CVE-2020-16042

Uninitialized Use in V8 in Google Chrome prior to 87.0.4280.88 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.

Uninitialized Use in V8 in Google Chrome prior to 87.0.4280.88 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.

When a BigInt was right-shifted the backing store was not properly cleared, allowing uninitialized memory to be read (CVE-2020-16042).

Certain blit values provided by the user were not properly constrained leading to a heap buffer overflow in WebGL on some video drivers (CVE-2020-26971).

Certain input to the CSS Sanitizer confused it, resulting in incorrect components being removed. This could have been used as a sanitizer bypass (CVE-2020-26973).

When flex-basis was used on a table wrapper, a StyleGenericFlexBasis object could have been incorrectly cast to the wrong type. This resulted in a heap user-after-free, memory corruption, and a potentially exploitable crash (CVE-2020-26974).

Using techniques that built on the slipstream research, a malicious webpage could have exposed both an internal network's hosts as well as services running on the user's local machine (CVE-2020-26978).

When an extension with the proxy permission registered to receive <all_urls>, the proxy.onRequest callback was not triggered for view-source URLs. While web content cannot navigate to such URLs, a user opening View Source could have inadvertently leaked their IP address (CVE-2020-35111).

Mozilla developer Christian Holler reported memory safety bugs present in Firefox ESR 78.5. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code (CVE-2020-35113).

When a BigInt was right-shifted the backing store was not properly cleared, allowing uninitialized memory to be read (CVE-2020-16042).

Certain blit values provided by the user were not properly constrained leading to a heap buffer overflow in WebGL on some video drivers (CVE-2020-26971).

Certain input to the CSS Sanitizer confused it, resulting in incorrect components being removed. This could have been used as a sanitizer bypass (CVE-2020-26973).

When flex-basis was used on a table wrapper, a StyleGenericFlexBasis object could have been incorrectly cast to the wrong type. This resulted in a heap user-after-free, memory corruption, and a potentially exploitable crash (CVE-2020-26974).

Using techniques that built on the slipstream research, a malicious webpage could have exposed both an internal network's hosts as well as services running on the user's local machine (CVE-2020-26978).

When an extension with the proxy permission registered to receive <all_urls>, the proxy.onRequest callback was not triggered for view-source URLs. While web content cannot navigate to such URLs, a user opening View Source could have inadvertently leaked their IP address (CVE-2020-35111).

Mozilla developer Christian Holler reported memory safety bugs present in Thunderbird 78.5. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code (CVE-2020-35113).

This update for chromium fixes the following issues:

Update to 87.0.4280.88 (boo#1179576)

• CVE-2020-16037: Use after free in clipboard
• CVE-2020-16038: Use after free in media
• CVE-2020-16039: Use after free in extensions
• CVE-2020-16040: Insufficient data validation in V8
• CVE-2020-16041: Out of bounds read in networking
• CVE-2020-16042: Uninitialized Use in V8

This update for chromium fixes the following issues:

Update to 87.0.4280.88 (boo#1179576)

• CVE-2020-16037: Use after free in clipboard
• CVE-2020-16038: Use after free in media
• CVE-2020-16039: Use after free in extensions
• CVE-2020-16040: Insufficient data validation in V8
• CVE-2020-16041: Out of bounds read in networking
• CVE-2020-16042: Uninitialized Use in V8

This update was imported from the openSUSE:Leap:15.2:Update update project.

This update for chromium fixes the following issues:

Update to 87.0.4280.88 boo#1179576

• CVE-2020-16037: Use after free in clipboard
• CVE-2020-16038: Use after free in media
• CVE-2020-16039: Use after free in extensions
• CVE-2020-16040: Insufficient data validation in V8
• CVE-2020-16041: Out of bounds read in networking
• CVE-2020-16042: Uninitialized Use in V8

This update for chromium fixes the following issues:

Update to 87.0.4280.88 boo#1179576

• CVE-2020-16037: Use after free in clipboard
• CVE-2020-16038: Use after free in media
• CVE-2020-16039: Use after free in extensions
• CVE-2020-16040: Insufficient data validation in V8
• CVE-2020-16041: Out of bounds read in networking
• CVE-2020-16042: Uninitialized Use in V8

This update was imported from the openSUSE:Leap:15.1:Update update project.

This update for MozillaThunderbird fixes the following issues:

• Mozilla Thunderbird 78.6
  • new: MailExtensions: Added browser.windows.openDefaultBrowser() (bmo#1664708)
  • changed: Thunderbird now only shows quota exceeded indications on the main window (bmo#1671748)
  • changed: MailExtensions: menus API enabled in messages being composed (bmo#1670832)
  • changed: MailExtensions: Honor allowScriptsToClose argument in windows.create API function (bmo#1675940)
  • changed: MailExtensions: APIs that returned an accountId will reflect the account the message belongs to, not what is stored in message headers (bmo#1644032)
  • fixed: Keyboard shortcut for toggling message 'read' status not shown in menus (bmo#1619248)
  • fixed: OpenPGP: After importing a secret key, Key Manager displayed properties of the wrong key (bmo#1667054)
  • fixed: OpenPGP: Inline PGP parsing improvements (bmo#1660041)
  • fixed: OpenPGP: Discovering keys online via Key Manager sometimes failed on Linux (bmo#1634053)
  • fixed: OpenPGP: Encrypted attachment 'Decrypt and Open/Save As' did not work (bmo#1663169)
  • fixed: OpenPGP: Importing keys failed on macOS (bmo#1680757)
  • fixed: OpenPGP: Verification of clear signed UTF-8 text failed (bmo#1679756)
  • fixed: Address book: Some columns incorrectly displayed no data (bmo#1631201)
  • fixed: Address book: The address book view did not update after changing the name format in the menu (bmo#1678555)
  • fixed: Calendar: Could not import an ICS file into a CalDAV calendar (bmo#1652984)
  • fixed: Calendar: Two 'Home' calendars were visible on a new profile (bmo#1656782)
  • fixed: Calendar: Dark theme was incomplete on Linux (bmo#1655543)
  • fixed: Dark theme did not apply to new mail notification popups (bmo#1681083)
  • fixed: Folder icon, message list, and contact side bar visual improvements (bmo#1679436)
  • fixed: MailExtensions: HTTP refresh in browser content tabs did not work (bmo#1667774)
  • fixed: MailExtensions: messageDisplayScripts failed to run in main window (bmo#1674932)
  • fixed: Various security fixes MFSA 2020-56 (bsc#1180039)
  • CVE-2020-16042 (bmo#1679003) Operations on a BigInt could have caused uninitialized memory to be exposed
  • CVE-2020-26971 (bmo#1663466) Heap buffer overflow in WebGL
  • CVE-2020-26973 (bmo#1680084) CSS Sanitizer performed incorrect sanitization
  • CVE-2020-26974 (bmo#1681022) Incorrect cast of StyleGenericFlexBasis resulted in a heap use-after-free
  • CVE-2020-26978 (bmo#1677047) Internal network hosts could have been probed by a malicious webpage
  • CVE-2020-35111 (bmo#1657916) The proxy.onRequest API did not catch view-source URLs
  • CVE-2020-35112 (bmo#1661365) Opening an extension-less download may have inadvertently launched an executable instead
  • CVE-2020-35113 (bmo#1664831, bmo#1673589) Memory safety bugs fixed in Thunderbird 78.6

This update was imported from the SUSE:SLE-15:Update update project.

This update for MozillaFirefox fixes the following issues:

• Firefox Extended Support Release 78.6.0 ESR
  • Fixed: Various stability, functionality, and security fixes MFSA 2020-55 (bsc#1180039)
  • CVE-2020-16042 (bmo#1679003) Operations on a BigInt could have caused uninitialized memory to be exposed
  • CVE-2020-26971 (bmo#1663466) Heap buffer overflow in WebGL
  • CVE-2020-26973 (bmo#1680084) CSS Sanitizer performed incorrect sanitization
  • CVE-2020-26974 (bmo#1681022) Incorrect cast of StyleGenericFlexBasis resulted in a heap use-after-free
  • CVE-2020-26978 (bmo#1677047) Internal network hosts could have been probed by a malicious webpage
  • CVE-2020-35111 (bmo#1657916) The proxy.onRequest API did not catch view-source URLs
  • CVE-2020-35112 (bmo#1661365) Opening an extension-less download may have inadvertently launched an executable instead
  • CVE-2020-35113 (bmo#1664831, bmo#1673589) Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6

This update was imported from the SUSE:SLE-15:Update update project.

