Linux · Security advisory · September 4, 2023

RHSA-2023:4955: thunderbird security update

RHSA-2023:4955, released September 4, 2023, fixes 12 CVEs in thunderbird (version 0:102.15.0-1.el9_2). None of them is reported as exploited. Patch Radar priority: High.

High
CVEs closed
12
None rated Critical
Exploited
0
None reported
Exploitation more likely
0
Vendor assessment
Highest EPSS
0.0080
56th percentile

Priority of the 12 CVEs

Patch now 0 Urgent 0 High 12 Routine 0

Fixed package versions

ProductReleaseFixed in
thunderbirdRHEL 90:102.15.0-1.el9_2

CVEs this fix closes

PriorityCVETitleImpactCVSSEPSSExploitation
High CVE-2023-4584 Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15, Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2 8.8 0.0080 None reported
High CVE-2023-4585 Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2, and Thunderbird 115.2 8.8 0.0077 None reported
High CVE-2023-4053 Full screen notification obscured by external program 8.8 0.0077 None reported
High CVE-2023-4583 Browsing Context potentially not cleared when closing Private Window 8.8 0.0069 None reported
High CVE-2023-4574 Memory corruption in IPC ColorPickerShownCallback 8.8 0.0066 None reported
High CVE-2023-4051 Full screen notification obscured by file open dialog 8.8 0.0066 None reported
High CVE-2023-4575 Memory corruption in IPC FilePickerShownCallback 8.8 0.0066 None reported
High CVE-2023-4577 Memory corruption in JIT UpdateRegExpStatics 8.8 0.0065 None reported
High CVE-2023-4573 Memory corruption in IPC CanvasTranslator 8.8 0.0063 None reported
High CVE-2023-4578 Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception 8.8 0.0062 None reported
High CVE-2023-4581 XLL file extensions were downloadable without warnings 8.8 0.0057 None reported
High CVE-2023-4580 Push notifications saved to disk unencrypted 8.8 0.0042 None reported
Showing 1 to 12 of 12 1