Security update for MozillaThunderbird

Announcement ID:	SUSE-SU-2019:1495-1
Rating:	important
References:	bsc#1137595
Cross-References:	CVE-2019-11703 CVE-2019-11704 CVE-2019-11705 CVE-2019-11706
CVSS scores:	CVE-2019-11703 ( SUSE ): 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2019-11703 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2019-11703 ( NVD ): 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2019-11704 ( SUSE ): 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2019-11704 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2019-11704 ( NVD ): 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2019-11705 ( SUSE ): 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2019-11705 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2019-11705 ( NVD ): 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2019-11706 ( SUSE ): 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2019-11706 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2019-11706 ( NVD ): 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products:	SUSE Linux Enterprise Desktop 15 SUSE Linux Enterprise Desktop 15 SP1 SUSE Linux Enterprise Server 15 SUSE Linux Enterprise Server 15 SP1 SUSE Linux Enterprise Server for SAP Applications 15 SUSE Linux Enterprise Server for SAP Applications 15 SP1 SUSE Linux Enterprise Workstation Extension 15 SUSE Linux Enterprise Workstation Extension 15 SP1

An update that solves four vulnerabilities can now be installed.

Description:

This update for MozillaThunderbird fixes the following security issues:

• CVE-2019-11703: Fixed a heap-based buffer overflow in icalmemorystrdupanddequote() (bsc#1137595).
• CVE-2019-11704: Fixed a heap-based buffer overflow in parser_get_next_char() (bsc#1137595).
• CVE-2019-11705: Fixed a stack-based buffer overflow in icalrecur_add_bydayrules() (bsc#1137595).
• CVE-2019-11706: Fixed a type confusion in icaltimezone_get_vtimezone_properties() (bsc#1137595).

Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:

• SUSE Linux Enterprise Workstation Extension 15 SP1
  zypper in -t patch SUSE-SLE-Product-WE-15-SP1-2019-1495=1
• SUSE Linux Enterprise Workstation Extension 15
  zypper in -t patch SUSE-SLE-Product-WE-15-2019-1495=1

Package List:

• SUSE Linux Enterprise Workstation Extension 15 SP1 (x86_64)
  • MozillaThunderbird-60.7.0-3.36.1
  • MozillaThunderbird-debugsource-60.7.0-3.36.1
  • MozillaThunderbird-debuginfo-60.7.0-3.36.1
  • MozillaThunderbird-translations-other-60.7.0-3.36.1
  • MozillaThunderbird-translations-common-60.7.0-3.36.1
• SUSE Linux Enterprise Workstation Extension 15 (x86_64)
  • MozillaThunderbird-60.7.0-3.36.1
  • MozillaThunderbird-debugsource-60.7.0-3.36.1
  • MozillaThunderbird-debuginfo-60.7.0-3.36.1
  • MozillaThunderbird-translations-other-60.7.0-3.36.1
  • MozillaThunderbird-translations-common-60.7.0-3.36.1

References:

• https://www.suse.com/security/cve/CVE-2019-11703.html
• https://www.suse.com/security/cve/CVE-2019-11704.html
• https://www.suse.com/security/cve/CVE-2019-11705.html
• https://www.suse.com/security/cve/CVE-2019-11706.html
• https://bugzilla.suse.com/show_bug.cgi?id=1137595