This update for MozillaThunderbird fixes the following issues:

• Mozilla Thunderbird 78.6
  • new: MailExtensions: Added browser.windows.openDefaultBrowser() (bmo#1664708)
  • changed: Thunderbird now only shows quota exceeded indications on the main window (bmo#1671748)
  • changed: MailExtensions: menus API enabled in messages being composed (bmo#1670832)
  • changed: MailExtensions: Honor allowScriptsToClose argument in windows.create API function (bmo#1675940)
  • changed: MailExtensions: APIs that returned an accountId will reflect the account the message belongs to, not what is stored in message headers (bmo#1644032)
  • fixed: Keyboard shortcut for toggling message 'read' status not shown in menus (bmo#1619248)
  • fixed: OpenPGP: After importing a secret key, Key Manager displayed properties of the wrong key (bmo#1667054)
  • fixed: OpenPGP: Inline PGP parsing improvements (bmo#1660041)
  • fixed: OpenPGP: Discovering keys online via Key Manager sometimes failed on Linux (bmo#1634053)
  • fixed: OpenPGP: Encrypted attachment 'Decrypt and Open/Save As' did not work (bmo#1663169)
  • fixed: OpenPGP: Importing keys failed on macOS (bmo#1680757)
  • fixed: OpenPGP: Verification of clear signed UTF-8 text failed (bmo#1679756)
  • fixed: Address book: Some columns incorrectly displayed no data (bmo#1631201)
  • fixed: Address book: The address book view did not update after changing the name format in the menu (bmo#1678555)
  • fixed: Calendar: Could not import an ICS file into a CalDAV calendar (bmo#1652984)
  • fixed: Calendar: Two 'Home' calendars were visible on a new profile (bmo#1656782)
  • fixed: Calendar: Dark theme was incomplete on Linux (bmo#1655543)
  • fixed: Dark theme did not apply to new mail notification popups (bmo#1681083)
  • fixed: Folder icon, message list, and contact side bar visual improvements (bmo#1679436)
  • fixed: MailExtensions: HTTP refresh in browser content tabs did not work (bmo#1667774)
  • fixed: MailExtensions: messageDisplayScripts failed to run in main window (bmo#1674932)
  • fixed: Various security fixes MFSA 2020-56 (bsc#1180039)
  • CVE-2020-16042 (bmo#1679003) Operations on a BigInt could have caused uninitialized memory to be exposed
  • CVE-2020-26971 (bmo#1663466) Heap buffer overflow in WebGL
  • CVE-2020-26973 (bmo#1680084) CSS Sanitizer performed incorrect sanitization
  • CVE-2020-26974 (bmo#1681022) Incorrect cast of StyleGenericFlexBasis resulted in a heap use-after-free
  • CVE-2020-26978 (bmo#1677047) Internal network hosts could have been probed by a malicious webpage
  • CVE-2020-35111 (bmo#1657916) The proxy.onRequest API did not catch view-source URLs
  • CVE-2020-35112 (bmo#1661365) Opening an extension-less download may have inadvertently launched an executable instead
  • CVE-2020-35113 (bmo#1664831, bmo#1673589) Memory safety bugs fixed in Thunderbird 78.6

This update was imported from the SUSE:SLE-15:Update update project.

This update for MozillaFirefox fixes the following issues:

• Firefox Extended Support Release 78.6.0 ESR
  • Fixed: Various stability, functionality, and security fixes MFSA 2020-55 (bsc#1180039)
  • CVE-2020-16042 (bmo#1679003) Operations on a BigInt could have caused uninitialized memory to be exposed
  • CVE-2020-26971 (bmo#1663466) Heap buffer overflow in WebGL
  • CVE-2020-26973 (bmo#1680084) CSS Sanitizer performed incorrect sanitization
  • CVE-2020-26974 (bmo#1681022) Incorrect cast of StyleGenericFlexBasis resulted in a heap use-after-free
  • CVE-2020-26978 (bmo#1677047) Internal network hosts could have been probed by a malicious webpage
  • CVE-2020-35111 (bmo#1657916) The proxy.onRequest API did not catch view-source URLs
  • CVE-2020-35112 (bmo#1661365) Opening an extension-less download may have inadvertently launched an executable instead
  • CVE-2020-35113 (bmo#1664831, bmo#1673589) Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6

This update was imported from the SUSE:SLE-15:Update update project.

