[security-announce] openSUSE-SU-2016:3019-1: important: Security update for MozillaThunderbird

[news 28]

openSUSE Security Update: Security update for MozillaThunderbird

______________________________________________________________________________

 

Announcement ID: openSUSE-SU-2016:3019-1

Rating: important

References: #1009026 #1010401 #1010404 #1010410 #1010411

#1010427 #1012964

Cross-References: CVE-2016-5290 CVE-2016-5291 CVE-2016-5296

CVE-2016-5297 CVE-2016-9066 CVE-2016-9079

 

Affected Products:

SUSE Package Hub for SUSE Linux Enterprise 12

______________________________________________________________________________

 

An update that solves 6 vulnerabilities and has one errata

is now available.

 

Description:

 

This update for MozillaThunderbird fixes some potential security issues

and bugs.

 

The following security flaws cannot be exploited through email because

scripting is disabled when reading mail, but are potentially risks in

browser or browser-like contexts:

 

- CVE-2016-9079: SVG Animation Remote Code Execution (MFSA 2016-92,

bsc#1012964)

- CVE-2016-5296: Heap-buffer-overflow WRITE in rasterize_edges_1

(bsc#1010411)

- CVE-2016-5297: Incorrect argument length checking in Javascript

(bsc#1010401)

- CVE-2016-9066: Integer overflow leading to a buffer overflow in

nsScriptLoadHandler (bsc#1010404)

- CVE-2016-5291: Same-origin policy violation using local HTML file and

saved shortcut file (bsc#1010410)

- CVE-2016-5290: Memory safety bugs fixed in Thunderbird ESR 45.5

(bsc#1010427)

 

The update contains changes in behavior:

 

- Changed recipient address entry: Arrow-keys now copy the pop-up value to

the input field. Mouse-hovered pop-up value can no longer be confirmed

with tab or enter key. This restores the behavior of Thunderbird 24.

- Support changes to character limit in Twitter

 

The following bugs were fixed:

 

- Reply with selected text containing quote resulted in wrong quoting

level indication

- Email invitation might not be displayed when description contains

non-ASCII characters

- Attempting to sort messages on the Date field whilst a quick filter is

applied got stuck

on sort descending

- Mail address display at header pane displayed incorrectly if the address

contains UTF-8 according to RFC 6532

 

 

Patch Instructions:

 

To install this openSUSE Security Update use YaST online_update.

Alternatively you can run the command listed for your product:

 

- SUSE Package Hub for SUSE Linux Enterprise 12:

 

zypper in -t patch openSUSE-2016-1412=1

 

To bring your system up-to-date, use "zypper patch".

 

 

Package List:

 

- SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 s390x x86_64):

 

MozillaThunderbird-45.5.1-17.1

MozillaThunderbird-devel-45.5.1-17.1

MozillaThunderbird-translations-common-45.5.1-17.1

MozillaThunderbird-translations-other-45.5.1-17.1

 

- SUSE Package Hub for SUSE Linux Enterprise 12 (x86_64):

 

MozillaThunderbird-buildsymbols-45.5.1-17.1

 

 

References:

 

https://www.suse.com/security/cve/CVE-2016-5290.html

https://www.suse.com/security/cve/CVE-2016-5291.html

https://www.suse.com/security/cve/CVE-2016-5296.html

https://www.suse.com/security/cve/CVE-2016-5297.html

https://www.suse.com/security/cve/CVE-2016-9066.html

https://www.suse.com/security/cve/CVE-2016-9079.html

https://bugzilla.suse.com/1009026

https://bugzilla.suse.com/1010401

https://bugzilla.suse.com/1010404

https://bugzilla.suse.com/1010410

https://bugzilla.suse.com/1010411

https://bugzilla.suse.com/1010427

https://bugzilla.suse.com/1012964

 

--

To unsubscribe, e-mail: opensuse-security-announce+unsubscribe ( -at -) opensuse.org

For additional commands, e-mail: opensuse-security-announce+help ( -at -) opensuse.org