openSUSE-SU-2020:2187-1

See a problem?
Import Source
https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2020:2187-1.json
JSON Data
https://api.test.osv.dev/v1/vulns/openSUSE-SU-2020:2187-1
Upstream
  • CVE-2020-26966
Related
Published
2020-12-07T11:05:31Z
Modified
2026-03-11T07:32:49Z
Summary
Security update for MozillaThunderbird
Details

This update for MozillaThunderbird fixes the following issues:

TODO

  • Mozilla Thunderbird 78.5.0

    • new: OpenPGP: Added option to disable attaching the public key to a signed message (bmo#1654950)
    • new: MailExtensions: 'compose_attachments' context added to Menus API (bmo#1670822)
    • new: MailExtensions: Menus API now available on displayed messages (bmo#1670825)
    • changed: MailExtensions: browser.tabs.create will now wait for 'mail-delayed-startup-finished' event (bmo#1674407)
    • fixed: OpenPGP: Support for inline PGP messages improved (bmo#1672851)
    • fixed: OpenPGP: Message security dialog showed unverified keys as unavailable (bmo#1675285)
    • fixed: Chat: New chat contact menu item did not function (bmo#1663321)
    • fixed: Various theme and usability improvements (bmo#1673861)
    • fixed: Various security fixes MFSA 2020-52 (bsc#1178894)
    • CVE-2020-26951 (bmo#1667113) Parsing mismatches could confuse and bypass security sanitizer for chrome privileged code
    • CVE-2020-16012 (bmo#1642028) Variable time processing of cross-origin images during drawImage calls
    • CVE-2020-26953 (bmo#1656741) Fullscreen could be enabled without displaying the security UI
    • CVE-2020-26956 (bmo#1666300) XSS through paste (manual and clipboard API)
    • CVE-2020-26958 (bmo#1669355) Requests intercepted through ServiceWorkers lacked MIME type restrictions
    • CVE-2020-26959 (bmo#1669466) Use-after-free in WebRequestService
    • CVE-2020-26960 (bmo#1670358) Potential use-after-free in uses of nsTArray
    • CVE-2020-15999 (bmo#1672223) Heap buffer overflow in freetype
    • CVE-2020-26961 (bmo#1672528) DoH did not filter IPv4 mapped IP Addresses
    • CVE-2020-26965 (bmo#1661617) Software keyboards may have remembered typed passwords
    • CVE-2020-26966 (bmo#1663571) Single-word search queries were also broadcast to local network
    • CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697, bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479, bmo#1671923) Memory safety bugs fixed in Thunderbird 78.5

  • Mozilla Thunderbird 78.4.3

    • fixed: User interface was inconsistent when switching from the default theme to the dark theme and back to the default theme (bmo#1659282)
    • fixed: Email subject would disappear when hovering over it with the mouse when using Windows 7 Classic theme (bmo#1675970)

This update was imported from the SUSE:SLE-15:Update update project.

References

Affected packages

openSUSE:Leap 15.1 / MozillaThunderbird

Package

Name
MozillaThunderbird
Purl
pkg:rpm/opensuse/MozillaThunderbird&distro=openSUSE%20Leap%2015.1

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
78.5.0-lp151.2.59.1

Ecosystem specific 

{
    "binaries":  [
        {
            "MozillaThunderbird":  "78.5.0-lp151.2.59.1",
            "MozillaThunderbird-translations-common":  "78.5.0-lp151.2.59.1",
            "MozillaThunderbird-translations-other":  "78.5.0-lp151.2.59.1"
        }
    ]
}

Database specific

source 
"https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2020:2187-1.json"