This update for opera fixes the following issues:

• Update to version 73.0.3856.284

  • CHR-8225 Update chromium on desktop-stable-87-3856 to 87.0.4280.88
  • DNA-88454 Background of snap area above visible scrolled viewport is not captured
  • DNA-89749 Implement client_capabilities support for Flow / Sync
  • DNA-89810 Opera no longer autoselects full url/address bar when clicked
  • DNA-89923 [Snap] Emojis look grayed out
  • DNA-90060 Make gesture events work with search-in-tabs feature
  • DNA-90168 Display SD suggestions titles
  • DNA-90176 Player doesn’t show music service to choose on Welcome page
  • DNA-90343 [Mac] Cmd+C doesn’t copy snapshot
  • DNA-90538 Crash at extensions::CommandService:: GetExtensionActionCommand(std::__1::basic_string const&, extensions::ActionInfo::Type, extensions::CommandService:: QueryType, extensions::Command*, bool*)

• The update to chromium 87.0.4280.88 fixes following issues:
  CVE-2020-16037, CVE-2020-16038, CVE-2020-16039, CVE-2020-16040, CVE-2020-16041, CVE-2020-16042

• Update to version 73.0.3856.257

  • DNA-89918 #enable-force-dark flag doesn’t work anymore
  • DNA-90061 Clicking on video’s progress bar breaks autopausing
  • DNA-90079 [BigSur] Blank pages
  • DNA-90154 Crash at extensions::CommandService:: GetExtensionActionCommand(std::__1::basic_string const&, extensions::ActionInfo::Type, extensions::CommandService:: QueryType, extensions::Command*, bool*)

• Complete Opera 73.0 changelog at: https://blogs.opera.com/desktop/changelog-for-73/

This update for opera fixes the following issues:

• Update to version 73.0.3856.284

  • CHR-8225 Update chromium on desktop-stable-87-3856 to 87.0.4280.88
  • DNA-88454 Background of snap area above visible scrolled viewport is not captured
  • DNA-89749 Implement client_capabilities support for Flow / Sync
  • DNA-89810 Opera no longer autoselects full url/address bar when clicked
  • DNA-89923 [Snap] Emojis look grayed out
  • DNA-90060 Make gesture events work with search-in-tabs feature
  • DNA-90168 Display SD suggestions titles
  • DNA-90176 Player doesn’t show music service to choose on Welcome page
  • DNA-90343 [Mac] Cmd+C doesn’t copy snapshot
  • DNA-90538 Crash at extensions::CommandService:: GetExtensionActionCommand(std::__1::basic_string const&, extensions::ActionInfo::Type, extensions::CommandService:: QueryType, extensions::Command*, bool*)

• The update to chromium 87.0.4280.88 fixes following issues:
  CVE-2020-16037, CVE-2020-16038, CVE-2020-16039, CVE-2020-16040, CVE-2020-16041, CVE-2020-16042

• Update to version 73.0.3856.257

  • DNA-89918 #enable-force-dark flag doesn’t work anymore
  • DNA-90061 Clicking on video’s progress bar breaks autopausing
  • DNA-90079 [BigSur] Blank pages
  • DNA-90154 Crash at extensions::CommandService:: GetExtensionActionCommand(std::__1::basic_string const&, extensions::ActionInfo::Type, extensions::CommandService:: QueryType, extensions::Command*, bool*)

• Complete Opera 73.0 changelog at: https://blogs.opera.com/desktop/changelog-for-73/

These are all security issues fixed in the MozillaFirefox-92.0-1.2 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the MozillaThunderbird-91.1.1-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the chromedriver-93.0.4577.82-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the ungoogled-chromium-113.0.5672.92-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the firefox-esr-128.5.1-1.1 package on the GA media of openSUSE Tumbleweed.

