ALSA-2023:6194 - Thunderbird Security Update
Summary
ALSA-2023:6194: Important: thunderbird security update. Affects thunderbird versions < 115.4.1-1.el8_8.alma.1. Fixed in 115.4.1-1.el8_8.alma.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Mozilla Thunderbird is a standalone mail and newsgroup client. It provides users with a convenient way to manage their emails and participate in online discussions. Thunderbird is widely used and trusted by individuals and organizations for its robust features and security measures. However, like any software, it is not immune to vulnerabilities that can potentially compromise its integrity and expose users to various risks.
Vulnerability Detail
The latest security update for Thunderbird, version 115.4.1, addresses several important vulnerabilities. These vulnerabilities include:
- Queued up rendering could have allowed websites to clickjack (CVE-2023-5721).
- Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4, and Thunderbird 115.4 (CVE-2023-5730).
- Crash related to VP9 encoding in libvpx (CVE-2023-44488).
- Large WebGL draw could have led to a crash (CVE-2023-5724).
- WebExtensions could open arbitrary URLs (CVE-2023-5725).
- Improper object tracking during GC in the JavaScript engine could have led to a crash (CVE-2023-5728).
- Address bar spoofing via bidirectional characters (CVE-2023-5732).
These vulnerabilities could potentially be exploited by malicious actors to perform various attacks, such as clickjacking, crashing the application, or opening arbitrary URLs. It is crucial to update Thunderbird to the latest version to mitigate these risks.
How To Fix
Minimum fixed version
115.4.1-1.el8_8.alma.1
This is the first release that contains the fix.
sudo dnf update thunderbirdTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
Updating Thunderbird to the latest version is crucial to address the identified vulnerabilities and ensure the security of your email and newsgroup communications. It is recommended to follow the provided steps to update Thunderbird and monitor for any abnormal behavior. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for thunderbird →
FAQ
Thunderbird is a standalone mail and newsgroup client developed by Mozilla. It allows users to manage their emails and participate in online discussions.
The vulnerabilities addressed in this update include clickjacking, memory safety bugs, crash related to VP9 encoding, large WebGL draw crash, arbitrary URL opening by WebExtensions, improper object tracking during GC, and address bar spoofing via bidirectional characters.
These vulnerabilities could be exploited by attackers to perform clickjacking attacks, crash the application, open arbitrary URLs, or spoof the address bar, potentially leading to unauthorized access, data loss, or other malicious activities.
To fix these vulnerabilities, update Thunderbird to version 115.4.1 or later. Make sure the update is applied to all instances of Thunderbird in your environment.
You can verify the successful installation of the update by checking the version number in the Thunderbird application. It should be 115.4.1 or later.
Related vulnerabilities
Recent vulnerabilities recorded for thunderbird.
