This update for MozillaThunderbird to version 60.5.1 fixes the following issues :

Security vulnerabilities addressed (MSFA 2019-03 MSFA 2018-31 MFSA 2019-06 bsc#1122983 bsc#1119105 bsc#1125330) :

  - CVE-2018-18356: Fixed a Use-after-free in Skia.

  - CVE-2019-5785: Fixed an Integer overflow in Skia.

  - CVE-2018-18335: Fixed a Buffer overflow in Skia by     default deactivating Canvas 2D. This issue does not     affect Linuc distributions.

  - CVE-2018-18509: Fixed a flaw which during verification     of certain S/MIME signatures showing mistekenly that     emails bring a valid sugnature. 

  - CVE-2018-18500: Use-after-free parsing HTML5 stream

  - CVE-2018-18505: Privilege escalation through IPC channel     messages

  - CVE-2016-5824 DoS (use-after-free) via a crafted ics     file

  - CVE-2018-18501: Memory safety bugs fixed in Firefox 65     and Firefox ESR 60.5

  - CVE-2018-17466: Buffer overflow and out-of-bounds read     in ANGLE library with TextureStorage11

  - CVE-2018-18492: Use-after-free with select element

  - CVE-2018-18493: Buffer overflow in accelerated 2D canvas     with Skia

  - CVE-2018-18494: Same-origin policy violation using     location attribute and performance.getEntries to steal     cross-origin URLs

  - CVE-2018-18498: Integer overflow when calculating buffer     sizes for images

  - CVE-2018-12405: Memory safety bugs fixed in Firefox 64,     60.4, and Thunderbird 60.4

Other bug fixes and changes :

  - FileLink provider WeTransfer to upload large attachments

  - Thunderbird now allows the addition of OpenSearch search     engines from a local XML file using a minimal user     interface: [+] button to select a file an add, [-] to     remove.

  - More search engines: Google and DuckDuckGo available by     default in some locales

  - During account creation, Thunderbird will now detect     servers using the Microsoft Exchange protocol. It will     offer the installation of a 3rd party add-on (Owl) which     supports that protocol.

  - Thunderbird now compatible with other WebExtension-based     FileLink add-ons like the Dropbox add-on

  - New WebExtensions FileLink API to facilitate add-ons

  - Fix decoding problems for messages with less common     charsets (cp932, cp936)

  - New messages in the drafts folder (and other special or     virtual folders) will no longer be included in the new     messages notification

  - Thunderbird 60 will migrate security databases (key3.db,     cert8.db to key4.db, cert9.db).

  - Address book search and auto-complete slowness

  - Plain text markup with * for bold, / for italics, _ for     underline and | for code did not work when the enclosed     text contained non-ASCII characters

  - While composing a message, a link not removed when link     location was removed in the link properties panel

  - Encoding problems when exporting address books or     messages using the system charset. Messages are now     always exported using the UTF-8 encoding

  - If the 'Date' header of a message was invalid, Jan 1970     or Dec 1969 was displayed. Now using date from     'Received' header instead.

  - Body search/filtering didn't reliably ignore content of     tags

  - Inappropriate warning 'Thunderbird prevented the site     (addons.thunderbird.net) from asking you to install     software on your computer' when installing add-ons

  - Incorrect display of correspondents column since own     email address was not always detected

  - Spurious (encoded newline) inserted into drafts and sent     email

  - Double-clicking on a word in the Write window sometimes     launched the Advanced Property Editor or Link Properties     dialog

  - Fixed Cookie removal

  - 'Download rest of message' was not working if global     inbox was used

  - Fix Encoding problems for users (especially in Poland)     when a file was sent via a folder using 'Sent to > Mail     recipient' due to a problem in the Thunderbird MAPI     interface

  - According to RFC 4616 and RFC 5721, passwords containing     non-ASCII characters are encoded using UTF-8 which can     lead to problems with non-compliant providers, for     example office365.com. The SMTP LOGIN and POP3 USER/PASS     authentication methods are now using a Latin-1 encoding     again to work around this issue

  - Fix shutdown crash/hang after entering an empty IMAP     password

This update was imported from the SUSE:SLE-15:Update update project.

An update for firefox is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Mozilla Firefox is an open source web browser, designed for standards compliance, performance, and portability.

This update upgrades Firefox to version 60.4.0 ESR.

