MozillaThunderbird-91.4.0-1.1 on GA media SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2024:11670 Final 1 1 2024-06-17T21:45:33Z current 2024-06-17T21:45:33Z 2024-06-17T21:45:33Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z MozillaThunderbird-91.4.0-1.1 on GA media These are all security issues fixed in the MozillaThunderbird-91.4.0-1.1 package on the GA media of openSUSE Tumbleweed. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). openSUSE-Tumbleweed-2024-11670 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) E-Mail link for openSUSE-SU-2024:11670 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://www.suse.com/security/cve/CVE-2021-40529/ SUSE CVE CVE-2021-40529 page https://www.suse.com/security/cve/CVE-2021-43528/ SUSE CVE CVE-2021-43528 page https://www.suse.com/security/cve/CVE-2021-43536/ SUSE CVE CVE-2021-43536 page https://www.suse.com/security/cve/CVE-2021-43537/ SUSE CVE CVE-2021-43537 page https://www.suse.com/security/cve/CVE-2021-43538/ SUSE CVE CVE-2021-43538 page https://www.suse.com/security/cve/CVE-2021-43539/ SUSE CVE CVE-2021-43539 page https://www.suse.com/security/cve/CVE-2021-43541/ SUSE CVE CVE-2021-43541 page https://www.suse.com/security/cve/CVE-2021-43542/ SUSE CVE CVE-2021-43542 page https://www.suse.com/security/cve/CVE-2021-43543/ SUSE CVE CVE-2021-43543 page https://www.suse.com/security/cve/CVE-2021-43545/ SUSE CVE CVE-2021-43545 page https://www.suse.com/security/cve/CVE-2021-43546/ SUSE CVE CVE-2021-43546 page openSUSE Tumbleweed MozillaThunderbird-91.4.0-1.1 MozillaThunderbird-translations-common-91.4.0-1.1 MozillaThunderbird-translations-other-91.4.0-1.1 MozillaThunderbird-91.4.0-1.1 as a component of openSUSE Tumbleweed MozillaThunderbird-translations-common-91.4.0-1.1 as a component of openSUSE Tumbleweed MozillaThunderbird-translations-other-91.4.0-1.1 as a component of openSUSE Tumbleweed The ElGamal implementation in Botan through 2.18.1, as used in Thunderbird and other products, allows plaintext recovery because, during interaction between two cryptographic libraries, a certain dangerous combination of the prime defined by the receiver's public key, the generator defined by the receiver's public key, and the sender's ephemeral exponents can lead to a cross-configuration attack against OpenPGP. CVE-2021-40529 openSUSE Tumbleweed:MozillaThunderbird-91.4.0-1.1 openSUSE Tumbleweed:MozillaThunderbird-translations-common-91.4.0-1.1 openSUSE Tumbleweed:MozillaThunderbird-translations-other-91.4.0-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2021-40529.html CVE-2021-40529 https://bugzilla.suse.com/1190244 SUSE Bug 1190244 Thunderbird unexpectedly enabled JavaScript in the composition area. The JavaScript execution context was limited to this area and did not receive chrome-level privileges, but could be used as a stepping stone to further an attack with other vulnerabilities. This vulnerability affects Thunderbird < 91.4.0. CVE-2021-43528 openSUSE Tumbleweed:MozillaThunderbird-91.4.0-1.1 openSUSE Tumbleweed:MozillaThunderbird-translations-common-91.4.0-1.1 openSUSE Tumbleweed:MozillaThunderbird-translations-other-91.4.0-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2021-43528.html CVE-2021-43528 https://bugzilla.suse.com/1193485 SUSE Bug 1193485 Under certain circumstances, asynchronous functions could have caused a navigation to fail but expose the target URL. This vulnerability affects Thunderbird < 91.4.0, Firefox ESR < 91.4.0, and Firefox < 95. CVE-2021-43536 openSUSE Tumbleweed:MozillaThunderbird-91.4.0-1.1 openSUSE Tumbleweed:MozillaThunderbird-translations-common-91.4.0-1.1 openSUSE Tumbleweed:MozillaThunderbird-translations-other-91.4.0-1.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2021-43536.html CVE-2021-43536 https://bugzilla.suse.com/1193485 SUSE Bug 1193485 An incorrect type conversion of sizes from 64bit to 32bit integers allowed an attacker to corrupt memory leading to a potentially exploitable crash. This vulnerability affects Thunderbird < 91.4.0, Firefox ESR < 91.4.0, and Firefox < 95. CVE-2021-43537 openSUSE Tumbleweed:MozillaThunderbird-91.4.0-1.1 openSUSE Tumbleweed:MozillaThunderbird-translations-common-91.4.0-1.1 openSUSE Tumbleweed:MozillaThunderbird-translations-other-91.4.0-1.