openSUSE-SU-2022:0906-1
Security update for MozillaThunderbird
Severidad por fuente
Ninguna fuente da una puntuación CVSS.
La etiqueta propia de Trivy es CRITICAL. Crítica según SUSE.
Descripción
This update for MozillaThunderbird fixes the following issues: Updated to version 91.7 (bsc#1196900): - CVE-2022-26381: Fixed an invalid memory access due to text reflow when SVG objects were present. - CVE-2022-26383: Fixed an issue where, when resizing a popup after requesting fullscreen access, the popup would not display the fullscreen notification. - CVE-2022-26384: Fixed an iframe XSS sandbox bypass when allow-popups was used on the iframe. - CVE-2022-26386: Fixed an issue where downloadable temporary files were accessible to other local users. - CVE-2022-26387: Fixed a potential add-on signature verification bypass due to a race condition.
Paquetes afectados y versiones corregidas
| Fuente | Paquete | Corregido en |
|---|---|---|
| openSUSE Leap 15.3 | MozillaThunderbird, MozillaThunderbird-translations-common, MozillaThunderbird-translations-other | 91.7.0-150200.8.62.7 |
Mostrar las 3 entradas de 1 fuente
| Fuente | Paquete | Corregido en |
|---|---|---|
| openSUSE Leap 15.3 | MozillaThunderbird | 91.7.0-150200.8.62.7 |
| openSUSE Leap 15.3 | MozillaThunderbird-translations-common | 91.7.0-150200.8.62.7 |
| openSUSE Leap 15.3 | MozillaThunderbird-translations-other | 91.7.0-150200.8.62.7 |
Referencias
- https://bugzilla.suse.com/1196900
- https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/AEEZYLQCKGYXDK76SYT5EY7XJEDGTHAW/
- https://www.suse.com/security/cve/CVE-2022-26381/
- https://www.suse.com/security/cve/CVE-2022-26383/
- https://www.suse.com/security/cve/CVE-2022-26384/
- https://www.suse.com/security/cve/CVE-2022-26386/
- https://www.suse.com/security/cve/CVE-2022-26387/
- https://www.suse.com/support/security/rating/