Security update for MozillaThunderbird

Announcement ID:	SUSE-SU-2019:1683-1
Rating:	important
References:	bsc#1137595 bsc#1138872
Cross-References:	CVE-2019-11703 CVE-2019-11704 CVE-2019-11705 CVE-2019-11706 CVE-2019-11707 CVE-2019-11708
CVSS scores:	CVE-2019-11703 ( SUSE ): 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2019-11703 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2019-11703 ( NVD ): 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2019-11704 ( SUSE ): 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2019-11704 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2019-11704 ( NVD ): 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2019-11705 ( SUSE ): 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2019-11705 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2019-11705 ( NVD ): 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2019-11706 ( SUSE ): 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2019-11706 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2019-11706 ( NVD ): 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2019-11707 ( SUSE ): 8.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2019-11707 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2019-11707 ( NVD ): 8.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2019-11708 ( NVD ): 10.0 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Affected Products:	SUSE Linux Enterprise Desktop 15 SUSE Linux Enterprise Desktop 15 SP1 SUSE Linux Enterprise Server 15 SUSE Linux Enterprise Server 15 SP1 SUSE Linux Enterprise Server for SAP Applications 15 SUSE Linux Enterprise Server for SAP Applications 15 SP1 SUSE Linux Enterprise Workstation Extension 15 SUSE Linux Enterprise Workstation Extension 15 SP1

An update that solves six vulnerabilities can now be installed.

Description:

This update for MozillaThunderbird fixes the following issues:

Security issues fixed:

• CVE-2019-11703: Fixed a heap-based buffer overflow in icalmemorystrdupanddequote() (bsc#1137595).
• CVE-2019-11704: Fixed a heap-based buffer overflow in parser_get_next_char() (bsc#1137595).
• CVE-2019-11705: Fixed a stack-based buffer overflow in icalrecur_add_bydayrules() (bsc#1137595).
• CVE-2019-11706: Fixed a type confusion in icaltimezone_get_vtimezone_properties() (bsc#1137595).
• CVE-2019-11707: Fixed a type confusion in Array.pop (bsc#1138872).
• CVE-2019-11708: Fixed a sandbox escape using Prompt:Open (bsc#1138872).

Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:

• SUSE Linux Enterprise Workstation Extension 15 SP1
  zypper in -t patch SUSE-SLE-Product-WE-15-SP1-2019-1683=1
• SUSE Linux Enterprise Workstation Extension 15
  zypper in -t patch SUSE-SLE-Product-WE-15-2019-1683=1

Package List:

• SUSE Linux Enterprise Workstation Extension 15 SP1 (x86_64)
  • MozillaThunderbird-60.7.2-3.43.1
  • MozillaThunderbird-debuginfo-60.7.2-3.43.1
  • MozillaThunderbird-debugsource-60.7.2-3.43.1
  • MozillaThunderbird-translations-other-60.7.2-3.43.1
  • MozillaThunderbird-translations-common-60.7.2-3.43.1
• SUSE Linux Enterprise Workstation Extension 15 (x86_64)
  • MozillaThunderbird-60.7.2-3.43.1
  • MozillaThunderbird-debuginfo-60.7.2-3.43.1
  • MozillaThunderbird-debugsource-60.7.2-3.43.1
  • MozillaThunderbird-translations-other-60.7.2-3.43.1
  • MozillaThunderbird-translations-common-60.7.2-3.43.1

References:

• https://www.suse.com/security/cve/CVE-2019-11703.html
• https://www.suse.com/security/cve/CVE-2019-11704.html
• https://www.suse.com/security/cve/CVE-2019-11705.html
• https://www.suse.com/security/cve/CVE-2019-11706.html
• https://www.suse.com/security/cve/CVE-2019-11707.html
• https://www.suse.com/security/cve/CVE-2019-11708.html
• https://bugzilla.suse.com/show_bug.cgi?id=1137595
• https://bugzilla.suse.com/show_bug.cgi?id=1138872