Synopsis

Important: thunderbird security update

Type/Severity

Security Advisory: Important

Topic

An update for thunderbird is now available for Red Hat Enterprise Linux 8.0 Update Services for SAP Solutions.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Mozilla Thunderbird is a standalone mail and newsgroup client.

This update upgrades Thunderbird to version 68.10.0.

Security Fix(es):

• Mozilla: Memory corruption due to missing sign-extension for ValueTags on ARM64 (CVE-2020-12417)
  
• Mozilla: Information disclosure due to manipulated URL object (CVE-2020-12418)
  
• Mozilla: Use-after-free in nsGlobalWindowInner (CVE-2020-12419)
  
• Mozilla: Use-After-Free when trying to connect to a STUN server (CVE-2020-12420)
  
• Mozilla: Add-On updates did not respect the same certificate trust rules as software updates (CVE-2020-12421)
  

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

All running instances of Thunderbird must be restarted for the update to take effect.

Affected Products

• Red Hat Enterprise Linux Server (for IBM Power LE) - Update Services for SAP Solutions 8.0 ppc64le
• Red Hat Enterprise Linux Server - Update Services for SAP Solutions 8.0 x86_64

Fixes

• BZ - 1853014 - CVE-2020-12417 Mozilla: Memory corruption due to missing sign-extension for ValueTags on ARM64
• BZ - 1853015 - CVE-2020-12418 Mozilla: Information disclosure due to manipulated URL object
• BZ - 1853016 - CVE-2020-12419 Mozilla: Use-after-free in nsGlobalWindowInner
• BZ - 1853017 - CVE-2020-12420 Mozilla: Use-After-Free when trying to connect to a STUN server
• BZ - 1853018 - CVE-2020-12421 Mozilla: Add-On updates did not respect the same certificate trust rules as software updates

CVEs

• CVE-2020-12417
• CVE-2020-12418
• CVE-2020-12419
• CVE-2020-12420
• CVE-2020-12421
• CVE-2020-15646

References

• https://access.redhat.com/security/updates/classification/#important

Red Hat Enterprise Linux Server (for IBM Power LE) - Update Services for SAP Solutions 8.0

SRPM
thunderbird-68.10.0-1.el8_0.src.rpm	SHA-256: 358735b8c129d1e391b40c417c24a2b3d5a3bcf6b90e49d43d52b581aee0dd97
ppc64le
thunderbird-68.10.0-1.el8_0.ppc64le.rpm	SHA-256: 91cfb9a639d75a4af505913be7de4cb95a6a2ccae76a424b16eefc644e8f3374
thunderbird-debuginfo-68.10.0-1.el8_0.ppc64le.rpm	SHA-256: 7e213387d4d8347b5d51f761d4791479ab54c5f44573787e1388b047a3edd9f9
thunderbird-debugsource-68.10.0-1.el8_0.ppc64le.rpm	SHA-256: ddbc92451e6b2e23ec71aa20560339e85be5205df59e10223632d14b1eb00a3e

Red Hat Enterprise Linux Server - Update Services for SAP Solutions 8.0

SRPM
thunderbird-68.10.0-1.el8_0.src.rpm	SHA-256: 358735b8c129d1e391b40c417c24a2b3d5a3bcf6b90e49d43d52b581aee0dd97
x86_64
thunderbird-68.10.0-1.el8_0.x86_64.rpm	SHA-256: f2103b066fce75f4ed428244c266bd8c8f6d9dbfc2013268e33d094d6145e594
thunderbird-debuginfo-68.10.0-1.el8_0.x86_64.rpm	SHA-256: 38c534b5b71bed95c7c032cab33647ae4b3df3f18e0761552414a6d566703649
thunderbird-debugsource-68.10.0-1.el8_0.x86_64.rpm	SHA-256: a386c68de5e772863725388089790a4938f6969a3f773c37b85760c8b1212c78