Most recent entries from all

ALSA-2023:3587 — Important: thunderbird security update

Affected: AlmaLinux:9: thunderbird

Mozilla Thunderbird is a standalone mail and newsgroup client.

This update upgrades Thunderbird to version 102.12.0.

Security Fix(es):

* Mozilla: Click-jacking certificate exceptions through rendering lag (CVE-2023-34414) * Mozilla: Memory safety bugs fixed in Firefox 114 and Firefox ESR 102.12 (CVE-2023-34416)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2023-03125

certfr-2023-avi-0438 — De multiples vulnérabilités ont été découvertes dans Mozilla Firefox et Firefox ESR. Elles…

certfr-2023-avi-0438

cnvd-2023-55350

EUVD-2026-216553

fkie_cve-2023-34416

Memory safety bugs present in Firefox 113, Firefox ESR 102.11, and Thunderbird 102.12. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR < 102.12, Firefox < 114, and Thunderbird < 102.12.

GHSA-94qw-3pc5-wwcm

gsd-2023-34416

OESA-2026-3213 — mozjs102 security update

Affected: openEuler:24.03-LTS-SP1: mozjs102

SpiderMonkey is the code-name for Mozilla Firefox&apos;s C++ implementation of JavaScript. It is intended to be embedded in other applications that provide host environments for JavaScript. Security Fix(es):

Unexpected data returned from the Safe Browsing API could have led to memory corruption and a potentially exploitable crash. This vulnerability affects Thunderbird < 102.10 and Firefox ESR < 102.10.(CVE-2023-1945)

There exists a use after free/double free in libwebp. An attacker can use the ApplyFiltersAndEncode() function and loop through to free best.bw and assign best = trial pointer. The second loop will then return 0 because of an Out of memory error in VP8 encoder, the pointer is still assigned to trial and the AddressSanitizer will attempt a double free.(CVE-2023-1999)

A website could have obscured the fullscreen notification by using a combination of <code>window.open</code>, fullscreen requests, <code>window.name</code> assignments, and <code>setInterval</code> calls. This could have led to user confusion and possible spoofing attacks. This vulnerability affects Firefox < 112, Focus for Android < 112, Firefox ESR < 102.10, Firefox for Android < 112, and Thunderbird < 102.10.(CVE-2023-29533)

Following a Garbage Collector compaction, weak maps may have been accessed before they were correctly traced. This resulted in memory corruption and a potentially exploitable crash. This vulnerability affects…

openSUSE-SU-2024:12990-1 — MozillaThunderbird-102.12.0-1.1 on GA media

MozillaThunderbird-102.12.0-1.1 on GA media

RHSA-2023:3560 — Red Hat Security Advisory: firefox security update

Mozilla: Click-jacking certificate exceptions through rendering lag Mozilla: Memory safety bugs fixed in Firefox 114 and Firefox ESR 102.12

SUSE-SU-2023:2440-1 — Security update for MozillaFirefox

Security update for MozillaFirefox

UBUNTU-CVE-2023-34416

Affected: Ubuntu:18.04:LTS: mozjs52, Ubuntu:18.04:LTS: mozjs38, Ubuntu:20.04:LTS: firefox, Ubuntu:20.04:LTS: thunderbird, Ubuntu:20.04:LTS: mozjs68, Ubuntu:20.04:LTS: mozjs52, Ubuntu:22.04:LTS: mozjs102, Ubuntu:22.04:LTS: mozjs78, Ubuntu:22.04:LTS: mozjs91, Ubuntu:22.04:LTS: thunderbird

WID-SEC-W-2023-1385 — Mozilla Firefox: Mehrere Schwachstellen

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Mozilla Firefox und Mozilla Firefox ESR, ausnutzen, um Sicherheitsvorkehrungen zu umgehen und Code auszuführen.