ce8e4b3bed806b13b9a79a044afb64c3 1.5.0.8 unknown cdcc3915517b39154ff7eee205eaa54a 1.5.0.8 unknown 711278631d53df8a5535b09dc12a01dd 1.5.0.8 unknown 4ec0dfea89c47eb3cc3eaf50f422364e 1.5.0.10 unknown e05b9368ff208eb0caf6edcfd42c4ae4 1.5.0.10 unknown 1a211fec71708f070dffa19d1b74bc10 1.5.0.10 unknown 097fd0a5464fc64d88afbc13e94cdfef 1.5.0.12 unknown be09145ec736f9b294c9d449b877b1a3 2.0.0.0 unknown d430483538992f777c659c012ba12846 2.0.0.4 unknown 99a9399fb03714379ae06f6f2c4504fd 2.0.0.4 unknown 354c74b4a90d22cc608f135d1014ef36 2.0.0.5 unknown 208f2ffd069044a4023a3c53532952a1 2.0.0.5 unknown 807b1e7ab977e223a6e9101ed8984792 2.0.0.6 unknown 10b3d1853c0074988b1e63eb5f92842a 2.0.0.6 unknown f826b58bc073bcce4d7f379a29e614c7 2.0.0.6 unknown 5772cabadf01c41867b5b6ec5654c842 2.0.0.6 unknown 99eac5dcf5ff617bfe181519e0140676 2.0.0.6 unknown 2ddf8959a6be293b9de5d0918b363e2c 2.0.0.6 unknown 9025d64f66cf1b93de848a9fe1f6bea4 2.0.0.9 unknown 457d67ed211615b8cdf630d6b53195b2 2.0.0.12 unknown 65a419034e8d9d68543078b7e072fff6 2.0.0.12 unknown a3ffd9b173bac44ef33b7d90cd4f348d 2.0.0.12 unknown 509f1ede6ac01c5f8ba3886651dc1b34 2.0.0.12 unknown c16779ffeaa1669359cc7afeef1ea3cd 2.0.0.14 unknown c5d4008d916fe68609399c9ae0c5423f 2.0.0.14 unknown e251c1810b801cd74a2ba09f5d5e4476 2.0.0.16 unknown 640b901416da07766d4a0dc60c19a626 2.0.0.17 unknown 11adda7c19d642333e7ec677e35951c8 2.0.0.18 unknown 80d4a89c58758ec03b2b6302db5034b0 2.0.0.19 unknown 8fce5cc9c90567c0113107df850ecfef 2.0.0.21 unknown 9d588d8eab8c1897f3181aa9c43c1cba 2.0.0.21 unknown 25e956710e2cf7c5f5b07b65c632eb19 2.0.0.21 unknown e91dba912392ae02973485a3c10bc01a 2.0.0.21 unknown 7779765924b17dea5d537155e8c2d85f 3.0b3 unknown a4e5f1d5b976929b6669312b02600485 3.0b3 unknown e7d7dd4d1fcded26fcbeb91d33c721a7 3.0b3 unknown c04d5591a98d76e8f9efca178e4f8209 3.0b3 autobuild Copy from mozilla:Factory/MozillaThunderbird based on submit request 18428 from user wrosenauer 5d62b36dd1802564d15857b5ca219f37 3.0b3 autobuild Copy from mozilla:Factory/MozillaThunderbird based on submit request 19035 from user wrosenauer 0ce6507cfc0bbfaa12d2fbedca8171e9 3.0b4 autobuild Copy from mozilla:Factory/MozillaThunderbird based on submit request 20944 from user wrosenauer dd0b1c474b034dce14a9ac3b03d7fd6e 3.0b4 autobuild Copy from mozilla:Factory/MozillaThunderbird based on submit request 21376 from user wrosenauer dd0b1c474b034dce14a9ac3b03d7fd6e 3.0b4 autobuild Copy from mozilla:Factory/MozillaThunderbird based on submit request 21376 from user wrosenauer 4f4108d9b38b075d376121422b4f7774 3.0b4 autobuild Copy from mozilla:Factory/MozillaThunderbird based on submit request 22482 from user wrosenauer 659ec32abadcac3c64fc2438d472cca9 3.0.0 autobuild Copy from mozilla:Factory/MozillaThunderbird based on submit request 26004 from user wrosenauer 416cc5480cbbe7cf3d313bbbdc49f5de 3.0.1 autobuild Copy from mozilla:Factory/MozillaThunderbird based on submit request 29991 from user wrosenauer c427052fe3a40b67b7b76752858f459e 3.0.3 autobuild Copy from mozilla:Factory/MozillaThunderbird