CVE-2023-0547

OCSP revocation status of recipient certificates was not checked when sending S/Mime encrypted email, and revoked certificates would be accepted. Thunderbird versions from 68 to 102.9.1 were affected by this bug. This vulnerability affects Thunderbird < 102.10.

Mozilla Thunderbird is a standalone mail and newsgroup client.

This update upgrades Thunderbird to version 102.10.0.

Security Fix(es):

• Thunderbird: Revocation status of S/Mime recipient certificates was not checked (CVE-2023-0547)
• Mozilla: Matrix SDK bundled with Thunderbird vulnerable to denial-of-service attack (CVE-2023-28427)
• Mozilla: Fullscreen notification obscured (CVE-2023-29533)
• Mozilla: Potential Memory Corruption following Garbage Collector compaction (CVE-2023-29535)
• Mozilla: Invalid free from JavaScript code (CVE-2023-29536)
• Mozilla: Memory safety bugs fixed in Firefox 112 and Firefox ESR 102.10 (CVE-2023-29550)
• Mozilla: Memory Corruption in Safe Browsing Code (CVE-2023-1945)
• Thunderbird: Hang when processing certain OpenPGP messages (CVE-2023-29479)
• Mozilla: Content-Disposition filename truncation leads to Reflected File Download (CVE-2023-29539)
• Mozilla: Files with malicious extensions could have been downloaded unsafely on Linux (CVE-2023-29541)
• Mozilla: Incorrect optimization result on ARM64 (CVE-2023-29548)
• MFSA-TMP-2023-0001 Mozilla: Double-free in libwebp (BZ#2186102)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Mozilla Thunderbird is a standalone mail and newsgroup client.

This update upgrades Thunderbird to version 102.10.0.

Security Fix(es):

• Thunderbird: Revocation status of S/Mime recipient certificates was not checked (CVE-2023-0547)
• Mozilla: Matrix SDK bundled with Thunderbird vulnerable to denial-of-service attack (CVE-2023-28427)
• Mozilla: Fullscreen notification obscured (CVE-2023-29533)
• Mozilla: Potential Memory Corruption following Garbage Collector compaction (CVE-2023-29535)
• Mozilla: Invalid free from JavaScript code (CVE-2023-29536)
• Mozilla: Memory safety bugs fixed in Firefox 112 and Firefox ESR 102.10 (CVE-2023-29550)
• Mozilla: Memory Corruption in Safe Browsing Code (CVE-2023-1945)
• Thunderbird: Hang when processing certain OpenPGP messages (CVE-2023-29479)
• Mozilla: Content-Disposition filename truncation leads to Reflected File Download (CVE-2023-29539)
• Mozilla: Files with malicious extensions could have been downloaded unsafely on Linux (CVE-2023-29541)
• Mozilla: Incorrect optimization result on ARM64 (CVE-2023-29548)
• MFSA-TMP-2023-0001 Mozilla: Double-free in libwebp (BZ#2186102)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

• rebase from Thunderbird 115.4.1 to 140.12.0 ESR

• CVE-2022-3032: When receiving an HTML email that contained an iframe element, which used a srcdoc attribute to define the inner HTML document, remote objects specified in the nested document, for example images or videos, were not blocked

• CVE-2023-0430: Certificate OCSP revocation status was not checked when verifying S/Mime signatures

• CVE-2023-0547: OCSP revocation status of recipient certificates was not checked when sending S/Mime encrypted email, and revoked certificates would be accepted

• CVE-2023-0616: If a MIME email combines OpenPGP and OpenPGP MIME data in a certain way Thunderbird repeatedly attempts to process and display the message, which could cause Thunderbird's user interface to lock up and no longer respond to the user's actions

• CVE-2023-1945: Unexpected data returned from the Safe Browsing API could have led to memory corruption and a potentially exploitable crash

• CVE-2023-4573: When receiving rendering data over IPC mStream could have been destroyed when initialized, which could have led to a use-after-free causing a potentially exploitable crash

• CVE-2023-4574: When creating a callback over IPC for showing the Color Picker window, multiple of the same callbacks could have been created at a time and eventually all simultaneously destroyed as soon as one of the callbacks finished

• CVE-2023-4575: When creating a callback over IPC for showing the File Picker window, multiple of the same callbacks could have been created at a time and eventually all simultaneously destroyed as soon as one of the callbacks finished

• CVE-2023-4577: When UpdateRegExpStatics attempted to access initialStringHeap it could already have been garbage collected prior to entering the function, which could potentially have led to an exploitable crash

• CVE-2023-4578: When calling JS::CheckRegExpSyntax a Syntax Error could have been set which would end in calling convertToRuntimeErrorAndClear. A path in the function could attempt to allocate memory when none is available which would have caused a newly created Out of Memory exception to be mishandled as a Syntax Error

