openSUSE-SU-2017:0354-1

    Dashboard / Vulnerabilities / openSUSE-SU-2017:0354-1

    openSUSE-SU-2017:0354-1

    Published: 1 Feb 2017Last Modified: 4 Feb 2026

    Summary: Security update for MozillaThunderbird

    Details: This update to Mozilla Thunderbird 45.7.0 fixes security issues and bugs. The following security issues from advisory MFSA 2017-03 were fixed (boo#1021991) In general, these flaws cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but are potentially risks in browser or browser-like contexts: - CVE-2017-5375: Excessive JIT code allocation allows bypass of ASLR and DEP (boo#1021814) - CVE-2017-5376: Use-after-free in XSL (boo#1021817) - CVE-2017-5378: Pointer and frame data leakage of Javascript objects (boo#1021818) - CVE-2017-5380: Potential use-after-free during DOM manipulations (boo#1021819) - CVE-2017-5390: Insecure communication methods in Developer Tools JSON viewer (boo#1021820) - CVE-2017-5396: Use-after-free with Media Decoder (boo#1021821) - CVE-2017-5383: Location bar spoofing with unicode characters (boo#1021822) - CVE-2017-5373: Memory safety bugs fixed in Thunderbird 45.7 (boo#1021824) The following non-security bugs were fixed: - Message preview pane non-functional after IMAP folder was renamed or moved - 'Move To' button on 'Search Messages' panel not working - Message sent to 'undisclosed recipients' shows no recipient (non-functional since Thunderbird version 38)

    References: , https://bugzilla.suse.com/1021814, https://bugzilla.suse.com/1021817, https://bugzilla.suse.com/1021818, https://bugzilla.suse.com/1021819, https://bugzilla.suse.com/1021820, https://bugzilla.suse.com/1021821, https://bugzilla.suse.com/1021822, https://bugzilla.suse.com/1021824, https://bugzilla.suse.com/1021991, https://www.suse.com/security/cve/CVE-2017-5373, https://www.suse.com/security/cve/CVE-2017-5375, https://www.suse.com/security/cve/CVE-2017-5376, https://www.suse.com/security/cve/CVE-2017-5378, https://www.suse.com/security/cve/CVE-2017-5380, https://www.suse.com/security/cve/CVE-2017-5383, https://www.suse.com/security/cve/CVE-2017-5390, https://www.suse.com/security/cve/CVE-2017-5396

    Affected packages

    Package

    Name: MozillaThunderbird

    Purl: pkg:rpm/suse/MozillaThunderbird&distro=SUSE%20Package%20Hub%2012

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -45.7.0-23.1

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High