Linux · Security advisory · November 27, 2023

RHSA-2023:7500: thunderbird security update

RHSA-2023:7500, released November 27, 2023, fixes 7 CVEs in thunderbird (version 0:115.5.0-1.el8_9). None of them is reported as exploited. Patch Radar priority: High.

High
CVEs closed
7
None rated Critical
Exploited
0
None reported
Exploitation more likely
0
Vendor assessment
Highest EPSS
0.0142
72nd percentile

Priority of the 7 CVEs

Patch now 0 Urgent 0 High 6 Routine 1

Fixed package versions

ProductReleaseFixed in
thunderbirdRHEL 80:115.5.0-1.el8_9

CVEs this fix closes

PriorityCVETitleImpactCVSSEPSSExploitation
High CVE-2023-6212 Mozilla Firefox ESR and 5 others: Memory safety bugs present in Firefox 119, Firefox ESR 115.4, and Thunderbird 115.4. 8.8 0.0095 None reported
High CVE-2023-6207 Mozilla Firefox ESR and 5 others: Ownership mismanagement led to a use-after-free in ReadableByteStreams This vulnerability affects Firefox… 8.8 0.0091 None reported
High CVE-2023-6208 Mozilla Firefox ESR and 5 others: When using X11, text selected by the page using the Selection API was erroneously copied into the primary… 8.8 0.0089 None reported
High CVE-2023-6205 Mozilla Firefox ESR and 5 others: It was possible to cause the use of a MessagePort after it had already been freed, which could potentially… 7.5 0.0087 None reported
High CVE-2023-6204 Mozilla Firefox ESR and 5 others: On some systems—depending on the graphics settings and drivers—it was possible to force an out-of-bounds… 7.5 0.0084 None reported
High CVE-2023-6206 Mozilla Firefox ESR and 5 others: The black fade animation when exiting fullscreen is roughly the length of the anti-clickjacking delay… 7.5 0.0064 None reported
Routine CVE-2023-6209 Mozilla Firefox ESR and 5 others: Relative URLs starting with three slashes were incorrectly parsed, and a path-traversal "/../" part in… 6.5 0.0142 None reported
Showing 1 to 7 of 7 1