-52 (bsc#1178894) * CVE-2020-26951 (bmo#1667113) Parsing mismatches could confuse and bypass security sanitizer for chrome privileged code * CVE-2020-16012 (bmo#1642028) Variable time processing of cross-origin images during drawImage calls * CVE-2020-26953 (bmo#1656741) Fullscreen could be enabled without displaying the security UI * CVE-2020-26956 (bmo#1666300) XSS through paste (manual and clipboard API) * CVE-2020-26958 (bmo#1669355) Requests intercepted through ServiceWorkers lacked MIME type restrictions * CVE-2020-26959 (bmo#1669466) Use-after-free in WebRequestService * CVE-2020-26960 (bmo#1670358) Potential use-after-free in uses of nsTArray * CVE-2020-15999 (bmo#1672223) Heap buffer overflow in freetype * CVE-2020-26961 (bmo#1672528) DoH did not filter IPv4 mapped IP Addresses * CVE-2020-26965 (bmo#1661617) Software keyboards may have remembered typed passwords * CVE-2020-26966 (bmo#1663571) Single-word search queries were also broadcast to local network * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697, bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479, bmo#1671923) Memory safety bugs fixed in Thunderbird 78.5

Mozilla Thunderbird 78.4.3
- fixed: User interface was inconsistent when switching from the default theme to the dark theme and back to the default theme (bmo#1659282)
- fixed: Email subject would disappear when hovering over it with the mouse when using Windows 7 Classic theme (bmo#1675970)

References

Affected packages

SUSE:Linux Enterprise Workstation Extension 15 SP1 / MozillaThunderbird

Package

Name: MozillaThunderbird
Purl: purl:rpm/suse/MozillaThunderbird&distro=SUSE%20Linux%20Enterprise%20Workstation%20Extension%2015%20SP1

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

78.5.0-3.107.1

Ecosystem specific

{
    "binaries": [
        {
            "MozillaThunderbird": "78.5.0-3.107.1",
            "MozillaThunderbird-translations-other": "78.5.0-3.107.1",
            "MozillaThunderbird-translations-common": "78.5.0-3.107.1"
        }
    ]
}

SUSE:Linux Enterprise Workstation Extension 15 SP2 / MozillaThunderbird

Package

Name: MozillaThunderbird
Purl: purl:rpm/suse/MozillaThunderbird&distro=SUSE%20Linux%20Enterprise%20Workstation%20Extension%2015%20SP2

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

78.5.0-3.107.1

Ecosystem specific

{
    "binaries": [
        {
            "MozillaThunderbird": "78.5.0-3.107.1",
            "MozillaThunderbird-translations-other": "78.5.0-3.107.1",
            "MozillaThunderbird-translations-common": "78.5.0-3.107.1"
        }
    ]
}