based on submit request 34079 from user wrosenauer 34079 e03686a6a9ac55986b4fb94253f74e96 3.0.3 autobuild 6d92baa97c3471ca970f013ccd22d7bd 3.0.4 autobuild Copy from mozilla:Factory/MozillaThunderbird based on submit request 36777 from user wrosenauer 36777 c5ec1f0a35c33a44d37a0c2c090703a9 3.0.4 autobuild Copy from mozilla:Factory/MozillaThunderbird based on submit request 41013 from user coolo 41013 3076875968370d2b13eaadf8dffc7fd3 3.0.5 autobuild Copy from mozilla:Factory/MozillaThunderbird based on submit request 41773 from user wrosenauer 41773 fdd97d064aa7c69e40c7c706e9dc7635 3.0.5 autobuild Copy from mozilla:Factory/MozillaThunderbird based on submit request 41985 from user wrosenauer 41985 fdd97d064aa7c69e40c7c706e9dc7635 3.0.5 autobuild release number sync fdd97d064aa7c69e40c7c706e9dc7635 3.0.5 autobuild release number sync 12a5cbf6bbb369663772c554e1144383 3.1.1 autobuild Copy from mozilla:Factory/MozillaThunderbird based on submit request 43908 from user wrosenauer 43908 f23d5b392ebf04953ec9350c05754a88 3.1.1 autobuild Copy from mozilla:Factory/MozillaThunderbird based on submit request 46683 from user wrosenauer 46683 21d07b61483b04dfb00b2748c839a448 unknown autobuild Copy from mozilla:Factory/MozillaThunderbird based on submit request 47529 from user wrosenauer 47529 528dffd25a431d105d744c2facb19cfb 3.1.4 autobuild Copy from mozilla:Factory/MozillaThunderbird based on submit request 48365 from user wrosenauer 48365 06060c16415ab12f79c6d5ce8da9e6db 3.1.5 oertel Accepted submit request 51186 from user wrosenauer 51186 cf761d7ac7db5fe3332b96205c4520cf 3.1.5 autobuild Autobuild autoformatter for 51186 12c9d2ff0f02f98cedacfcb4b78f1b00 3.1.6 oertel Accepted submit request 51547 from user wrosenauer 51547 b89cfe0f9a5bf6d1476002054041b2fb 3.1.6 autobuild Autobuild autoformatter for 51547 234bbbd8f593f7cb2a6908b8877698cf unknown darix Accepted submit request 55507 from user wrosenauer 55507 a7fcd722d283974ad1745b49c773e14e unknown darix Autobuild autoformatter for 55507 8ceecdcc3377af571a46bb78ca8f4182 unknown darix Accepted submit request 57627 from user wrosenauer 57627 50669bc15eb34505cbc1a69716e29772 unknown darix Autobuild autoformatter for 57627 1866e1f25f7b8b1c61b85dc541cbc431 unknown darix Accepted submit request 58062 from user wrosenauer 58062 bf812e4219e68d802a2e872a3e42a656 unknown darix Autobuild autoformatter for 58062 bf812e4219e68d802a2e872a3e42a656 unknown autobuild 11.4 source split 8de64af4ec87b688c1122b8c346b2544 unknown saschpe Accepted submit request 65602 from user coolo 65602 a03862e3e68b43192cac0697d0b0405c unknown saschpe Autobuild autoformatter for 65602 febbba551e901db9f92f5a5dc4da2ef8 unknown darix update 68988 ca614d2bc3a6a779ed30d7a24e7a8774 unknown autobuild 6ea7e5bdd3d4ce78f69f937d9dc9a18e unknown saschpe Thunderbird 5 + enigmail 1.2 75945 46c4a708e375b179163d35739bf0f249 unknown saschpe Autobuild autoformatter for 75945 ad7d848cf6e156c7d7de2a4b464ddd41 unknown saschpe 77746 61e3d9e66c52c647a75be25a77ae1187 unknown saschpe Autobuild autoformatter