CVE-2023-29479

Ribose RNP before 0.16.3 may hang when the input is malformed.

Mozilla Thunderbird is a standalone mail and newsgroup client.

This update upgrades Thunderbird to version 102.10.0.

Security Fix(es):

• Thunderbird: Revocation status of S/Mime recipient certificates was not checked (CVE-2023-0547)
• Mozilla: Matrix SDK bundled with Thunderbird vulnerable to denial-of-service attack (CVE-2023-28427)
• Mozilla: Fullscreen notification obscured (CVE-2023-29533)
• Mozilla: Potential Memory Corruption following Garbage Collector compaction (CVE-2023-29535)
• Mozilla: Invalid free from JavaScript code (CVE-2023-29536)
• Mozilla: Memory safety bugs fixed in Firefox 112 and Firefox ESR 102.10 (CVE-2023-29550)
• Mozilla: Memory Corruption in Safe Browsing Code (CVE-2023-1945)
• Thunderbird: Hang when processing certain OpenPGP messages (CVE-2023-29479)
• Mozilla: Content-Disposition filename truncation leads to Reflected File Download (CVE-2023-29539)
• Mozilla: Files with malicious extensions could have been downloaded unsafely on Linux (CVE-2023-29541)
• Mozilla: Incorrect optimization result on ARM64 (CVE-2023-29548)
• MFSA-TMP-2023-0001 Mozilla: Double-free in libwebp (BZ#2186102)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Mozilla Thunderbird is a standalone mail and newsgroup client.

This update upgrades Thunderbird to version 102.10.0.

Security Fix(es):

• Thunderbird: Revocation status of S/Mime recipient certificates was not checked (CVE-2023-0547)
• Mozilla: Matrix SDK bundled with Thunderbird vulnerable to denial-of-service attack (CVE-2023-28427)
• Mozilla: Fullscreen notification obscured (CVE-2023-29533)
• Mozilla: Potential Memory Corruption following Garbage Collector compaction (CVE-2023-29535)
• Mozilla: Invalid free from JavaScript code (CVE-2023-29536)
• Mozilla: Memory safety bugs fixed in Firefox 112 and Firefox ESR 102.10 (CVE-2023-29550)
• Mozilla: Memory Corruption in Safe Browsing Code (CVE-2023-1945)
• Thunderbird: Hang when processing certain OpenPGP messages (CVE-2023-29479)
• Mozilla: Content-Disposition filename truncation leads to Reflected File Download (CVE-2023-29539)
• Mozilla: Files with malicious extensions could have been downloaded unsafely on Linux (CVE-2023-29541)
• Mozilla: Incorrect optimization result on ARM64 (CVE-2023-29548)
• MFSA-TMP-2023-0001 Mozilla: Double-free in libwebp (BZ#2186102)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fullscreen notification obscured. (CVE-2023-29533) Double-free in libwebp. (MFSA-TMP-2023-0001) Potential Memory Corruption following Garbage Collector compaction. (CVE-2023-29535) Invalid free from JavaScript code. (CVE-2023-29536) Revocation status of S/Mime recipient certificates was not checked. (CVE-2023-0547) Hang when processing certain OpenPGP messages. (CVE-2023-29479) Content-Disposition filename truncation leads to Reflected File Download. (CVE-2023-29539) Files with malicious extensions could have been downloaded unsafely on Linux. (CVE-2023-29541) Memory Corruption in Safe Browsing Code. (CVE-2023-1945) Incorrect optimization result on ARM64. (CVE-2023-29548) Memory safety bugs fixed in Thunderbird 102.10. (CVE-2023-29550)

These are all security issues fixed in the MozillaThunderbird-102.10.0-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the librnp0-0.16.3-1.1 package on the GA media of openSUSE Tumbleweed.

Mozilla Thunderbird is a standalone mail and newsgroup client.

This update upgrades Thunderbird to version 102.10.0.

Security Fix(es):

• Thunderbird: Revocation status of S/Mime recipient certificates was not checked (CVE-2023-0547)

• Mozilla: Matrix SDK bundled with Thunderbird vulnerable to denial-of-service attack (CVE-2023-28427)

• Mozilla: Fullscreen notification obscured (CVE-2023-29533)

• Mozilla: Potential Memory Corruption following Garbage Collector compaction (CVE-2023-29535)

• Mozilla: Invalid free from JavaScript code (CVE-2023-29536)

• Mozilla: Memory safety bugs fixed in Firefox 112 and Firefox ESR 102.10 (CVE-2023-29550)

• Mozilla: Memory Corruption in Safe Browsing Code (CVE-2023-1945)

• Thunderbird: Hang when processing certain OpenPGP messages (CVE-2023-29479)

• Mozilla: Content-Disposition filename truncation leads to Reflected File Download (CVE-2023-29539)

• Mozilla: Files with malicious extensions could have been downloaded unsafely on Linux (CVE-2023-29541)

• Mozilla: Incorrect optimization result on ARM64 (CVE-2023-29548)

• MFSA-TMP-2023-0001 Mozilla: Double-free in libwebp (BZ#2186102)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Mozilla Thunderbird is a standalone mail and newsgroup client.

This update upgrades Thunderbird to version 102.10.0.

