Important: Thunderbird Security Update - Memory Corruption and Other Vulnerabilities
Summary
ALSA-2023:4955: Important: thunderbird security update. Affects thunderbird versions < 102.15.0-1.el9_2.alma. Fixed in 102.15.0-1.el9_2.alma. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Mozilla Thunderbird is a standalone mail and newsgroup client. It is used for sending, receiving, and organizing emails and news articles. Thunderbird is vulnerable to multiple memory corruption issues and other security vulnerabilities.
Vulnerability Detail
The identified vulnerabilities in Thunderbird include memory corruption in various components such as IPC CanvasTranslator, IPC ColorPickerShownCallback, IPC FilePickerShownCallback, and JIT UpdateRegExpStatics. These memory corruption issues can lead to arbitrary code execution and potential exploitation by attackers. Additionally, there are memory safety bugs fixed in this update, which could have allowed for memory-related vulnerabilities. Other vulnerabilities include full screen notification obscuring, error reporting methods triggering Out of Memory Exception, unencrypted push notifications saved to disk, XLL file extensions downloadable without warnings, and potential failure to clear browsing context when closing Private Window.
How To Fix
Minimum fixed version
102.15.0-1.el9_2.alma
This is the first release that contains the fix.
sudo dnf update thunderbirdTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
Mozilla Thunderbird is affected by multiple vulnerabilities, including memory corruption issues and memory safety bugs. To mitigate these risks, it is crucial to update Thunderbird to version 102.15.0 or later. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for thunderbird →
FAQ
Thunderbird is a standalone mail and newsgroup client used for managing emails and news articles.
The vulnerabilities addressed in this update include memory corruption issues, memory safety bugs, full screen notification obscuring, error reporting methods triggering Out of Memory Exception, unencrypted push notifications saved to disk, XLL file extensions downloadable without warnings, and potential failure to clear browsing context when closing Private Window.
These vulnerabilities can lead to arbitrary code execution, potential exploitation by attackers, and privacy risks such as unencrypted push notifications and XLL file extensions downloadable without warnings.
To fix these vulnerabilities, update Thunderbird to version 102.15.0 or later.
No specific workaround has been mentioned for these vulnerabilities. It is recommended to update Thunderbird to the latest version.
Related vulnerabilities
Recent vulnerabilities recorded for thunderbird.
