CVE-2023-3417

Mozilla Thunderbird is a standalone mail and newsgroup client.

This update upgrades Thunderbird to version 102.14.0.

Security Fix(es):

• Mozilla: Offscreen Canvas could have bypassed cross-origin restrictions (CVE-2023-4045)

• Mozilla: Incorrect value used during WASM compilation (CVE-2023-4046)

• Mozilla: Potential permissions request bypass via clickjacking (CVE-2023-4047)

• Mozilla: Crash in DOMParser due to out-of-memory conditions (CVE-2023-4048)

• Mozilla: Fix potential race conditions when releasing platform objects (CVE-2023-4049)

• Mozilla: Stack buffer overflow in StorageManager (CVE-2023-4050)

• Mozilla: Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1, Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14 (CVE-2023-4056)

• Mozilla: Memory safety bugs fixed in Firefox ESR 115.1, and Thunderbird 115.1 (CVE-2023-4057)

• thunderbird: File Extension Spoofing using the Text Direction Override Character (CVE-2023-3417)

• Mozilla: Cookie jar overflow caused unexpected cookie jar state (CVE-2023-4055)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Mozilla Thunderbird is a standalone mail and newsgroup client.

This update upgrades Thunderbird to version 102.14.0.

Security Fix(es):

• Mozilla: Offscreen Canvas could have bypassed cross-origin restrictions (CVE-2023-4045)

• Mozilla: Incorrect value used during WASM compilation (CVE-2023-4046)

• Mozilla: Potential permissions request bypass via clickjacking (CVE-2023-4047)

• Mozilla: Crash in DOMParser due to out-of-memory conditions (CVE-2023-4048)

• Mozilla: Fix potential race conditions when releasing platform objects (CVE-2023-4049)

• Mozilla: Stack buffer overflow in StorageManager (CVE-2023-4050)

• Mozilla: Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1, Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14 (CVE-2023-4056)

• Mozilla: Memory safety bugs fixed in Firefox ESR 115.1, and Thunderbird 115.1 (CVE-2023-4057)

• thunderbird: File Extension Spoofing using the Text Direction Override Character (CVE-2023-3417)

• Mozilla: Cookie jar overflow caused unexpected cookie jar state (CVE-2023-4055)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Thunderbird allowed the Text Direction Override Unicode Character in filenames. An email attachment could be incorrectly shown as being a document file, while in fact it was an executable file. Newer versions of Thunderbird will strip the character and show the correct file extension. This vulnerability affects Thunderbird < 115.0.1 and Thunderbird < 102.13.1.

Mozilla Thunderbird is a standalone mail and newsgroup client.

This update upgrades Thunderbird to version 102.14.0.

Security Fix(es):

• Mozilla: Offscreen Canvas could have bypassed cross-origin restrictions (CVE-2023-4045)
• Mozilla: Incorrect value used during WASM compilation (CVE-2023-4046)
• Mozilla: Potential permissions request bypass via clickjacking (CVE-2023-4047)
• Mozilla: Crash in DOMParser due to out-of-memory conditions (CVE-2023-4048)
• Mozilla: Fix potential race conditions when releasing platform objects (CVE-2023-4049)
• Mozilla: Stack buffer overflow in StorageManager (CVE-2023-4050)
• Mozilla: Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1, Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14 (CVE-2023-4056)
• Mozilla: Memory safety bugs fixed in Firefox ESR 115.1, and Thunderbird 115.1 (CVE-2023-4057)
• thunderbird: File Extension Spoofing using the Text Direction Override Character (CVE-2023-3417)
• Mozilla: Cookie jar overflow caused unexpected cookie jar state (CVE-2023-4055)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Mozilla Thunderbird is a standalone mail and newsgroup client.

This update upgrades Thunderbird to version 102.14.0.

Security Fix(es):

• Mozilla: Offscreen Canvas could have bypassed cross-origin restrictions (CVE-2023-4045)
• Mozilla: Incorrect value used during WASM compilation (CVE-2023-4046)
• Mozilla: Potential permissions request bypass via clickjacking (CVE-2023-4047)
• Mozilla: Crash in DOMParser due to out-of-memory conditions (CVE-2023-4048)
• Mozilla: Fix potential race conditions when releasing platform objects (CVE-2023-4049)
• Mozilla: Stack buffer overflow in StorageManager (CVE-2023-4050)
• Mozilla: Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1, Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14 (CVE-2023-4056)
• Mozilla: Memory safety bugs fixed in Firefox ESR 115.1, and Thunderbird 115.1 (CVE-2023-4057)
• thunderbird: File Extension Spoofing using the Text Direction Override Character (CVE-2023-3417)
• Mozilla: Cookie jar overflow caused unexpected cookie jar state (CVE-2023-4055)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Use-after-free in workers. (CVE-2023-3600)

