MozillaThunderbird-115.6.0-1.1 on GA media SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2024:13519-1 Final 1 1 2024-06-15T00:00:00Z current 2024-06-15T00:00:00Z 2024-06-15T00:00:00Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z MozillaThunderbird-115.6.0-1.1 on GA media These are all security issues fixed in the MozillaThunderbird-115.6.0-1.1 package on the GA media of openSUSE Tumbleweed. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). openSUSE-Tumbleweed-2024-13519 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/security/rating/ SUSE Security Ratings https://www.suse.com/security/cve/CVE-2023-50761/ SUSE CVE CVE-2023-50761 page https://www.suse.com/security/cve/CVE-2023-50762/ SUSE CVE CVE-2023-50762 page https://www.suse.com/security/cve/CVE-2023-6856/ SUSE CVE CVE-2023-6856 page https://www.suse.com/security/cve/CVE-2023-6857/ SUSE CVE CVE-2023-6857 page https://www.suse.com/security/cve/CVE-2023-6858/ SUSE CVE CVE-2023-6858 page https://www.suse.com/security/cve/CVE-2023-6859/ SUSE CVE CVE-2023-6859 page https://www.suse.com/security/cve/CVE-2023-6860/ SUSE CVE CVE-2023-6860 page https://www.suse.com/security/cve/CVE-2023-6861/ SUSE CVE CVE-2023-6861 page https://www.suse.com/security/cve/CVE-2023-6862/ SUSE CVE CVE-2023-6862 page https://www.suse.com/security/cve/CVE-2023-6863/ SUSE CVE CVE-2023-6863 page https://www.suse.com/security/cve/CVE-2023-6864/ SUSE CVE CVE-2023-6864 page openSUSE Tumbleweed MozillaThunderbird-115.6.0-1.1 MozillaThunderbird-translations-common-115.6.0-1.1 MozillaThunderbird-translations-other-115.6.0-1.1 MozillaThunderbird-115.6.0-1.1 as a component of openSUSE Tumbleweed MozillaThunderbird-translations-common-115.6.0-1.1 as a component of openSUSE Tumbleweed MozillaThunderbird-translations-other-115.6.0-1.1 as a component of openSUSE Tumbleweed The signature of a digitally signed S/MIME email message may optionally specify the signature creation date and time. If present, Thunderbird did not compare the signature creation date with the message date and time, and displayed a valid signature despite a date or time mismatch. This could be used to give recipients the impression that a message was sent at a different date or time. This vulnerability affects Thunderbird < 115.6. CVE-2023-50761 openSUSE Tumbleweed:MozillaThunderbird-115.6.0-1.1 openSUSE Tumbleweed:MozillaThunderbird-translations-common-115.6.0-1.1 openSUSE Tumbleweed:MozillaThunderbird-translations-other-115.6.0-1.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2023-50761.html CVE-2023-50761 https://bugzilla.suse.com/1217974 SUSE Bug 1217974 When processing a PGP/MIME payload that contains digitally signed text, the first paragraph of the text was never shown to the user. This is because the text was interpreted as a MIME message and the first paragraph was always treated as an email header section. A digitally signed text from a different context, such as a signed GIT commit, could be used to spoof an email message. This vulnerability affects Thunderbird < 115.6. CVE-2023-50762 openSUSE Tumbleweed:MozillaThunderbird-115.6.0-1.1 openSUSE Tumbleweed:MozillaThunderbird-translations-common-115.6.0-1.1 openSUSE Tumbleweed:MozillaThunderbird-translations-other-115.6.0-1.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2023-50762.html CVE-2023-50762 https://bugzilla.suse.com/1217974 SUSE Bug 1217974 The WebGL `DrawElementsInstanced` method was susceptible to a heap buffer overflow when used on systems with the Mesa VM driver. This issue could allow an attacker to perform remote code execution and sandbox escape. This vulnerability affects Firefox ESR < 115.6, Thunderbird < 115.6, and Firefox < 121. CVE-2023-6856 openSUSE Tumbleweed:MozillaThunderbird-115.6.0-1.1 openSUSE Tumbleweed:MozillaThunderbird-translations-common-115.6.0-1.1 openSUSE Tumbleweed:MozillaThunderbird-translations-other-115.6.0-1.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2023-6856.html CVE-2023-6856 https://bugzilla.suse.com/1217974 SUSE Bug 1217974 When resolving a symlink, a race may occur where the buffer passed to `readlink` may actually be smaller than necessary. *This bug only affects Firefox on Unix-based operating systems (Android, Linux, MacOS). Windows is unaffected.