Linux · Security advisory · August 9, 2023
ELSA-2023-4497: thunderbird security update
ELSA-2023-4497, released August 9, 2023, fixes 10 CVEs in thunderbird (version 0:102.14.0-1.0.1.el8_8). None of them is reported as exploited. Patch Radar priority: Urgent.
Urgent
CVEs closed
10
2 rated Critical
Exploited
0
None reported
Exploitation more likely
0
Vendor assessment
Highest EPSS
0.1258
96th percentile
Priority of the 10 CVEs
Patch now 0
Urgent 2
High 8
Routine 0
Fixed package versions
| Product | Release | Fixed in |
|---|---|---|
| thunderbird | ol 8 | 0:102.14.0-1.0.1.el8_8 |
CVEs this fix closes
| Priority | CVE | Title | Impact | CVSS | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| Urgent | CVE-2023-4056 | Mozilla Firefox ESR and 3 others: Memory safety bugs present in Firefox 115, Firefox ESR 115.0, Firefox ESR 102.13, Thunderbird 115.0,… | 9.8 | 0.0095 | None reported | |
| Urgent | CVE-2023-4057 | Mozilla Firefox ESR and 5 others: Memory safety bugs present in Firefox 115, Firefox ESR 115.0, and Thunderbird 115.0. | 9.8 | 0.0089 | None reported | |
| High | CVE-2023-4050 | Mozilla Firefox ESR and 3 others: In some cases, an untrusted input stream was copied to a stack buffer without checking its size. | 7.5 | 0.1258 | None reported | |
| High | CVE-2023-4046 | Mozilla Firefox ESR and 3 others: Allocation of Resources Without Limits or Throttling | 7.5 | 0.0113 | None reported | |
| High | CVE-2023-4048 | Mozilla Firefox ESR and 3 others: An out-of-bounds read could have led to an exploitable crash when parsing HTML with DOMParser in low… | 7.5 | 0.0093 | None reported | |
| High | CVE-2023-4055 | Mozilla Firefox ESR and 3 others: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') | 7.5 | 0.0073 | None reported | |
| High | CVE-2023-3417 | File Extension Spoofing using the Text Direction Override Character | 7.5 | 0.0067 | None reported | |
| High | CVE-2023-4049 | Mozilla Firefox ESR and 3 others: Race conditions in reference counting code were found through code inspection. | 7.5 | 0.0063 | None reported | |
| High | CVE-2023-4047 | Mozilla Firefox ESR and 3 others: Cross-Site Request Forgery (CSRF) | 8.8 | 0.0063 | None reported | |
| High | CVE-2023-4045 | Mozilla Firefox ESR and 3 others: Offscreen Canvas did not properly track cross-origin tainting, which could have been used to access image… | 7.5 | 0.0059 | None reported |
Showing 1 to 10 of 10
1