Linux · Security advisory · April 26, 2023
RLSA-2023:1809: thunderbird security update
RLSA-2023:1809, released April 26, 2023, fixes 11 CVEs in thunderbird (version 0:102.10.0-2.el9_1). None of them is reported as exploited. Patch Radar priority: High.
High
CVEs closed
11
None rated Critical
Exploited
0
None reported
Exploitation more likely
0
Vendor assessment
Highest EPSS
0.0119
67th percentile
Priority of the 11 CVEs
Patch now 0
Urgent 0
High 8
Routine 3
Fixed package versions
| Product | Release | Fixed in |
|---|---|---|
| thunderbird | rocky 9 | 0:102.10.0-2.el9_1 |
CVEs this fix closes
| Priority | CVE | Title | Impact | CVSS | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| High | CVE-2023-28427 | thunderbird: Mozilla Thunderbird is a standalone mail and newsgroup client. This update upgrades Thunderbird to version 102.10.0.... | 8.2 | 0.0119 | None reported | |
| High | CVE-2023-29535 | Mozilla Firefox and 4 others: Following a Garbage Collector compaction, weak maps may have been accessed before they were correctly… | 7.5 | 0.0075 | None reported | |
| High | CVE-2023-29541 | Mozilla Firefox and 4 others: Improper Encoding or Escaping of Output | 8.8 | 0.0074 | None reported | |
| High | CVE-2023-29539 | Mozilla Firefox and 4 others: When handling the filename directive in the Content-Disposition header, the filename would be truncated… | 8.8 | 0.0074 | None reported | |
| High | CVE-2023-29550 | Mozilla Firefox and 4 others: Memory safety bugs present in Firefox 111 and Firefox ESR 102.9. | 8.8 | 0.0071 | None reported | |
| High | CVE-2023-29536 | Mozilla Firefox and 4 others: An attacker could cause the memory manager to incorrectly free a pointer that addresses attacker-controlled… | 8.8 | 0.0070 | None reported | |
| High | CVE-2023-29533 | Mozilla Firefox and 4 others: A website could have obscured the fullscreen notification by using a combination of <code>window.open</code>,… | 7.5 | 0.0057 | None reported | |
| High | CVE-2023-0547 | Mozilla Thunderbird and 1 other: Improper Certificate Validation | 7.5 | 0.0037 | None reported | |
| Routine | CVE-2023-29479 | xul-ext-lightning: Ribose RNP before 0.16.3 may hang when the input is malformed. | 6.5 | 0.0090 | None reported | |
| Routine | CVE-2023-29548 | Mozilla Firefox and 4 others: A wrong lowering instruction in the ARM64 Ion compiler resulted in a wrong optimization result. | 6.5 | 0.0070 | None reported | |
| Routine | CVE-2023-1945 | Mozilla Thunderbird and 1 other: Out-of-bounds Write | 6.5 | 0.0064 | None reported |
Showing 1 to 11 of 11
1