• CVE-2023-4580: Push notifications stored on disk in private browsing mode were not being encrypted potentially allowing the leak of sensitive information

• CVE-2023-4581: Excel .xll add-in files did not have a blocklist entry in Firefox's executable blocklist which allowed them to be downloaded without any warning of their potential harm

• CVE-2023-5169: A compromised content process could have provided malicious data in a PathRecording resulting in an out-of-bounds write, leading to a potentially exploitable crash in a privileged process

• CVE-2023-5171: During Ion compilation, a Garbage Collection could have resulted in a use-after-free condition, allowing an attacker to write two NUL bytes, and cause a potentially exploitable crash

• CVE-2023-5724: Drivers are not always robust to extremely large draw calls and in some cases this scenario could have led to a crash

• CVE-2023-5725: A malicious installed WebExtension could open arbitrary URLs, which under the right circumstance could be leveraged to collect sensitive user data

• CVE-2023-5732: An attacker could have created a malicious link using bidirectional characters to spoof the location in the address bar when visited

• CVE-2023-6204: On some systems—depending on the graphics settings and drivers—it was possible to force an out-of-bounds read and leak memory data into the images created on the canvas element

• CVE-2023-6205: It was possible to cause the use of a MessagePort after it had already been freed, which could potentially have led to an exploitable crash

• CVE-2023-6206: The black fade animation when exiting fullscreen is roughly the length of the anti-clickjacking delay on permission prompts

• CVE-2023-6207: Ownership…

Fullscreen notification obscured. (CVE-2023-29533) Double-free in libwebp. (MFSA-TMP-2023-0001) Potential Memory Corruption following Garbage Collector compaction. (CVE-2023-29535) Invalid free from JavaScript code. (CVE-2023-29536) Revocation status of S/Mime recipient certificates was not checked. (CVE-2023-0547) Hang when processing certain OpenPGP messages. (CVE-2023-29479) Content-Disposition filename truncation leads to Reflected File Download. (CVE-2023-29539) Files with malicious extensions could have been downloaded unsafely on Linux. (CVE-2023-29541) Memory Corruption in Safe Browsing Code. (CVE-2023-1945) Incorrect optimization result on ARM64. (CVE-2023-29548) Memory safety bugs fixed in Thunderbird 102.10. (CVE-2023-29550)

These are all security issues fixed in the MozillaThunderbird-102.10.0-1.1 package on the GA media of openSUSE Tumbleweed.

Mozilla Thunderbird is a standalone mail and newsgroup client.

This update upgrades Thunderbird to version 102.10.0.

Security Fix(es):

• Thunderbird: Revocation status of S/Mime recipient certificates was not checked (CVE-2023-0547)

• Mozilla: Matrix SDK bundled with Thunderbird vulnerable to denial-of-service attack (CVE-2023-28427)

• Mozilla: Fullscreen notification obscured (CVE-2023-29533)

• Mozilla: Potential Memory Corruption following Garbage Collector compaction (CVE-2023-29535)

• Mozilla: Invalid free from JavaScript code (CVE-2023-29536)

• Mozilla: Memory safety bugs fixed in Firefox 112 and Firefox ESR 102.10 (CVE-2023-29550)

• Mozilla: Memory Corruption in Safe Browsing Code (CVE-2023-1945)

• Thunderbird: Hang when processing certain OpenPGP messages (CVE-2023-29479)

• Mozilla: Content-Disposition filename truncation leads to Reflected File Download (CVE-2023-29539)

• Mozilla: Files with malicious extensions could have been downloaded unsafely on Linux (CVE-2023-29541)

• Mozilla: Incorrect optimization result on ARM64 (CVE-2023-29548)

• MFSA-TMP-2023-0001 Mozilla: Double-free in libwebp (BZ#2186102)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Mozilla Thunderbird is a standalone mail and newsgroup client.

This update upgrades Thunderbird to version 102.10.0.

Security Fix(es):

• Thunderbird: Revocation status of S/Mime recipient certificates was not checked (CVE-2023-0547)

• Mozilla: Matrix SDK bundled with Thunderbird vulnerable to denial-of-service attack (CVE-2023-28427)

• Mozilla: Fullscreen notification obscured (CVE-2023-29533)

• Mozilla: Potential Memory Corruption following Garbage Collector compaction (CVE-2023-29535)

• Mozilla: Invalid free from JavaScript code (CVE-2023-29536)

• Mozilla: Memory safety bugs fixed in Firefox 112 and Firefox ESR 102.10 (CVE-2023-29550)

• Mozilla: Memory Corruption in Safe Browsing Code (CVE-2023-1945)

• Thunderbird: Hang when processing certain OpenPGP messages (CVE-2023-29479)

