Vulnerability   
Search   
    Search 191973 CVE descriptions
and 86218 test descriptions,
access 10,000+ cross references.
Tests   CVE   All  

Test ID:1.3.6.1.4.1.25623.1.0.853536
Category:SuSE Local Security Checks
Title:openSUSE: Security Advisory for MozillaThunderbird (openSUSE-SU-2020:1780-1)
Summary:The remote host is missing an update for the 'MozillaThunderbird'; package(s) announced via the openSUSE-SU-2020:1780-1 advisory.
Description:Summary:
The remote host is missing an update for the 'MozillaThunderbird'
package(s) announced via the openSUSE-SU-2020:1780-1 advisory.

Vulnerability Insight:
This update for MozillaThunderbird and mozilla-nspr fixes the following
issues:

- Mozilla Thunderbird 78.4

* new: MailExtensions: browser.tabs.sendMessage API added

* new: MailExtensions: messageDisplayScripts API added

* changed: Yahoo and AOL mail users using password authentication will
be migrated to OAuth2

* changed: MailExtensions: messageDisplay APIs extended to support
multiple selected messages

* changed: MailExtensions: compose.begin functions now support creating
a message with attachments

* fixed: Thunderbird could freeze when updating global search index

* fixed: Multiple issues with handling of self-signed SSL certificates
addressed

* fixed: Recipient address fields in compose window could expand to fill
all available space

* fixed: Inserting emoji characters in message compose window caused
unexpected behavior

* fixed: Button to restore default folder icon color was not keyboard
accessible

* fixed: Various keyboard navigation fixes

* fixed: Various color-related theme fixes

* fixed: MailExtensions: Updating attachments with
onBeforeSend.addListener() did not work MFSA 2020-47 (bsc#1177977)

* CVE-2020-15969 Use-after-free in usersctp

* CVE-2020-15683 Memory safety bugs fixed in Thunderbird 78.4

- Mozilla Thunderbird 78.3.3

* OpenPGP: Improved support for encrypting with subkeys

* OpenPGP message status icons were not visible in message header pane

* Creating a new calendar event did not require an event title

- Mozilla Thunderbird 78.3.2 (bsc#1176899)

* OpenPGP: Improved support for encrypting with subkeys

* OpenPGP: Encrypted messages with international characters were
sometimes displayed incorrectly

* Single-click deletion of recipient pills with middle mouse button
restored

* Searching an address book list did not display results

* Dark mode, high contrast, and Windows theming fixes

- Mozilla Thunderbird 78.3.1

* fix crash in nsImapProtocol::CreateNewLineFromSocket

- Mozilla Thunderbird 78.3.0 MFSA 2020-44 (bsc#1176756)

* CVE-2020-15677 Download origin spoofing via redirect

* CVE-2020-15676 XSS when pasting attacker-controlled data into a
contenteditable element

* CVE-2020-15678 When recursing through layers while scrolling, an
iterator may have become invalid, resulting in a potential use-after-
free scenario

* CVE-2020-15673 Memory safety bugs fixed in Thunderbird 78.3

- update mozilla-nspr to version 4.25.1

* The macOS platform code for shared library loading was changed to
support macOS 11.

* Dependency needed for the MozillaThunderbird update

This u ...

Description truncated. Please see the references for more information.

Affected Software/OS:
'MozillaThunderbird' package(s) on openSUSE Leap 15.2.

Solution:
Please install the updated package(s).

CVSS Score:
7.5

CVSS Vector:
AV:N/AC:L/Au:N/C:P/I:P/A:P

Cross-Ref: Common Vulnerability Exposure (CVE) ID: CVE-2020-15673
Common Vulnerability Exposure (CVE) ID: CVE-2020-15676
Common Vulnerability Exposure (CVE) ID: CVE-2020-15677
Common Vulnerability Exposure (CVE) ID: CVE-2020-15678
Common Vulnerability Exposure (CVE) ID: CVE-2020-15683
Common Vulnerability Exposure (CVE) ID: CVE-2020-15969
CopyrightCopyright (C) 2020 Greenbone Networks GmbH

This is only one of 86218 vulnerability tests in our test suite. Find out more about running a complete security audit.

To run a free test of this vulnerability against your system, register below.




© 1998-2020 E-Soft Inc. All rights reserved.