for 77746 549dee9e3752334c27f705238ec42faa unknown saschpe 79015 17156afd230ee3dea8fc2c620c8ac2db unknown saschpe Autobuild autoformatter for 79015 1b5a7862a5b1be5575a8ffef0f4292c4 unknown saschpe 79165 5b57de873a31a5a4d41d742c90dea241 unknown saschpe Autobuild autoformatter for 79165 db9d50e6d22b706ccbf063ae1a83fc6d 6.0.2 saschpe security update to Thunderbird 6.0.2 - bnc#714931 81397 2c3a842802fb7f40e6acc93ff9fc25d2 6.0.2 saschpe Autobuild autoformatter for 81397 9f4baec8efdbd459127c1e4fef43ed75 6.0.2 saschpe - make enigmail a subversion of Thunderbird to fix %release number tracking issues with the Open Build Service (taken from dmueller's 3.1.x changes) 81759 fb9c91be6d0608798da7fb9d34bf4568 6.0.2 saschpe Autobuild autoformatter for 81759 0425bc8478c02655b837d82854aa5a26 6.0.2 saschpe 82129 d156aca3e0bb582296ada3a3c8813c66 6.0.2 saschpe Autobuild autoformatter for 82129 9b46b855e141f3c549b2986ea4738ba1 unknown saschpe - update to version 7.0 (bnc#720264) - removed obsolete mozilla-cairo-lcd.patch - rebased patches 85282 23d5b486362ee3401264e49b40e11ab1 unknown lrupp 85867 23d5b486362ee3401264e49b40e11ab1 unknown adrianSuSE 2406dc0f61dd08c2decbeeadf7be6e2b unknown coolo - update to version 8.0 (bnc#728520) * MFSA 2011-47/CVE-2011-3648 (bmo#690225) Potential XSS against sites using Shift-JIS * MFSA 2011-48/CVE-2011-3651/CVE-2011-3652/CVE-2011-3654 Miscellaneous memory safety hazards * MFSA 2011-49/CVE-2011-3650 (bmo#674776) Memory corruption while profiling using Firebug * MFSA 2011-52/CVE-2011-3655 (bmo#672182) Code execution via NoWaiverWrapper - rebased patches - update enigmail to 1.3.3 - update icon cache after install/removal (bnc#726758) 90814 89ac457ee5a5fc3c0d28363803b0300d unknown coolo 92968 6296a9f945032c35b16caca812a9a632 unknown coolo replace license with spdx.org variant 8f5e3a5cd331fa339f2500e327a40256 unknown coolo - update to version 9.0 (bnc#737533) * MFSA 2011-53/CVE-2011-3660 Miscellaneous memory safety hazards (rv:9.0) * MFSA 2011-54/CVE-2011-3661 (bmo#691299) Potentially exploitable crash in the YARR regular expression library * MFSA 2011-55/CVE-2011-3658 (bmo#708186) nsSVGValue out-of-bounds access * MFSA 2011-56/CVE-2011-3663 (bmo#704482) Key detection without JavaScript via SVG animation * MFSA 2011-58/VE-2011-3665 (bmo#701259) Crash scaling <video> to extreme sizes - fixed accessibility under GNOME 3 (bnc#732898) (mozilla-a11y.patch) - do not show update channel in about box (tb-no-update-channel.patch) - update enigmail to 1.3.4 (bnc#733002) * fixes several regressions from previous release 97352 8caf9a4e49f96b182f90f02e8e65ebd7 unknown coolo - update to version 10.0 (bnc#744275) * MFSA 2012-01/CVE-2012-0442/CVE-2012-0443 Miscellaneous memory safety hazards * MFSA 2012-03/CVE-2012-0445 (bmo#701071) <iframe> element exposed across domains via name attribute * MFSA 2012-04/CVE-2011-3659 (bmo#708198) Child nodes from nsDOMAttribute still accessible after removal of nodes * MFSA 2012-05/CVE-2012-0446 (bmo#705651) Frame scripts calling into untrusted