Red Hat Product Errata RHSA-2023:5438 - Security Advisory
Issued:
2023-10-04
Updated:
2023-10-04

RHSA-2023:5438 - Security Advisory

Synopsis

Important: thunderbird security update

Type/Severity

Security Advisory: Important

Red Hat Insights patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

An update for thunderbird is now available for Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Mozilla Thunderbird is a standalone mail and newsgroup client.

This update upgrades Thunderbird to version 115.3.1.

Security Fix(es):

  • firefox: use-after-free in workers (CVE-2023-3600)
  • Mozilla: Out-of-bounds write in PathOps (CVE-2023-5169)
  • Mozilla: Use-after-free in Ion Compiler (CVE-2023-5171)
  • Mozilla: Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3, and Thunderbird 115.3 (CVE-2023-5176)
  • libvpx: Heap buffer overflow in vp8 encoding in libvpx (CVE-2023-5217)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

All running instances of Thunderbird must be restarted for the update to take effect.

Affected Products

  • Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 8.1 ppc64le
  • Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 8.1 x86_64

Fixes

  • BZ - 2222652 - CVE-2023-3600 firefox: use-after-free in workers
  • BZ - 2240893 - CVE-2023-5169 Mozilla: Out-of-bounds write in PathOps
  • BZ - 2240894 - CVE-2023-5171 Mozilla: Use-after-free in Ion Compiler
  • BZ - 2240896 - CVE-2023-5176 Mozilla: Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3, and Thunderbird 115.3
  • BZ - 2241191 - CVE-2023-5217 libvpx: Heap buffer overflow in vp8 encoding in libvpx

Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 8.1

SRPM
thunderbird-115.3.1-1.el8_1.src.rpm SHA-256: 49367acb4ca315d55b131f58a561971a129e0ff598d45288d8cd48fb6c9c84ea
ppc64le
thunderbird-115.3.1-1.el8_1.ppc64le.rpm SHA-256: 8fec3a4ba500fc567bef5e8c03b2c71b91530ee5139ecaf3e491623be56a4965
thunderbird-debuginfo-115.3.1-1.el8_1.ppc64le.rpm SHA-256: 7aa7f13e876237b1b424b592820147e0454fe960ec8d75d37ac4c9afda7cf02f
thunderbird-debugsource-115.3.1-1.el8_1.ppc64le.rpm SHA-256: 8feb50f4483c9f4d0b0ff9cfe1a319c7c6786528f0053fe3ec3d8a7803491717

Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 8.1

SRPM
thunderbird-115.3.1-1.el8_1.src.rpm SHA-256: 49367acb4ca315d55b131f58a561971a129e0ff598d45288d8cd48fb6c9c84ea
x86_64
thunderbird-115.3.1-1.el8_1.x86_64.rpm SHA-256: b8fc759e834181d13d8359c6115ebad90c4d28237ef43777d42ce34c2d8a7eaf
thunderbird-debuginfo-115.3.1-1.el8_1.x86_64.rpm SHA-256: f3054f93f82faf95cfb0d424f8d3fdba977dab80cd57fba31ea2ba94a2738cdc
thunderbird-debugsource-115.3.1-1.el8_1.x86_64.rpm SHA-256: ee056257a778fa0201fd0194635f24c2fce67dc7cdb59059eb5a902ade5491b7

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.