This update for MozillaFirefox fixes the following issues:

• Firefox Extended Support Release 78.6.0 ESR
  • Fixed: Various stability, functionality, and security fixes MFSA 2020-55 (bsc#1180039)
  • CVE-2020-16042 (bmo#1679003) Operations on a BigInt could have caused uninitialized memory to be exposed
  • CVE-2020-26971 (bmo#1663466) Heap buffer overflow in WebGL
  • CVE-2020-26973 (bmo#1680084) CSS Sanitizer performed incorrect sanitization
  • CVE-2020-26974 (bmo#1681022) Incorrect cast of StyleGenericFlexBasis resulted in a heap use-after-free
  • CVE-2020-26978 (bmo#1677047) Internal network hosts could have been probed by a malicious webpage
  • CVE-2020-35111 (bmo#1657916) The proxy.onRequest API did not catch view-source URLs
  • CVE-2020-35112 (bmo#1661365) Opening an extension-less download may have inadvertently launched an executable instead
  • CVE-2020-35113 (bmo#1664831, bmo#1673589) Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6

This update for MozillaThunderbird fixes the following issues:

• Mozilla Thunderbird 78.6
  • new: MailExtensions: Added browser.windows.openDefaultBrowser() (bmo#1664708)
  • changed: Thunderbird now only shows quota exceeded indications on the main window (bmo#1671748)
  • changed: MailExtensions: menus API enabled in messages being composed (bmo#1670832)
  • changed: MailExtensions: Honor allowScriptsToClose argument in windows.create API function (bmo#1675940)
  • changed: MailExtensions: APIs that returned an accountId will reflect the account the message belongs to, not what is stored in message headers (bmo#1644032)
  • fixed: Keyboard shortcut for toggling message 'read' status not shown in menus (bmo#1619248)
  • fixed: OpenPGP: After importing a secret key, Key Manager displayed properties of the wrong key (bmo#1667054)
  • fixed: OpenPGP: Inline PGP parsing improvements (bmo#1660041)
  • fixed: OpenPGP: Discovering keys online via Key Manager sometimes failed on Linux (bmo#1634053)
  • fixed: OpenPGP: Encrypted attachment 'Decrypt and Open/Save As' did not work (bmo#1663169)
  • fixed: OpenPGP: Importing keys failed on macOS (bmo#1680757)
  • fixed: OpenPGP: Verification of clear signed UTF-8 text failed (bmo#1679756)
  • fixed: Address book: Some columns incorrectly displayed no data (bmo#1631201)
  • fixed: Address book: The address book view did not update after changing the name format in the menu (bmo#1678555)
  • fixed: Calendar: Could not import an ICS file into a CalDAV calendar (bmo#1652984)
  • fixed: Calendar: Two 'Home' calendars were visible on a new profile (bmo#1656782)
  • fixed: Calendar: Dark theme was incomplete on Linux (bmo#1655543)
  • fixed: Dark theme did not apply to new mail notification popups (bmo#1681083)
  • fixed: Folder icon, message list, and contact side bar visual improvements (bmo#1679436)
  • fixed: MailExtensions: HTTP refresh in browser content tabs did not work (bmo#1667774)
  • fixed: MailExtensions: messageDisplayScripts failed to run in main window (bmo#1674932)
  • fixed: Various security fixes MFSA 2020-56 (bsc#1180039)
  • CVE-2020-16042 (bmo#1679003) Operations on a BigInt could have caused uninitialized memory to be exposed
  • CVE-2020-26971 (bmo#1663466) Heap buffer overflow in WebGL
  • CVE-2020-26973 (bmo#1680084) CSS Sanitizer performed incorrect sanitization
  • CVE-2020-26974 (bmo#1681022) Incorrect cast of StyleGenericFlexBasis resulted in a heap use-after-free
  • CVE-2020-26978 (bmo#1677047) Internal network hosts could have been probed by a malicious webpage
  • CVE-2020-35111 (bmo#1657916) The proxy.onRequest API did not catch view-source URLs
  • CVE-2020-35112 (bmo#1661365) Opening an extension-less download may have inadvertently launched an executable instead
  • CVE-2020-35113 (bmo#1664831, bmo#1673589) Memory safety bugs fixed in Thunderbird 78.6