objects bypass security checks * MFSA 2012-06/CVE-2012-0447 (bmo#710079) Uninitialized memory appended when encoding icon images may cause information disclosure * MFSA 2012-07/CVE-2012-0444 (bmo#719612) Potential Memory Corruption When Decoding Ogg Vorbis files * MFSA 2012-08/CVE-2012-0449 (bmo#701806, bmo#702466) Crash with malformed embedded XSLT stylesheets - update enigmail to 1.3.5 - added mozilla-disable-neon-option.patch to be able to disable neon on ARM - removed obsolete PPC64 patch 102414 ed6ab17dbde17407ee9e33d21d87d98f unknown coolo - update to version 10.0.1 (bnc#746616) * MFSA 2012-10/CVE-2012-0452 (bmo#724284) use after free in nsXBLDocumentInfo::ReadPrototypeBindings - Use YARR interpreter instead of PCRE on platforms where YARR JIT is not supported, since PCRE doesnt build (bmo#691898) - fix ppc64 build (bmo#703534) 104185 87595d3eb55f40e906de675d8fc71ebb unknown coolo - update to Thunderbird 10.0.2 (bnc#747328) * CVE-2011-3026 (bmo#727401) libpng: integer overflow leading to heap-buffer overflow 105495 67e8ac42fb719c319f9df1980c2aa97c unknown coolo - update to Thunderbird 11.0 (bnc#750044) * MFSA 2012-13/CVE-2012-0455 (bmo#704354) XSS with Drag and Drop and Javascript: URL * MFSA 2012-14/CVE-2012-0456/CVE-2012-0457 (bmo#711653, #720103) SVG issues found with Address Sanitizer * MFSA 2012-15/CVE-2012-0451 (bmo#717511) XSS with multiple Content Security Policy headers * MFSA 2012-16/CVE-2012-0458 Escalation of privilege with Javascript: URL as home page * MFSA 2012-17/CVE-2012-0459 (bmo#723446) Crash when accessing keyframe cssText after dynamic modification * MFSA 2012-18/CVE-2012-0460 (bmo#727303) window.fullScreen writeable by untrusted content * MFSA 2012-19/CVE-2012-0461/CVE-2012-0462/CVE-2012-0464/ CVE-2012-0463 Miscellaneous memory safety hazards - update enigmail to 1.4 - added KDE integration patches (bnc#749440) - update enigmail to 1.3.99 (1.4a1pre) 109222 52d2cf1499bb39ffd073da2fd52d4dde unknown coolo - update to Thunderbird 11.0.1 (bnc#755060) * Fixing an issue where filters can get messed up (bmo#735940) * Fixes a hang when switching IMAP folders, or doing other imap functions (bmo#733731) 112142 4bc754414ec7949dd664e1a6e181e719 unknown coolo - update to Thunderbird 12.0 (bnc#758408) - update Enigmail to 1.4.1 - added mozilla-revert_621446.patch - added mozilla-libnotify.patch (bmo#737646) - added mailnew-showalert.patch (bmo#739146) - added mozilla-gcc47.patch and mailnews-literals.patch to fix compilation issues with recent gcc 4.7 - disabled crashreporter temporarily for Factory (gcc 4.7 issue) 114916 09a294467d967135fc2c33cdc5a2839a unknown coolo - update to Thunderbird 12.0.1 * fix regressions - POP3 filters (bmo#748090) - Message Body not loaded when using "Fetch Headers Only" (bmo#748865) - Received messages contain parts of other messages with movemail account (bmo#748726) - New mail notification issue (bmo#748997) - crash in nsMsgDatabase::MatchDbName (bmo#748432) - fixed build with gcc 4.7 * MFSA 2012-20/CVE-2012-0467/CVE-2012-0468 