File Extension Spoofing using the Text Direction Override Character. (CVE-2023-3417)

Offscreen Canvas could have bypassed cross-origin restrictions. (CVE-2023-4045)

Incorrect value used during WASM compilation. (CVE-2023-4046)

Potential permissions request bypass via clickjacking. (CVE-2023-4047)

Crash in DOMParser due to out-of-memory conditions. (CVE-2023-4048)

Fix potential race conditions when releasing platform objects. (CVE-2023-4049)

Stack buffer overflow in StorageManager. (CVE-2023-4050)

Cookie jar overflow caused unexpected cookie jar state. (CVE-2023-4055)

Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1, Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14. (CVE-2023-4056)

Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1, and Thunderbird 115.1. (CVE-2023-4057)

Memory corruption in IPC CanvasTranslator. (CVE-2023-4573)

Memory corruption in IPC ColorPickerShownCallback. (CVE-2023-4574)

Memory corruption in IPC FilePickerShownCallback. (CVE-2023-4575)

Integer Overflow in RecordedSourceSurfaceCreation. (CVE-2023-4576)

Memory corruption in JIT UpdateRegExpStatics. (CVE-2023-4577)

Full screen notification obscured by file open dialog. (CVE-2023-4051)

Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception. (CVE-2023-4578)

Full screen notification obscured by external program. (CVE-2023-4053)

Push notifications saved to disk unencrypted. (CVE-2023-4580)

XLL file extensions were downloadable without warnings. (CVE-2023-4581)

Browsing Context potentially not cleared when closing Private Window. (CVE-2023-4583)

Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15, Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2. (CVE-2023-4584)

Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2, and Thunderbird 115.2. (CVE-2023-4585)

Heap buffer overflow in libwebp. (CVE-2023-4863)

These are all security issues fixed in the MozillaThunderbird-102.13.1-1.1 package on the GA media of openSUSE Tumbleweed.

This update for MozillaThunderbird fixes the following issues:

Mozilla Thunderbird was updated to version 115.0.1 (bsc#1212438):

• CVE-2023-3600: Fixed use-after-free in workers (bmo#1839703).
• CVE-2023-3417: Fixed File Extension Spoofing using the Text Direction Override Character (bmo#1835582).

Bugfixes:

• changed: Added Thunderbird Supernova branding to about:dialog (bmo#1842102)
• fixed: Message list was not updated when message was deleted from server outside of Thunderbird (bmo#1837041)
• fixed: Scrolling behaved unexpectedly when moving to next message unread message in another folder (bmo#1841711)
• fixed: Scrolling animation was unnecessarily used when switching or toggling the sort column in message list (bmo#1838522)
• fixed: Attempting to delete a message and then cancelling the action still marked the message as read (bmo#793353)
• fixed: Unified Toolbar could not be customized under certain tabs (bmo#1841480)
• fixed: Selecting a folder with one or more subfolders and pressing enter did not expand folder (bmo#1841200)
• fixed: Tooltips did not appear when hovering over folders (bmo#1839780)
• fixed: Deleting large amounts of messages from Trash folder consumed excessive time and memory (bmo#1833665)
• fixed: Message Summary header buttons were not keyboard accessible (bmo#1827199)
• fixed: 'New' button in Message Filters dialog was not keyboard accessible (bmo#1841477)
• fixed: Backing up secret keys from OpenPGP Key Manager dialog silently failed (bmo#1839415)
• fixed: Various visual and UX improvements (bmo#1843172,bmo#1831422,bmo#1838360,bmo#1842319)

Junsung Lee discovered that Thunderbird did not properly validate the text direction override unicode character in filenames. An attacker could potentially exploits this issue by spoofing file extension while attaching a file in emails. (CVE-2023-3417)

Max Vlasov discovered that Thunderbird Offscreen Canvas did not properly track cross-origin tainting. An attacker could potentially exploit this issue to access image data from another site in violation of same-origin policy. (CVE-2023-4045)

Alexander Guryanov discovered that Thunderbird did not properly update the value of a global variable in WASM JIT analysis in some circumstances. An attacker could potentially exploit this issue to cause a denial of service. (CVE-2023-4046)

Mark Brand discovered that Thunderbird did not properly validate the size of an untrusted input stream. An attacker could potentially exploit this issue to cause a denial of service. (CVE-2023-4050)

Multiple security issues were discovered in Thunderbird. If a user were tricked into opening a specially crafted website in a browsing context, an attacker could potentially exploit these to cause a denial of service, obtain sensitive information, bypass security restrictions, cross-site tracing, or execute arbitrary code. (CVE-2023-4047, CVE-2023-4048, CVE-2023-4049, CVE-2023-4055, CVE-2023-4056)