SUSE-SU-2024:4148-1

Severity by source

No source gives a CVSS score.

Trivy's own label is CRITICAL. Rated critical by SUSE.

Description

This update for MozillaThunderbird fixes the following issues: - Mozilla Thunderbird 128.5 * fixed: IMAP could crash when reading cached messages * fixed: Enabling 'Show Folder Size' on Maildir profile could render Thunderbird unusable * fixed: Messages corrupted by folder compaction were only fixed by user intervention * fixed: Reading a message from past the end of an mbox file did not cause an error * fixed: View -> Folders had duplicate F access keys * fixed: Add-ons adding columns to the message list could fail and cause display issue * fixed: 'Empty trash on exit' and 'Expunge inbox on exit' did not always work * fixed: Selecting a display option in View -> Tasks did not apply in the Task interface * fixed: Security fixes MFSA 2024-68 (bsc#1233695) * CVE-2024-11691 Out-of-bounds write in Apple GPU drivers via WebGL * CVE-2024-11692 Select list elements could be shown over another site * CVE-2024-11693 Download Protections were bypassed by .library-ms files on Windows * CVE-2024-11694 CSP Bypass and XSS Exposure via Web Compatibility Shims * CVE-2024-11695 URL Bar Spoofing via Manipulated Punycode and Whitespace Characters * CVE-2024-11696 Unhandled Exception in Add-on Signature Verification * CVE-2024-11697 Improper Keypress Handling in Executable File Confirmation Dialog * CVE-2024-11698 Fullscreen Lock-Up When Modal Dialog Interrupts Transition on macOS * CVE-2024-11699 Memory safety bugs fixed in Firefox 133, Thunderbird 133, Firefox ESR 128.5, and Thunderbird 128.5 - Handle upstream changes with esr-prefix of desktop-file (bsc#1233650)

Affected packages and fixed versions

References

• https://bugzilla.suse.com/1233650
• https://bugzilla.suse.com/1233695
• https://lists.suse.com/pipermail/sle-security-updates/2024-December/019900.html
• https://www.suse.com/security/cve/CVE-2024-11691/
• https://www.suse.com/security/cve/CVE-2024-11692/
• https://www.suse.com/security/cve/CVE-2024-11693/
• https://www.suse.com/security/cve/CVE-2024-11694/
• https://www.suse.com/security/cve/CVE-2024-11695/