openSUSE-SU-2020:1785-1

Mozilla Thunderbird 78.4
- new: MailExtensions: browser.tabs.sendMessage API added
- new: MailExtensions: messageDisplayScripts API added
- changed: Yahoo and AOL mail users using password authentication will be migrated to OAuth2
- changed: MailExtensions: messageDisplay APIs extended to support multiple selected messages
- changed: MailExtensions: compose.begin functions now support creating a message with attachments
- fixed: Thunderbird could freeze when updating global search index
- fixed: Multiple issues with handling of self-signed SSL certificates addressed
- fixed: Recipient address fields in compose window could expand to fill all available space
- fixed: Inserting emoji characters in message compose window caused unexpected behavior
- fixed: Button to restore default folder icon color was not keyboard accessible
- fixed: Various keyboard navigation fixes
- fixed: Various color-related theme fixes
- fixed: MailExtensions: Updating attachments with onBeforeSend.addListener() did not work MFSA 2020-47 (bsc#1177977)
- CVE-2020-15969 Use-after-free in usersctp
- CVE-2020-15683 Memory safety bugs fixed in Thunderbird 78.4
Mozilla Thunderbird 78.3.3
- OpenPGP: Improved support for encrypting with subkeys
- OpenPGP message status icons were not visible in message header pane
- Creating a new calendar event did not require an event title
Mozilla Thunderbird 78.3.2 (bsc#1176899)
- OpenPGP: Improved support for encrypting with subkeys
- OpenPGP: Encrypted messages with international characters were sometimes displayed incorrectly
- Single-click deletion of recipient pills with middle mouse button restored
- Searching an address book list did not display results
- Dark mode, high contrast, and Windows theming fixes
Mozilla Thunderbird 78.3.1
- fix crash in nsImapProtocol::CreateNewLineFromSocket
Mozilla Thunderbird 78.3.0 MFSA 2020-44 (bsc#1176756)
- CVE-2020-15677 Download origin spoofing via redirect
- CVE-2020-15676 XSS when pasting attacker-controlled data into a contenteditable element
- CVE-2020-15678 When recursing through layers while scrolling, an iterator may have become invalid, resulting in a potential use-after- free scenario
- CVE-2020-15673 Memory safety bugs fixed in Thunderbird 78.3
update mozilla-nspr to version 4.25.1
- The macOS platform code for shared library loading was changed to support macOS 11.
- Dependency needed for the MozillaThunderbird udpate

This update was imported from the SUSE:SLE-15:Update update project.

References

Affected packages

openSUSE:Leap 15.1 / MozillaThunderbird

Package

Name: MozillaThunderbird
Purl: pkg:rpm/opensuse/MozillaThunderbird&distro=openSUSE%20Leap%2015.1

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

78.4.0-lp151.2.53.1

Ecosystem specific

{
    "binaries": [
        {
            "MozillaThunderbird": "78.4.0-lp151.2.53.1",
            "MozillaThunderbird-translations-common": "78.4.0-lp151.2.53.1",
            "mozilla-nspr": "4.25.1-lp151.2.13.1",
            "mozilla-nspr-devel": "4.25.1-lp151.2.13.1",
            "mozilla-nspr-32bit": "4.25.1-lp151.2.13.1",
            "MozillaThunderbird-translations-other": "78.4.0-lp151.2.53.1"
        }
    ]
}

openSUSE:Leap 15.1 / mozilla-nspr

Package

Name: mozilla-nspr
Purl: pkg:rpm/opensuse/mozilla-nspr&distro=openSUSE%20Leap%2015.1

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

4.25.1-lp151.2.13.1

Ecosystem specific

{
    "binaries": [
        {
            "MozillaThunderbird": "78.4.0-lp151.2.53.1",
            "MozillaThunderbird-translations-common": "78.4.0-lp151.2.53.1",
            "mozilla-nspr": "4.25.1-lp151.2.13.1",
            "mozilla-nspr-devel": "4.25.1-lp151.2.13.1",
            "mozilla-nspr-32bit": "4.25.1-lp151.2.13.1",
            "MozillaThunderbird-translations-other": "78.4.0-lp151.2.53.1"
        }
    ]
}