Security Fix(es) :

* Mozilla: Memory safety bugs fixed in Firefox 64 and Firefox ESR 60.4 (CVE-2018-12405)

* Mozilla: Memory corruption in Angle (CVE-2018-17466)

* Mozilla: Use-after-free with select element (CVE-2018-18492)

* Mozilla: Buffer overflow in accelerated 2D canvas with Skia (CVE-2018-18493)

* Mozilla: Same-origin policy violation using location attribute and performance.getEntries to steal cross-origin URLs (CVE-2018-18494)

* Mozilla: Integer overflow when calculating buffer sizes for images (CVE-2018-18498)

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat would like to thank the Mozilla project for reporting these issues. Upstream acknowledges Christian Holler, Diego Calleja, Andrew McCreight, Jon Coppeard, Natalia Csoregi, Nicolas B. Pierron, Tyson Smith, Nils, Atte Kettunen, James Lee of Kryptos Logic, and r as the original reporters.

This update upgrades Firefox to version 60.4.0 ESR.

Security Fix(es) :

  - Mozilla: Memory safety bugs fixed in Firefox 64 and     Firefox ESR 60.4 (CVE-2018-12405)

  - Mozilla: Memory corruption in Angle (CVE-2018-17466)

  - Mozilla: Use-after-free with select element     (CVE-2018-18492)

  - Mozilla: Buffer overflow in accelerated 2D canvas with     Skia (CVE-2018-18493)

  - Mozilla: Same-origin policy violation using location     attribute and performance.getEntries to steal     cross-origin URLs (CVE-2018-18494)

  - Mozilla: Integer overflow when calculating buffer sizes     for images (CVE-2018-18498)

This update upgrades Thunderbird to version 60.4.0.

Security Fix(es) :

  - Mozilla: Memory safety bugs fixed in Firefox 64 and     Firefox ESR 60.4 (CVE-2018-12405)

  - chromium-browser, firefox: Memory corruption in Angle     (CVE-2018-17466)

  - Mozilla: Use-after-free with select element     (CVE-2018-18492)

  - Mozilla: Buffer overflow in accelerated 2D canvas with     Skia (CVE-2018-18493)

  - Mozilla: Same-origin policy violation using location     attribute and performance.getEntries to steal     cross-origin URLs (CVE-2018-18494)

  - Mozilla: Integer overflow when calculating buffer sizes     for images (CVE-2018-18498)

The remote host is affected by the vulnerability described in GLSA-201903-04 (Mozilla Firefox: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Mozilla Firefox. Please       review the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could entice a user to view a specially crafted web       page possibly resulting in the execution of arbitrary code with the       privileges of the process or cause a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

This update to Mozilla Firefox 60.4.0 ESR fixes security issues and bugs.

Security issues fixed as part of the MFSA 2018-30 advisory (boo#1119105) :

  - CVE-2018-17466: Buffer overflow and out-of-bounds read     in ANGLE library with TextureStorage11

  - CVE-2018-18492: Use-after-free with select element

  - CVE-2018-18493: Buffer overflow in accelerated 2D canvas     with Skia

  - CVE-2018-18494: Same-origin policy violation using     location attribute and performance.getEntries to steal     cross-origin URLs

  - CVE-2018-18498: Integer overflow when calculating buffer     sizes for images

  - CVE-2018-12405: Memory safety bugs fixed in Firefox 64     and Firefox ESR 60.4

The following changes are included :

  - now requires NSS >= 3.36.6

  - Updated list of currency codes to include Unidad     Previsional (UYW)

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
122493	openSUSE Security Update : MozillaThunderbird (openSUSE-2019-251)	Nessus	SuSE Local Security Checks	2019/2/28	2024/6/18	critical
119874	CentOS 7 : firefox (CESA-2018:3833)	Nessus	CentOS Local Security Checks	2018/12/27	2024/7/12	critical
119881	Scientific Linux Security Update : firefox on SL6.x i386/x86_64 (20181217)	Nessus	Scientific Linux Local Security Checks	2018/12/27	2024/7/12	critical
121409	Scientific Linux Security Update : thunderbird on SL6.x i386/x86_64 (20190125)	Nessus	Scientific Linux Local Security Checks	2019/1/28	2024/6/25	critical
122732	GLSA-201903-04 : Mozilla Firefox: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2019/3/11	2024/6/14	critical
123148	openSUSE Security Update : Mozilla Firefox (openSUSE-2019-1004)	Nessus	SuSE Local Security Checks	2019/3/27	2024/6/12	critical

检测

插件搜索

critical

critical

critical

critical

critical

critical