Security Fix(es):

• Thunderbird: Revocation status of S/Mime recipient certificates was not checked (CVE-2023-0547)

• Mozilla: Matrix SDK bundled with Thunderbird vulnerable to denial-of-service attack (CVE-2023-28427)

• Mozilla: Fullscreen notification obscured (CVE-2023-29533)

• Mozilla: Potential Memory Corruption following Garbage Collector compaction (CVE-2023-29535)

• Mozilla: Invalid free from JavaScript code (CVE-2023-29536)

• Mozilla: Memory safety bugs fixed in Firefox 112 and Firefox ESR 102.10 (CVE-2023-29550)

• Mozilla: Memory Corruption in Safe Browsing Code (CVE-2023-1945)

• Thunderbird: Hang when processing certain OpenPGP messages (CVE-2023-29479)

• Mozilla: Content-Disposition filename truncation leads to Reflected File Download (CVE-2023-29539)

• Mozilla: Files with malicious extensions could have been downloaded unsafely on Linux (CVE-2023-29541)

• Mozilla: Incorrect optimization result on ARM64 (CVE-2023-29548)

• MFSA-TMP-2023-0001 Mozilla: Double-free in libwebp (BZ#2186102)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

This update for MozillaThunderbird fixes the following issues:

Update to Mozilla Thunderbird 102.10.1 (MFSA 2023-15) (bsc#1210212):

Security fixes:

• CVE-2023-29531: Out-of-bound memory access in WebGL on macOS (bmo#1794292)
• CVE-2023-29532: Mozilla Maintenance Service Write-lock bypass (bmo#1806394)
• CVE-2023-29533: Fullscreen notification obscured (bmo#1798219, bmo#1814597)
• CVE-2023-1999: Double-free in libwebp (bmo#1819244)
• CVE-2023-29535: Potential Memory Corruption following Garbage Collector compaction (bmo#1820543)
• CVE-2023-29536: Invalid free from JavaScript code (bmo#1821959)
• CVE-2023-0547: Revocation status of S/Mime recipient certificates was not checked (bmo#1811298)
• CVE-2023-29479: Hang when processing certain OpenPGP messages (bmo#1824978)
• CVE-2023-29539: Content-Disposition filename truncation leads to Reflected File Download (bmo#1784348)
• CVE-2023-29541: Files with malicious extensions could have been downloaded unsafely on Linux (bmo#1810191)
• CVE-2023-29542: Bypass of file download extension restrictions (bmo#1810793, bmo#1815062)
• CVE-2023-29545: Windows Save As dialog resolved environment variables (bmo#1823077)
• CVE-2023-1945: Memory Corruption in Safe Browsing Code (bmo#1777588)
• CVE-2023-29548: Incorrect optimization result on ARM64 (bmo#1822754)
• CVE-2023-29550: Memory safety bugs fixed in Thunderbird 102.10 (bmo#1720594, bmo#1751945, bmo#1812498, bmo#1814217, bmo#1818357, bmo#1818762, bmo#1819493, bmo#1820389, bmo#1820602, bmo#1821448, bmo#1822413, bmo#1824828)

Other fixes:

• fixed: Messages with missing or corrupt 'From:' header did not display message header buttons (bmo#1793918)
• fixed: Composer repeatedly prompted for S/MIME smartcard signing/encryption password (bmo#1828366)
• fixed: Address Book integration did not work with macOS 11.4 Bug Sur (bmo#1720257)
• fixed: Mexico City DST fix in Thunderbird 102.10.0 (bug 1826146) was incomplete (bmo#1827503)
• changed: New messages will automatically select S/MIME if configured and OpenPGP is not (bmo#1793278)
• fixed: Calendar events with timezone America/Mexico_City incorrectly applied Daylight Savings Time (bmo#1826146)
• fixed: Security fixes

Multiple security issues were discovered in Thunderbird. If a user were tricked into opening a specially crafted website in a browsing context, an attacker could potentially exploit these to cause a denial of service, obtain sensitive information, bypass security restrictions, cross-site tracing, or execute arbitrary code. (CVE-2023-1945, CVE-2023-29548, CVE-2023-29550)

Paul Menzel discovered that Thunderbird did not properly validate OCSP revocation status of recipient certificates when sending S/Mime encrypted email. An attacker could potentially exploits this issue to perform spoofing attack. (CVE-2023-0547)

Ribose RNP Team discovered that Thunderbird did not properly manage memory when parsing certain OpenPGP messages. An attacker could potentially exploits this issue to cause a denial of service. (CVE-2023-29479)

Irvan Kurniawan discovered that Thunderbird did not properly manage fullscreen notifications using a combination of window.open, fullscreen requests, window.name assignments, and setInterval calls. An attacker could potentially exploit this issue to perform spoofing attacks. (CVE-2023-29533)

Lukas Bernhard discovered that Thunderbird did not properly manage memory when doing Garbage Collector compaction. An attacker could potentially exploits this issue to cause a denial of service. (CVE-2023-29535)

Zx from qriousec discovered that Thunderbird did not properly validate the address to free a pointer provided to the memory manager. An attacker could potentially exploits this issue to cause a denial of service. (CVE-2023-29536)

Trung Pham discovered that Thunderbird did not properly validate the filename directive in the Content-Disposition header. An attacker could possibly exploit this to perform reflected file download attacks potentially tricking users to install malware. (CVE-2023-29539)

Ameen Basha M K discovered that Thunderbird did not properly validate downloads of files ending in .desktop. An attacker could potentially exploits this issue to execute arbitrary code. (CVE-2023-29541)