ALSA-2021:5045 - Thunderbird Security Update
Summary
ALSA-2021:5045: Important: thunderbird security update. Affects thunderbird across 2 version ranges.
< 91.4.0-2.el8_5.alma
< 91.4.0-2.el8_5.alma.plus
Fixed in 91.4.0-2.el8_5.alma or 91.4.0-2.el8_5.alma.plus, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Mozilla Thunderbird is a standalone mail and newsgroup client. It provides users with a convenient way to manage their emails and news feeds. Thunderbird is vulnerable to multiple security issues that have been addressed in this update.
Vulnerability Detail
The updated version of Thunderbird, 91.4.0, fixes several security vulnerabilities. These include:
- CVE-2021-43536: URL leakage when navigating while executing asynchronous function
- CVE-2021-43537: Heap buffer overflow when using structured clone
- CVE-2021-43538: Missing fullscreen and pointer lock notification when requesting both
- CVE-2021-43539: GC rooting failure when calling wasm instance methods
- CVE-2021-43541: External protocol handler parameters were unescaped
- CVE-2021-43542: XMLHttpRequest error codes could have leaked the existence of an external protocol handler
- CVE-2021-43543: Bypass of CSP sandbox directive when embedding
- CVE-2021-43528: JavaScript unexpectedly enabled for the composition area
- CVE-2021-43545: Denial of Service when using the Location API in a loop
- CVE-2021-43546: Cursor spoofing could overlay user interface when native cursor is zoomed
These vulnerabilities could potentially lead to information leakage, heap buffer overflow, bypass of security measures, denial of service, and user interface manipulation.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
sudo dnf update thunderbird-
< 91.4.0-2.el8_5.alma91.4.0-2.el8_5.alma -
< 91.4.0-2.el8_5.alma.plus91.4.0-2.el8_5.alma.plus
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Conclusion
In conclusion, Thunderbird version 91.4.0 addresses multiple security vulnerabilities that could potentially lead to information leakage, heap buffer overflow, bypass of security measures, denial of service, and user interface manipulation. It is crucial to update Thunderbird to the latest version to ensure the security of your email and news management.
See every vulnerability recorded for thunderbird →
FAQ
Thunderbird is a standalone mail and newsgroup client developed by Mozilla. It allows users to manage their emails and news feeds.
The update addresses multiple security vulnerabilities, including URL leakage, heap buffer overflow, bypass of security measures, denial of service, and user interface manipulation.
To fix these vulnerabilities, you should update Thunderbird to version 91.4.0 or later. This update includes the necessary patches to address the security issues.
You can download the latest version of Thunderbird from the official Mozilla website or use your package manager to update the software.
No specific workarounds have been mentioned for these vulnerabilities. It is recommended to update Thunderbird to the latest version.
Related vulnerabilities
Recent vulnerabilities recorded for thunderbird.