• Mozilla: Content-Disposition filename truncation leads to Reflected File Download (CVE-2023-29539)

• Mozilla: Files with malicious extensions could have been downloaded unsafely on Linux (CVE-2023-29541)

• Mozilla: Incorrect optimization result on ARM64 (CVE-2023-29548)

• MFSA-TMP-2023-0001 Mozilla: Double-free in libwebp (BZ#2186102)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

This update for MozillaThunderbird fixes the following issues:

Update to Mozilla Thunderbird 102.10.1 (MFSA 2023-15) (bsc#1210212):

Security fixes:

• CVE-2023-29531: Out-of-bound memory access in WebGL on macOS (bmo#1794292)
• CVE-2023-29532: Mozilla Maintenance Service Write-lock bypass (bmo#1806394)
• CVE-2023-29533: Fullscreen notification obscured (bmo#1798219, bmo#1814597)
• CVE-2023-1999: Double-free in libwebp (bmo#1819244)
• CVE-2023-29535: Potential Memory Corruption following Garbage Collector compaction (bmo#1820543)
• CVE-2023-29536: Invalid free from JavaScript code (bmo#1821959)
• CVE-2023-0547: Revocation status of S/Mime recipient certificates was not checked (bmo#1811298)
• CVE-2023-29479: Hang when processing certain OpenPGP messages (bmo#1824978)
• CVE-2023-29539: Content-Disposition filename truncation leads to Reflected File Download (bmo#1784348)
• CVE-2023-29541: Files with malicious extensions could have been downloaded unsafely on Linux (bmo#1810191)
• CVE-2023-29542: Bypass of file download extension restrictions (bmo#1810793, bmo#1815062)
• CVE-2023-29545: Windows Save As dialog resolved environment variables (bmo#1823077)
• CVE-2023-1945: Memory Corruption in Safe Browsing Code (bmo#1777588)
• CVE-2023-29548: Incorrect optimization result on ARM64 (bmo#1822754)
• CVE-2023-29550: Memory safety bugs fixed in Thunderbird 102.10 (bmo#1720594, bmo#1751945, bmo#1812498, bmo#1814217, bmo#1818357, bmo#1818762, bmo#1819493, bmo#1820389, bmo#1820602, bmo#1821448, bmo#1822413, bmo#1824828)

Other fixes:

• fixed: Messages with missing or corrupt 'From:' header did not display message header buttons (bmo#1793918)
• fixed: Composer repeatedly prompted for S/MIME smartcard signing/encryption password (bmo#1828366)
• fixed: Address Book integration did not work with macOS 11.4 Bug Sur (bmo#1720257)
• fixed: Mexico City DST fix in Thunderbird 102.10.0 (bug 1826146) was incomplete (bmo#1827503)
• changed: New messages will automatically select S/MIME if configured and OpenPGP is not (bmo#1793278)
• fixed: Calendar events with timezone America/Mexico_City incorrectly applied Daylight Savings Time (bmo#1826146)
• fixed: Security fixes

Multiple security issues were discovered in Thunderbird. If a user were tricked into opening a specially crafted website in a browsing context, an attacker could potentially exploit these to cause a denial of service, obtain sensitive information, bypass security restrictions, cross-site tracing, or execute arbitrary code. (CVE-2023-1945, CVE-2023-29548, CVE-2023-29550)

Paul Menzel discovered that Thunderbird did not properly validate OCSP revocation status of recipient certificates when sending S/Mime encrypted email. An attacker could potentially exploits this issue to perform spoofing attack. (CVE-2023-0547)

Ribose RNP Team discovered that Thunderbird did not properly manage memory when parsing certain OpenPGP messages. An attacker could potentially exploits this issue to cause a denial of service. (CVE-2023-29479)

Irvan Kurniawan discovered that Thunderbird did not properly manage fullscreen notifications using a combination of window.open, fullscreen requests, window.name assignments, and setInterval calls. An attacker could potentially exploit this issue to perform spoofing attacks. (CVE-2023-29533)

Lukas Bernhard discovered that Thunderbird did not properly manage memory when doing Garbage Collector compaction. An attacker could potentially exploits this issue to cause a denial of service. (CVE-2023-29535)

Zx from qriousec discovered that Thunderbird did not properly validate the address to free a pointer provided to the memory manager. An attacker could potentially exploits this issue to cause a denial of service. (CVE-2023-29536)

Trung Pham discovered that Thunderbird did not properly validate the filename directive in the Content-Disposition header. An attacker could possibly exploit this to perform reflected file download attacks potentially tricking users to install malware. (CVE-2023-29539)

Ameen Basha M K discovered that Thunderbird did not properly validate downloads of files ending in .desktop. An attacker could potentially exploits this issue to execute arbitrary code. (CVE-2023-29541)