ID de Prueba:	1.3.6.1.4.1.25623.1.0.856109
Categoría:	openSUSE Local Security Checks
Título:	openSUSE Security Advisory (SUSE-SU-2024:1437-1)
Resumen:	The remote host is missing an update for the 'MozillaThunderbird' package(s) announced via the SUSE-SU-2024:1437-1 advisory.
Descripción:	Summary: The remote host is missing an update for the 'MozillaThunderbird' package(s) announced via the SUSE-SU-2024:1437-1 advisory. Vulnerability Insight: This update for MozillaThunderbird fixes the following issues: Update to Mozilla Thunderbird 115.10.1 Security fixes (MFSA 2024-20) (bsc#1222535): - CVE-2024-3852: GetBoundName in the JIT returned the wrong object (bmo#1883542) - CVE-2024-3854: Out-of-bounds-read after mis-optimized switch statement (bmo#1884552) - CVE-2024-3857: Incorrect JITting of arguments led to use-after-free during garbage collection (bmo#1886683) - CVE-2024-2609: Permission prompt input delay could expire when not in focus (bmo#1866100) - CVE-2024-3859: Integer-overflow led to out-of-bounds-read in the OpenType sanitizer (bmo#1874489) - CVE-2024-3861: Potential use-after-free due to AlignedBuffer self-move (bmo#1883158) - CVE-2024-3863: Download Protections were bypassed by .xrm-ms files on Windows (bmo#1885855) - CVE-2024-3302: Denial of Service using HTTP/2 CONTINUATION frames (bmo#1881183, [link moved to references]) - CVE-2024-3864: Memory safety bug fixed in Firefox 125, Firefox ESR 115.10, and Thunderbird 115.10 (bmo#1888333) Other Fixes: * fixed: Thunderbird processes did not exit cleanly, user intervention was required via task manager (bmo#1891889) * unresolved: After changing password on an IMAP account, the account could become locked due to too many failed login attempts (bmo#1862111) * fixed: Creating a tag in General Settings with a number as the tag name did not work (bmo#1881124) * fixed: Quick Filter button selections did not persist after restart (bmo#1847265) * fixed: Collapsing and expanding message list headers sometimes caused header to scroll out of view (bmo#1862197) * fixed: Single message with no children inside a parent thread sometimes displayed incorrectly as a thread with a duplicate of itself as its child (bmo#1427546) * fixed: 'Get selected messages' menu items did not work (bmo#1867091) * fixed: 'Download and Sync Messages' dialog was too short when using Russian locale, obscuring OK button (bmo#1881795) * fixed: After changing password on an IMAP account, the account could become locked due to too many failed login attempts (bmo#1862111) * fixed: Retrieving multiline POP3 message from server failed if message chunk ended in newline instead of carriage return and newline (bmo#1883760) * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did not support encryption configuration (bmo#1876992) * fixed: Non-empty address book search bar interfered with displaying/editing contacts (bmo#1833031) * fixed: Deleting attendees from 'Invite Attendees' view removed attendees from view, but not from invite (bmo#1874450) * fixed: Splitter arrow between task list and task description did not behave as expected (bmo#1889562) * fixed: Performance improvements and code cleanup (bmo#1878257,bmo#1883550) * fixed: Security fixes * unresolved: Thunderbird processes did not exit cleanly, user intervention was required via task manager (bmo#1891889) Affected Software/OS: 'MozillaThunderbird' package(s) on openSUSE Leap 15.5. Solution: Please install the updated package(s). CVSS Score: 10.0 CVSS Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Referencia Cruzada:	Common Vulnerability Exposure (CVE) ID: CVE-2024-2609 https://bugzilla.mozilla.org/show_bug.cgi?id=1866100 https://lists.debian.org/debian-lts-announce/2024/04/msg00012.html https://www.mozilla.org/security/advisories/mfsa2024-12/ https://www.mozilla.org/security/advisories/mfsa2024-19/ https://www.mozilla.org/security/advisories/mfsa2024-20/ https://lists.debian.org/debian-lts-announce/2024/04/msg00013.html Common Vulnerability Exposure (CVE) ID: CVE-2024-3302 VU#421644 - HTTP/2 CONTINUATION frames can be utilized for DoS attacks https://kb.cert.org/vuls/id/421644 https://bugzilla.mozilla.org/show_bug.cgi?id=1881183 https://www.mozilla.org/security/advisories/mfsa2024-18/ Common Vulnerability Exposure (CVE) ID: CVE-2024-3852 https://bugzilla.mozilla.org/show_bug.cgi?id=1883542 Common Vulnerability Exposure (CVE) ID: CVE-2024-3854 https://bugzilla.mozilla.org/show_bug.cgi?id=1884552 Common Vulnerability Exposure (CVE) ID: CVE-2024-3857 https://bugzilla.mozilla.org/show_bug.cgi?id=1886683 Common Vulnerability Exposure (CVE) ID: CVE-2024-3859 https://bugzilla.mozilla.org/show_bug.cgi?id=1874489 Common Vulnerability Exposure (CVE) ID: CVE-2024-3861 https://bugzilla.mozilla.org/show_bug.cgi?id=1883158 Common Vulnerability Exposure (CVE) ID: CVE-2024-3863 https://bugzilla.mozilla.org/show_bug.cgi?id=1885855 Common Vulnerability Exposure (CVE) ID: CVE-2024-3864 Memory safety bug fixed in Firefox 125, Firefox ESR 115.10, and Thunderbird 115.10 https://bugzilla.mozilla.org/show_bug.cgi?id=1888333
Copyright	Copyright (C) 2024 Greenbone AG

Esta es sólo una de 146377 pruebas de vulnerabilidad en nuestra serie de pruebas. Encuentre más sobre cómo ejecutar una auditoría de seguridad completa. Para ejecutar una prueba gratuita de esta vulnerabilidad contra su sistema, regístrese ahora.