ALSA-2023:1809 - Important: Thunderbird Security Update
Summary
ALSA-2023:1809: Important: thunderbird security update. Affects thunderbird versions < 102.10.0-2.el9_1.alma. Fixed in 102.10.0-2.el9_1.alma. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Mozilla Thunderbird is a standalone mail and newsgroup client. It is widely used for managing emails, news feeds, and discussions. Thunderbird provides various features such as advanced search capabilities, message filtering, and support for multiple accounts. This vulnerability affects Thunderbird version 102.10.0 and earlier.
Vulnerability Detail
The vulnerability identified in this update is a critical security issue that could potentially lead to various attacks and compromises. The specific vulnerabilities addressed in this update include:
- Revocation status of S/Mime recipient certificates not being checked (CVE-2023-0547)
- Matrix SDK bundled with Thunderbird being vulnerable to denial-of-service attacks (CVE-2023-28427)
- Fullscreen notification being obscured (CVE-2023-29533)
- Potential memory corruption following Garbage Collector compaction (CVE-2023-29535)
- Invalid free from JavaScript code (CVE-2023-29536)
- Memory safety bugs fixed in Firefox 112 and Firefox ESR 102.10 (CVE-2023-29550)
- Memory Corruption in Safe Browsing Code (CVE-2023-1945)
- Hang when processing certain OpenPGP messages (CVE-2023-29479)
- Content-Disposition filename truncation leading to Reflected File Download (CVE-2023-29539)
- Files with malicious extensions being downloaded unsafely on Linux (CVE-2023-29541)
- Incorrect optimization result on ARM64 (CVE-2023-29548)
- Double-free in libwebp (CVE-2023-0001)
These vulnerabilities could potentially allow attackers to execute arbitrary code, cause denial-of-service, or bypass security measures.
How To Fix
Minimum fixed version
102.10.0-2.el9_1.alma
This is the first release that contains the fix.
sudo dnf update thunderbirdTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
This update addresses multiple critical security vulnerabilities in Thunderbird. It is highly recommended to update to version 102.10.0 or later to mitigate the risks associated with these vulnerabilities. For further support and assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for thunderbird →
FAQ
Thunderbird is a standalone mail and newsgroup client used for managing emails, news feeds, and discussions.
These vulnerabilities could allow attackers to execute arbitrary code, cause denial-of-service, or bypass security measures.
To fix these vulnerabilities, update Thunderbird to version 102.10.0 or later.
No specific workarounds have been provided for these vulnerabilities.
For more details about these vulnerabilities, refer to the CVE pages listed in the References section.
Related vulnerabilities
Recent vulnerabilities recorded for thunderbird.