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2021-43537.html CVE-2021-43537 https://bugzilla.suse.com/1193485 SUSE Bug 1193485 By misusing a race in our notification code, an attacker could have forcefully hidden the notification for pages that had received full screen and pointer lock access, which could have been used for spoofing attacks. This vulnerability affects Thunderbird < 91.4.0, Firefox ESR < 91.4.0, and Firefox < 95. CVE-2021-43538 openSUSE Tumbleweed:MozillaThunderbird-91.4.0-1.1 openSUSE Tumbleweed:MozillaThunderbird-translations-common-91.4.0-1.1 openSUSE Tumbleweed:MozillaThunderbird-translations-other-91.4.0-1.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2021-43538.html CVE-2021-43538 https://bugzilla.suse.com/1193485 SUSE Bug 1193485 Failure to correctly record the location of live pointers across wasm instance calls resulted in a GC occurring within the call not tracing those live pointers. This could have led to a use-after-free causing a potentially exploitable crash. This vulnerability affects Thunderbird < 91.4.0, Firefox ESR < 91.4.0, and Firefox < 95. CVE-2021-43539 openSUSE Tumbleweed:MozillaThunderbird-91.4.0-1.1 openSUSE Tumbleweed:MozillaThunderbird-translations-common-91.4.0-1.1 openSUSE Tumbleweed:MozillaThunderbird-translations-other-91.4.0-1.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2021-43539.html CVE-2021-43539 https://bugzilla.suse.com/1193485 SUSE Bug 1193485 When invoking protocol handlers for external protocols, a supplied parameter URL containing spaces was not properly escaped. This vulnerability affects Thunderbird < 91.4.0, Firefox ESR < 91.4.0, and Firefox < 95. CVE-2021-43541 openSUSE Tumbleweed:MozillaThunderbird-91.4.0-1.1 openSUSE Tumbleweed:MozillaThunderbird-translations-common-91.4.0-1.1 openSUSE Tumbleweed:MozillaThunderbird-translations-other-91.4.0-1.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2021-43541.html CVE-2021-43541 https://bugzilla.suse.com/1193485 SUSE Bug 1193485 Using XMLHttpRequest, an attacker could have identified installed applications by probing error messages for loading external protocols. This vulnerability affects Thunderbird < 91.4.0, Firefox ESR < 91.4.0, and Firefox < 95. CVE-2021-43542 openSUSE Tumbleweed:MozillaThunderbird-91.4.0-1.1 openSUSE Tumbleweed:MozillaThunderbird-translations-common-91.4.0-1.1 openSUSE Tumbleweed:MozillaThunderbird-translations-other-91.4.0-1.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2021-43542.html CVE-2021-43542 https://bugzilla.suse.com/1193485 SUSE Bug 1193485 Documents loaded with the CSP sandbox directive could have escaped the sandbox's script restriction by embedding additional content. This vulnerability affects Thunderbird < 91.4.0, Firefox ESR < 91.4.0, and Firefox < 95. CVE-2021-43543 openSUSE Tumbleweed:MozillaThunderbird-91.4.0-1.1 openSUSE Tumbleweed:MozillaThunderbird-translations-common-91.4.0-1.1 openSUSE Tumbleweed:MozillaThunderbird-translations-other-91.4.0-1.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2021-43543.html CVE-2021-43543 https://bugzilla.suse.com/1193485 SUSE Bug 1193485 Using the Location API in a loop could have caused severe application hangs and crashes. This vulnerability affects Thunderbird < 91.4.0, Firefox ESR < 91.4.0, and Firefox < 95. CVE-2021-43545 openSUSE Tumbleweed:MozillaThunderbird-91.4.0-1.1 openSUSE Tumbleweed:MozillaThunderbird-translations-common-91.4.0-1.1 openSUSE Tumbleweed:MozillaThunderbird-translations-other-91.4.0-1.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2021-43545.html CVE-2021-43545 https://bugzilla.suse.com/1193485 SUSE Bug 1193485 It was possible to recreate previous cursor spoofing attacks against users with a zoomed native cursor. This vulnerability affects Thunderbird < 91.4.0, Firefox ESR < 91.4.0, and Firefox < 95. CVE-2021-43546 openSUSE Tumbleweed:MozillaThunderbird-91.4.0-1.1 openSUSE Tumbleweed:MozillaThunderbird-translations-common-91.4.0-1.1 openSUSE Tumbleweed:MozillaThunderbird-translations-other-91.4.0-1.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2021-43546.html CVE-2021-43546 https://bugzilla.suse.com/1193485 SUSE Bug 1193485