* This vulnerability affects Firefox ESR < 115.6, Thunderbird < 115.6, and Firefox < 121. CVE-2023-6857 openSUSE Tumbleweed:MozillaThunderbird-115.6.0-1.1 openSUSE Tumbleweed:MozillaThunderbird-translations-common-115.6.0-1.1 openSUSE Tumbleweed:MozillaThunderbird-translations-other-115.6.0-1.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2023-6857.html CVE-2023-6857 https://bugzilla.suse.com/1217974 SUSE Bug 1217974 Firefox was susceptible to a heap buffer overflow in `nsTextFragment` due to insufficient OOM handling. This vulnerability affects Firefox ESR < 115.6, Thunderbird < 115.6, and Firefox < 121. CVE-2023-6858 openSUSE Tumbleweed:MozillaThunderbird-115.6.0-1.1 openSUSE Tumbleweed:MozillaThunderbird-translations-common-115.6.0-1.1 openSUSE Tumbleweed:MozillaThunderbird-translations-other-115.6.0-1.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2023-6858.html CVE-2023-6858 https://bugzilla.suse.com/1217974 SUSE Bug 1217974 A use-after-free condition affected TLS socket creation when under memory pressure. This vulnerability affects Firefox ESR < 115.6, Thunderbird < 115.6, and Firefox < 121. CVE-2023-6859 openSUSE Tumbleweed:MozillaThunderbird-115.6.0-1.1 openSUSE Tumbleweed:MozillaThunderbird-translations-common-115.6.0-1.1 openSUSE Tumbleweed:MozillaThunderbird-translations-other-115.6.0-1.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2023-6859.html CVE-2023-6859 https://bugzilla.suse.com/1217974 SUSE Bug 1217974 The `VideoBridge` allowed any content process to use textures produced by remote decoders. This could be abused to escape the sandbox. This vulnerability affects Firefox ESR < 115.6, Thunderbird < 115.6, and Firefox < 121. CVE-2023-6860 openSUSE Tumbleweed:MozillaThunderbird-115.6.0-1.1 openSUSE Tumbleweed:MozillaThunderbird-translations-common-115.6.0-1.1 openSUSE Tumbleweed:MozillaThunderbird-translations-other-115.6.0-1.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2023-6860.html CVE-2023-6860 https://bugzilla.suse.com/1217974 SUSE Bug 1217974 The `nsWindow::PickerOpen(void)` method was susceptible to a heap buffer overflow when running in headless mode. This vulnerability affects Firefox ESR < 115.6, Thunderbird < 115.6, and Firefox < 121. CVE-2023-6861 openSUSE Tumbleweed:MozillaThunderbird-115.6.0-1.1 openSUSE Tumbleweed:MozillaThunderbird-translations-common-115.6.0-1.1 openSUSE Tumbleweed:MozillaThunderbird-translations-other-115.6.0-1.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2023-6861.html CVE-2023-6861 https://bugzilla.suse.com/1217974 SUSE Bug 1217974 A use-after-free was identified in the `nsDNSService::Init`. This issue appears to manifest rarely during start-up. This vulnerability affects Firefox ESR < 115.6 and Thunderbird < 115.6. CVE-2023-6862 openSUSE Tumbleweed:MozillaThunderbird-115.6.0-1.1 openSUSE Tumbleweed:MozillaThunderbird-translations-common-115.6.0-1.1 openSUSE Tumbleweed:MozillaThunderbird-translations-other-115.6.0-1.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2023-6862.html CVE-2023-6862 https://bugzilla.suse.com/1217974 SUSE Bug 1217974 The `ShutdownObserver()` was susceptible to potentially undefined behavior due to its reliance on a dynamic type that lacked a virtual destructor. This vulnerability affects Firefox ESR < 115.6, Thunderbird < 115.6, and Firefox < 121. CVE-2023-6863 openSUSE Tumbleweed:MozillaThunderbird-115.6.0-1.1 openSUSE Tumbleweed:MozillaThunderbird-translations-common-115.6.0-1.1 openSUSE Tumbleweed:MozillaThunderbird-translations-other-115.6.0-1.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2023-6863.html CVE-2023-6863 https://bugzilla.suse.com/1217974 SUSE Bug 1217974 Memory safety bugs present in Firefox 120, Firefox ESR 115.5, and Thunderbird 115.5. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR < 115.6, Thunderbird < 115.6, and Firefox < 121. CVE-2023-6864 openSUSE Tumbleweed:MozillaThunderbird-115.6.0-1.1 openSUSE Tumbleweed:MozillaThunderbird-translations-common-115.6.0-1.1 openSUSE Tumbleweed:MozillaThunderbird-translations-other-115.6.0-1.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2023-6864.html CVE-2023-6864 https://bugzilla.suse.com/1217974 SUSE Bug 1217974