Miscellaneous memory safety hazards * MFSA 2012-22/CVE-2012-0469 (bmo#738985) use-after-free in IDBKeyRange * MFSA 2012-23/CVE-2012-0470 (bmo#734288) Invalid frees causes heap corruption in gfxImageSurface * MFSA 2012-24/CVE-2012-0471 (bmo#715319) Potential XSS via multibyte content processing errors * MFSA 2012-25/CVE-2012-0472 (bmo#744480) Potential memory corruption during font rendering using cairo-dwrite * MFSA 2012-26/CVE-2012-0473 (bmo#743475) WebGL.drawElements may read illegal video memory due to FindMaxUshortElement error * MFSA 2012-27/CVE-2012-0474 (bmo#687745, bmo#737307) Page load short-circuit can lead to XSS * MFSA 2012-28/CVE-2012-0475 (bmo#694576) Ambiguous IPv6 in Origin headers may bypass webserver access restrictions 115998 4dc2d4680c202456a0dcfc1bffd3d05b unknown coolo 121180 ffdaed2577df0d00e95821f47d83f95b unknown coolo - update to Thunderbird 13.0 (bnc#765204) * MFSA 2012-34/CVE-2012-1938/CVE-2012-1937/CVE-2011-3101 Miscellaneous memory safety hazards * MFSA 2012-36/CVE-2012-1944 (bmo#751422) Content Security Policy inline-script bypass * MFSA 2012-37/CVE-2012-1945 (bmo#670514) Information disclosure though Windows file shares and shortcut files * MFSA 2012-38/CVE-2012-1946 (bmo#750109) Use-after-free while replacing/inserting a node in a document * MFSA 2012-40/CVE-2012-1947/CVE-2012-1940/CVE-2012-1941 Buffer overflow and use-after-free issues found using Address Sanitizer - require NSS 3.13.4 * MFSA 2012-39/CVE-2012-0441 (bmo#715073) - fix build with system NSPR (mozilla-system-nspr.patch) - add dependentlibs.list for improved XRE startup - update enigmail to 1.4.2 123738 389da1b6001520312b77ab6ede3864ad unknown coolo - update to Thunderbird 13.0.1 * bugfix release 125187 389da1b6001520312b77ab6ede3864ad unknown adrianSuSE branched from openSUSE:Factory 756b9c23f0a990dc8bdf136a662368ae unknown coolo fix arm build (forwarded request 127201 from adrianSuSE) 127263 c00dcd51a64685c97187628948f6d8cb unknown coolo - update to Thunderbird 14.0 (bnc#771583) * MFSA 2012-42/CVE-2012-1949/CVE-2012-1948 Miscellaneous memory safety hazards * MFSA 2012-44/CVE-2012-1951/CVE-2012-1954/CVE-2012-1953/CVE-2012-1952 Gecko memory corruption * MFSA 2012-45/CVE-2012-1955 (bmo#757376) Spoofing issue with location * MFSA 2012-47/CVE-2012-1957 (bmo#750096) Improper filtering of javascript in HTML feed-view * MFSA 2012-48/CVE-2012-1958 (bmo#750820) use-after-free in nsGlobalWindow::PageHidden * MFSA 2012-49/CVE-2012-1959 (bmo#754044, bmo#737559) Same-compartment Security Wrappers can be bypassed * MFSA 2012-50/CVE-2012-1960 (bmo#761014) Out of bounds read in QCMS * MFSA 2012-51/CVE-2012-1961 (bmo#761655) X-Frame-Options header ignored when duplicated * MFSA 2012-52/CVE-2012-1962 (bmo#764296) JSDependentString::undepend string conversion results in memory corruption * MFSA 2012-53/CVE-2012-1963 (bmo#767778) Content Security Policy 1.0 implementation errors cause data leakage * MFSA 2012-56/CVE-2012-1967 (bmo#758344) Code execution through javascript: URLs * relicensed to MPL-2.0 - update Enigmail to 1.4.3 * bugfix release 128279 41bffe26964c2d378763ca0d861067f1 unknown namtrac Fix mozilla-kde.patch to include sys/resource.h for getrlimit etc (glibc 2.16) (forwarded request 129194 from a_jaeger) 129202 c644b785e59e805bb114fb18ef7c0af7 unknown coolo - update to Thunderbird 15.0 (bnc#777588) * MFSA 2012-57/CVE-2012-1970 Miscellaneous memory safety hazards * MFSA 2012-58/CVE-2012-1972/CVE-2012-1973/CVE-2012-1974/CVE-2012-1975 CVE-2012-1976/CVE-2012-3956/CVE-2012-3957/CVE-2012-3958/CVE-2012-3959 CVE-2012-3960/CVE-2012-3961/CVE-2012-3962/CVE-2012-3963/CVE-2012-3964 Use-after-free issues found using Address Sanitizer * MFSA 2012-59/CVE-2012-1956 (bmo#756719) Location object can be shadowed using Object.defineProperty * MFSA 2012-61/CVE-2012-3966 (bmo#775794, bmo#775793) Memory corruption with bitmap format images with negative height * MFSA 2012-62/CVE-2012-3967/CVE-2012-3968 WebGL use-after-free and memory corruption * MFSA 2012-63/CVE-2012-3969/CVE-2012-3970 SVG buffer overflow and use-after-free issues * MFSA 2012-64/CVE-2012-3971 Graphite 2 memory corruption * MFSA 2012-65/CVE-2012-3972 (bmo#746855) Out-of-bounds read in format-number in XSLT * MFSA 2012-68/CVE-2012-3975 (bmo#770684) DOMParser loads linked resources in extensions when parsing text/html * MFSA 2012-70/CVE-2012-3978 (bmo#770429) Location object security checks bypassed by chrome code * MFSA 2012-72/CVE-2012-3980 (bmo#771859) Web console eval capable of executing chrome-privileged code - update Enigmail to 1.4.4 131906 763ea33f153ef922c471802375509490 unknown coolo - update to Thunderbird 16.0 (bnc#783533) * MFSA 2012-74/CVE-2012-3982/CVE-2012-3983 Miscellaneous memory safety hazards * MFSA 2012-75/CVE-2012-3984 (bmo#575294) select element persistance allows for attacks * MFSA 2012-76/CVE-2012-3985 (bmo#655649) Continued access to initial origin after setting document.domain * MFSA 2012-77/CVE-2012-3986 (bmo#775868) Some DOMWindowUtils methods bypass security checks * MFSA 2012-79/CVE-2012-3988 (bmo#725770) DOS and crash with full screen and history navigation * MFSA 2012-80/CVE-2012-3989 (bmo#783867) Crash with invalid cast when using instanceof operator * MFSA 2012-81/CVE-2012-3991 (bmo#783260) GetProperty function can bypass security checks * MFSA 2012-82/CVE-2012-3994 (bmo#765527) top object and location property accessible by plugins * MFSA 2012-83/CVE-2012-3993/CVE-2012-4184 (bmo#768101, bmo#780370) Chrome Object Wrapper (COW) does not disallow acces to privileged functions or properties * MFSA 2012-84/CVE-2012-3992 (bmo#775009) Spoofing and script injection through location.hash * MFSA 2012-85/CVE-2012-3995/CVE-2012-4179/CVE-2012-4180/ CVE-2012-4181/CVE-2012-4182/CVE-2012-4183 Use-after-free, buffer overflow, and out of bounds read issues found using Address Sanitizer * MFSA 2012-86/CVE-2012-4185/CVE-2012-4186/CVE-2012-4187/ CVE-2012-4188 Heap memory corruption issues found using Address Sanitizer * MFSA 2012-87/CVE-2012-3990 (bmo#787704) 137669 1db3775d8ebe9b2aed0a94191e4c4613 unknown