This update for MozillaFirefox fixes the following issues:

• Firefox Extended Support Release 78.6.0 ESR
  • Fixed: Various stability, functionality, and security fixes MFSA 2020-55 (bsc#1180039)
  • CVE-2020-16042 (bmo#1679003) Operations on a BigInt could have caused uninitialized memory to be exposed
  • CVE-2020-26971 (bmo#1663466) Heap buffer overflow in WebGL
  • CVE-2020-26973 (bmo#1680084) CSS Sanitizer performed incorrect sanitization
  • CVE-2020-26974 (bmo#1681022) Incorrect cast of StyleGenericFlexBasis resulted in a heap use-after-free
  • CVE-2020-26978 (bmo#1677047) Internal network hosts could have been probed by a malicious webpage
  • CVE-2020-35111 (bmo#1657916) The proxy.onRequest API did not catch view-source URLs
  • CVE-2020-35112 (bmo#1661365) Opening an extension-less download may have inadvertently launched an executable instead
  • CVE-2020-35113 (bmo#1664831, bmo#1673589) Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6

This update for MozillaFirefox fixes the following issues:

• Firefox Extended Support Release 78.6.0 ESR
  • Fixed: Various stability, functionality, and security fixes MFSA 2020-55 (bsc#1180039)
  • CVE-2020-16042 (bmo#1679003) Operations on a BigInt could have caused uninitialized memory to be exposed
  • CVE-2020-26971 (bmo#1663466) Heap buffer overflow in WebGL
  • CVE-2020-26973 (bmo#1680084) CSS Sanitizer performed incorrect sanitization
  • CVE-2020-26974 (bmo#1681022) Incorrect cast of StyleGenericFlexBasis resulted in a heap use-after-free
  • CVE-2020-26978 (bmo#1677047) Internal network hosts could have been probed by a malicious webpage
  • CVE-2020-35111 (bmo#1657916) The proxy.onRequest API did not catch view-source URLs
  • CVE-2020-35112 (bmo#1661365) Opening an extension-less download may have inadvertently launched an executable instead
  • CVE-2020-35113 (bmo#1664831, bmo#1673589) Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6

This update for MozillaFirefox fixes the following issues:

• Firefox Extended Support Release 78.6.0 ESR
  • Fixed: Various stability, functionality, and security fixes MFSA 2020-55 (bsc#1180039)
  • CVE-2020-16042 (bmo#1679003) Operations on a BigInt could have caused uninitialized memory to be exposed
  • CVE-2020-26971 (bmo#1663466) Heap buffer overflow in WebGL
  • CVE-2020-26973 (bmo#1680084) CSS Sanitizer performed incorrect sanitization
  • CVE-2020-26974 (bmo#1681022) Incorrect cast of StyleGenericFlexBasis resulted in a heap use-after-free
  • CVE-2020-26978 (bmo#1677047) Internal network hosts could have been probed by a malicious webpage
  • CVE-2020-35111 (bmo#1657916) The proxy.onRequest API did not catch view-source URLs
  • CVE-2020-35112 (bmo#1661365) Opening an extension-less download may have inadvertently launched an executable instead
  • CVE-2020-35113 (bmo#1664831, bmo#1673589) Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6

This update for MozillaThunderbird fixes the following issues:

• Mozilla Thunderbird 78.6
  • new: MailExtensions: Added browser.windows.openDefaultBrowser() (bmo#1664708)
  • changed: Thunderbird now only shows quota exceeded indications on the main window (bmo#1671748)
  • changed: MailExtensions: menus API enabled in messages being composed (bmo#1670832)
  • changed: MailExtensions: Honor allowScriptsToClose argument in windows.create API function (bmo#1675940)
  • changed: MailExtensions: APIs that returned an accountId will reflect the account the message belongs to, not what is stored in message headers (bmo#1644032)
  • fixed: Keyboard shortcut for toggling message 'read' status not shown in menus (bmo#1619248)
  • fixed: OpenPGP: After importing a secret key, Key Manager displayed properties of the wrong key (bmo#1667054)
  • fixed: OpenPGP: Inline PGP parsing improvements (bmo#1660041)
  • fixed: OpenPGP: Discovering keys online via Key Manager sometimes failed on Linux (bmo#1634053)
  • fixed: OpenPGP: Encrypted attachment 'Decrypt and Open/Save As' did not work (bmo#1663169)
  • fixed: OpenPGP: Importing keys failed on macOS (bmo#1680757)
  • fixed: OpenPGP: Verification of clear signed UTF-8 text failed (bmo#1679756)
  • fixed: Address book: Some columns incorrectly displayed no data (bmo#1631201)
  • fixed: Address book: The address book view did not update after changing the name format in the menu (bmo#1678555)
  • fixed: Calendar: Could not import an ICS file into a CalDAV calendar (bmo#1652984)
  • fixed: Calendar: Two 'Home' calendars were visible on a new profile (bmo#1656782)
  • fixed: Calendar: Dark theme was incomplete on Linux (bmo#1655543)
  • fixed: Dark theme did not apply to new mail notification popups (bmo#1681083)
  • fixed: Folder icon, message list, and contact side bar visual improvements (bmo#1679436)
  • fixed: MailExtensions: HTTP refresh in browser content tabs did not work (bmo#1667774)
  • fixed: MailExtensions: messageDisplayScripts failed to run in main window (bmo#1674932)
  • fixed: Various security fixes MFSA 2020-56 (bsc#1180039)
  • CVE-2020-16042 (bmo#1679003) Operations on a BigInt could have caused uninitialized memory to be exposed
  • CVE-2020-26971 (bmo#1663466) Heap buffer overflow in WebGL
  • CVE-2020-26973 (bmo#1680084) CSS Sanitizer performed incorrect sanitization
  • CVE-2020-26974 (bmo#1681022) Incorrect cast of StyleGenericFlexBasis resulted in a heap use-after-free
  • CVE-2020-26978 (bmo#1677047) Internal network hosts could have been probed by a malicious webpage
  • CVE-2020-35111 (bmo#1657916) The proxy.onRequest API did not catch view-source URLs
  • CVE-2020-35112 (bmo#1661365) Opening an extension-less download may have inadvertently launched an executable instead
  • CVE-2020-35113 (bmo#1664831, bmo#1673589) Memory safety bugs fixed in Thunderbird 78.6

Mozilla Thunderbird 78.5.1

• new: OpenPGP: Added option to disable email subject encryption (bmo#1666073)
• changed: OpenPGP public key import now supports multi-file selection and bulk accepting imported keys (bmo#1665145)
• changed: MailExtensions: getComposeDetails will wait for 'compose-editor-ready' event (bmo#1675012)
• fixed: New mail icon was not removed from the system tray at shutdown (bmo#1664586)
• fixed: 'Place replies in the folder of the message being replied to' did not work when using 'Reply to List' (bmo#522450)
• fixed: Thunderbird did not honor the 'Run search on server' option when searching messages (bmo#546925)
• fixed: Highlight color for folders with unread messages wasn't visible in dark theme (bmo#1676697)
• fixed: OpenPGP: Key were missing from Key Manager (bmo#1674521)
• fixed: OpenPGP: Option to import keys from clipboard always disabled (bmo#1676842)
• fixed: The 'Link' button on the large attachments info bar failed to open…

Multiple security issues were discovered in Firefox. If a user were tricked into opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service, obtain sensitive information, bypass the CSS sanitizer, bypass security restrictions, spoof the URL bar, or execute arbitrary code. (CVE-2020-16042, CVE-2020-26971, CVE-2020-26972, CVE-2020-26793, CVE-2020-26974, CVE-2020-26976, CVE-2020-26978, CVE-2020-26979, CVE-2020-35113, CVE-2020-35114)

It was discovered that the proxy.onRequest API did not catch view-source URLs. If a user were tricked in to installing an extension with the proxy permission and opening View Source, an attacker could potentially exploit this to obtain sensitive information. (CVE-2020-35111)