# RHSA-2023:4499: thunderbird security update

RHSA-2023:4499, released August 7, 2023, fixes 10 CVEs in thunderbird (version 0:102.14.0-1.el9_2). None of them is reported as exploited. Patch Radar priority: Urgent.

- Web page: https://patchblox.com/security/fix/linux/rhsa-2023-4499
- Platform: Linux
- Released: Aug 7, 2023
- Priority: Urgent (Closes CVE-2023-4056, rated Critical)
- CVEs: 10, exploited: 0, on CISA KEV: 0
- Vendor advisory: https://access.redhat.com/errata/RHSA-2023:4499

## Applies to

| Product | Release | Fixed in |
|---|---|---|
| [thunderbird](https://patchblox.com/security/data/product/linux/thunderbird.md) | RHEL 9 | 0:102.14.0-1.el9_2 |

## CVEs this fix closes

| CVE | Priority | Title | CVSS | EPSS | Exploitation |
|---|---|---|---:|---:|---|
| [CVE-2023-4056](https://patchblox.com/security/data/cve/CVE-2023-4056.md) | Urgent | Mozilla Firefox ESR and 3 others: Memory safety bugs present in Firefox 115, Firefox ESR 115.0, Firefox ESR 102.13, Thunderbird 115.0,… | 9.8 | 0.0095 |  |
| [CVE-2023-4057](https://patchblox.com/security/data/cve/CVE-2023-4057.md) | Urgent | Mozilla Firefox ESR and 5 others: Memory safety bugs present in Firefox 115, Firefox ESR 115.0, and Thunderbird 115.0. | 9.8 | 0.0089 |  |
| [CVE-2023-4050](https://patchblox.com/security/data/cve/CVE-2023-4050.md) | High | Mozilla Firefox ESR and 3 others: In some cases, an untrusted input stream was copied to a stack buffer without checking its size. | 7.5 | 0.1258 |  |
| [CVE-2023-4046](https://patchblox.com/security/data/cve/CVE-2023-4046.md) | High | Mozilla Firefox ESR and 3 others: Allocation of Resources Without Limits or Throttling | 7.5 | 0.0113 |  |
| [CVE-2023-4048](https://patchblox.com/security/data/cve/CVE-2023-4048.md) | High | Mozilla Firefox ESR and 3 others: An out-of-bounds read could have led to an exploitable crash when parsing HTML with DOMParser in low… | 7.5 | 0.0093 |  |
| [CVE-2023-4055](https://patchblox.com/security/data/cve/CVE-2023-4055.md) | High | Mozilla Firefox ESR and 3 others: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') | 7.5 | 0.0073 |  |
| [CVE-2023-3417](https://patchblox.com/security/data/cve/CVE-2023-3417.md) | High | File Extension Spoofing using the Text Direction Override Character | 7.5 | 0.0067 |  |
| [CVE-2023-4049](https://patchblox.com/security/data/cve/CVE-2023-4049.md) | High | Mozilla Firefox ESR and 3 others: Race conditions in reference counting code were found through code inspection. | 7.5 | 0.0063 |  |
| [CVE-2023-4047](https://patchblox.com/security/data/cve/CVE-2023-4047.md) | High | Mozilla Firefox ESR and 3 others: Cross-Site Request Forgery (CSRF) | 8.8 | 0.0063 |  |
| [CVE-2023-4045](https://patchblox.com/security/data/cve/CVE-2023-4045.md) | High | Mozilla Firefox ESR and 3 others: Offscreen Canvas did not properly track cross-origin tainting, which could have been used to access image… | 7.5 | 0.0059 |  |

---

Data as of 2026-11-07T12:40:37Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo