Security update for MozillaThunderbird

Announcement ID:	SUSE-SU-2023:0599-1
Rating:	important
References:	bsc#1208144
Cross-References:	CVE-2023-0616 CVE-2023-0767 CVE-2023-25728 CVE-2023-25729 CVE-2023-25730 CVE-2023-25732 CVE-2023-25734 CVE-2023-25735 CVE-2023-25737 CVE-2023-25738 CVE-2023-25739 CVE-2023-25742 CVE-2023-25746
CVSS scores:	CVE-2023-0616 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2023-0767 ( SUSE ): 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2023-0767 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2023-25728 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N CVE-2023-25729 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2023-25730 ( NVD ): 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N CVE-2023-25732 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2023-25734 ( NVD ): 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N CVE-2023-25735 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2023-25737 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2023-25738 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2023-25739 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2023-25742 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2023-25746 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected Products:	openSUSE Leap 15.4 SUSE Linux Enterprise Desktop 15 SP4 SUSE Linux Enterprise High Performance Computing 15 SP4 SUSE Linux Enterprise Micro 5.3 SUSE Linux Enterprise Micro 5.4 SUSE Linux Enterprise Real Time 15 SP4 SUSE Linux Enterprise Server 15 SP4 SUSE Linux Enterprise Server for SAP Applications 15 SP4 SUSE Linux Enterprise Workstation Extension 15 SP4 SUSE Manager Proxy 4.3 SUSE Manager Retail Branch Server 4.3 SUSE Manager Server 4.3 SUSE Package Hub 15 15-SP4

An update that solves 13 vulnerabilities can now be installed.

Description:

This update for MozillaThunderbird fixes the following issues:

Updated Mozilla Thunderbird to version 102.8.0 (bsc#1208144): - CVE-2023-0616: Fixed User Interface lockup via messages combining S/MIME and OpenPGP. - CVE-2023-25728: Fixed content security policy leak in violation reports using iframes. - CVE-2023-25730: Fixed screen hijack via browser fullscreen mode. - CVE-2023-0767: Fixed arbitrary memory write via PKCS 12 in NSS. - CVE-2023-25735: Fixed potential use-after-free from compartment mismatch in SpiderMonkey. - CVE-2023-25737: Fixed invalid downcast in SVGUtils::SetupStrokeGeometry. - CVE-2023-25738: Fixed printing on Windows could potentially crash Thunderbird with some device drivers. - CVE-2023-25739: Fixed use-after-free in mozilla::dom::ScriptLoadContext::~ScriptLoadContext. - CVE-2023-25729: Fixed vulnerability where extensions could have opened external schemes without user knowledge. - CVE-2023-25732: Fixed out of bounds memory write from EncodeInputStream. - CVE-2023-25734: Fixed issue where opening local .url files could cause unexpected network loads. - CVE-2023-25742: Fixed tab crashing caused by Web Crypto ImportKey. - CVE-2023-25746: Fixed memory safety bugs.

Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:

• openSUSE Leap 15.4
  zypper in -t patch openSUSE-SLE-15.4-2023-599=1
• SUSE Package Hub 15 15-SP4
  zypper in -t patch SUSE-SLE-Module-Packagehub-Subpackages-15-SP4-2023-599=1
• SUSE Linux Enterprise Workstation Extension 15 SP4
  zypper in -t patch SUSE-SLE-Product-WE-15-SP4-2023-599=1

Package List:

• openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64)
  • MozillaThunderbird-translations-common-102.8.0-150200.8.105.2
  • MozillaThunderbird-debugsource-102.8.0-150200.8.105.2
  • MozillaThunderbird-102.8.0-150200.8.105.2
  • MozillaThunderbird-translations-other-102.8.0-150200.8.105.2
  • MozillaThunderbird-debuginfo-102.8.0-150200.8.105.2
• SUSE Package Hub 15 15-SP4 (aarch64 ppc64le s390x)
  • MozillaThunderbird-translations-common-102.8.0-150200.8.105.2
  • MozillaThunderbird-debugsource-102.8.0-150200.8.105.2
  • MozillaThunderbird-102.8.0-150200.8.105.2
  • MozillaThunderbird-translations-other-102.8.0-150200.8.105.2
  • MozillaThunderbird-debuginfo-102.8.0-150200.8.105.2
• SUSE Linux Enterprise Workstation Extension 15 SP4 (x86_64)
  • MozillaThunderbird-translations-common-102.8.0-150200.8.105.2
  • MozillaThunderbird-debugsource-102.8.0-150200.8.105.2
  • MozillaThunderbird-102.8.0-150200.8.105.2
  • MozillaThunderbird-translations-other-102.8.0-150200.8.105.2
  • MozillaThunderbird-debuginfo-102.8.0-150200.8.105.2

References:

• https://www.suse.com/security/cve/CVE-2023-0616.html
• https://www.suse.com/security/cve/CVE-2023-0767.html
• https://www.suse.com/security/cve/CVE-2023-25728.html
• https://www.suse.com/security/cve/CVE-2023-25729.html
• https://www.suse.com/security/cve/CVE-2023-25730.html
• https://www.suse.com/security/cve/CVE-2023-25732.html
• https://www.suse.com/security/cve/CVE-2023-25734.html
• https://www.suse.com/security/cve/CVE-2023-25735.html
• https://www.suse.com/security/cve/CVE-2023-25737.html
• https://www.suse.com/security/cve/CVE-2023-25738.html
• https://www.suse.com/security/cve/CVE-2023-25739.html
• https://www.suse.com/security/cve/CVE-2023-25742.html
• https://www.suse.com/security/cve/CVE-2023-25746.html
• https://bugzilla.suse.com/show_bug.cgi?id=1208144