Scientific Linux alert SLSA-2023:0817-1 (thunderbird)

From:
             
 
Pat Riehecky <riehecky@fnal.gov>
To:
             
 
scientific-linux-errata@listserv.fnal.gov
Subject:
             
 
Security ERRATA Important: thunderbird on SL7.x x86_64
Date:
             
 
Mon, 20 Feb 2023 19:04:49 -0000
Message-ID:
             
 
<20230220190449.10167.60715@0acbe050e934>
Synopsis:          Important: thunderbird security update
Advisory ID:       SLSA-2023:0817-1
Issue Date:        2023-02-20
CVE Numbers:       CVE-2023-25728
                   CVE-2023-25730
                   CVE-2023-25743
                   CVE-2023-0767
                   CVE-2023-25735
                   CVE-2023-25737
                   CVE-2023-25739
                   CVE-2023-25729
                   CVE-2023-25732
                   CVE-2023-25742
                   CVE-2023-25744
                   CVE-2023-25746
                   CVE-2023-0616
--

This update upgrades Thunderbird to version 102.8.0.

Security Fix(es):

* Mozilla: Arbitrary memory write via PKCS 12 in NSS (CVE-2023-0767)

* Mozilla: Content security policy leak in violation reports using iframes
(CVE-2023-25728)

* Mozilla: Screen hijack via browser fullscreen mode (CVE-2023-25730)

* Mozilla: Potential use-after-free from compartment mismatch in
SpiderMonkey (CVE-2023-25735)

* Mozilla: Invalid downcast in SVGUtils::SetupStrokeGeometry
(CVE-2023-25737)

* Mozilla: Use-after-free in
mozilla::dom::ScriptLoadContext::~ScriptLoadContext (CVE-2023-25739)

* Mozilla: Fullscreen notification not shown in Firefox Focus
(CVE-2023-25743)

* Mozilla: Memory safety bugs fixed in Firefox 110 and Firefox ESR 102.8
(CVE-2023-25744)

* Mozilla: Memory safety bugs fixed in Firefox ESR 102.8 (CVE-2023-25746)

* Mozilla: Extensions could have opened external schemes without user
knowledge (CVE-2023-25729)

* Mozilla: Out of bounds memory write from EncodeInputStream
(CVE-2023-25732)

* Mozilla: User Interface lockup with messages combining S/MIME and
OpenPGP  (CVE-2023-0616)

* Mozilla: Web Crypto ImportKey crashes tab (CVE-2023-25742)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
--

SL7
  x86_64
    thunderbird-102.8.0-2.el7_9.x86_64.rpm
    thunderbird-debuginfo-102.8.0-2.el7_9.x86_64.rpm

- Scientific Linux Development Team