coolo - update to Thunderbird 16.0.1 (bnc#783533) * MFSA 2012-88/CVE-2012-4191 (bmo#798045) Miscellaneous memory safety hazards * MFSA 2012-89/CVE-2012-4192/CVE-2012-4193 (bmo#799952, bmo#720619) defaultValue security checks not applied 137944 5f9c907af8847023064a5eb242d19e9b unknown coolo - update to Thunderbird 16.0.2 (bnc#786522) * MFSA 2012-90/CVE-2012-4194/CVE-2012-4195/CVE-2012-4196 (bmo#800666, bmo#793121, bmo#802557) Fixes for Location object issues 139559 67ae4aad415553343d3d5045faa2ca87 unknown coolo - update to Thunderbird 17.0 (bnc#790140) * MFSA 2012-91/CVE-2012-5842/CVE-2012-5843 Miscellaneous memory safety hazards * MFSA 2012-92/CVE-2012-4202 (bmo#758200) Buffer overflow while rendering GIF images * MFSA 2012-93/CVE-2012-4201 (bmo#747607) evalInSanbox location context incorrectly applied * MFSA 2012-94/CVE-2012-5836 (bmo#792857) Crash when combining SVG text on path with CSS * MFSA 2012-96/CVE-2012-4204 (bmo#778603) Memory corruption in str_unescape * MFSA 2012-97/CVE-2012-4205 (bmo#779821) XMLHttpRequest inherits incorrect principal within sandbox * MFSA 2012-99/CVE-2012-4208 (bmo#798264) XrayWrappers exposes chrome-only properties when not in chrome compartment * MFSA 2012-100/CVE-2012-5841 (bmo#805807) Improper security filtering for cross-origin wrappers * MFSA 2012-101/CVE-2012-4207 (bmo#801681) Improper character decoding in HZ-GB-2312 charset * MFSA 2012-102/CVE-2012-5837 (bmo#800363) Script entered into Developer Toolbar runs with chrome privileges * MFSA 2012-103/CVE-2012-4209 (bmo#792405) Frames can shadow top.location * MFSA 2012-105/CVE-2012-4214/CVE-2012-4215/CVE-2012-4216/ CVE-2012-5829/CVE-2012-5839/CVE-2012-5840/CVE-2012-4212/ CVE-2012-4213/CVE-2012-4217/CVE-2012-4218 Use-after-free and buffer overflow issues found using Address Sanitizer * MFSA 2012-106/CVE-2012-5830/CVE-2012-5833/CVE-2012-5835/CVE-2012-5838 142209 cdfcd8da562e20e70bcc9ec2fcbdde38 unknown coolo - fix KDE integration for file dialogs - fix some rpmlint warnings (mkdir.done files) - build on SLE11 * mozilla-gcc43-enums.patch * mozilla-gcc43-template_hacks.patch * mozilla-gcc43-templates_instantiation.patch 143654 0e5f09be26a050ac5cfc9018507ffda8 unknown coolo - update to Thunderbird 17.0.2 (bnc#796895) * MFSA 2013-01/CVE-2013-0749/CVE-2013-0769/CVE-2013-0770 Miscellaneous memory safety hazards * MFSA 2013-02/CVE-2013-0760/CVE-2013-0762/CVE-2013-0766/CVE-2013-0767 CVE-2013-0761/CVE-2013-0763/CVE-2013-0771/CVE-2012-5829 Use-after-free and buffer overflow issues found using Address Sanitizer * MFSA 2013-03/CVE-2013-0768 (bmo#815795) Buffer Overflow in Canvas * MFSA 2013-04/CVE-2012-0759 (bmo#802026) URL spoofing in addressbar during page loads * MFSA 2013-05/CVE-2013-0744 (bmo#814713) Use-after-free when displaying table with many columns and column groups * MFSA 2013-07/CVE-2013-0764 (bmo#804237) Crash due to handling of SSL on threads * MFSA 2013-08/CVE-2013-0745 (bmo#794158) AutoWrapperChanger fails to keep objects alive during garbage collection * MFSA 2013-09/CVE-2013-0746 (bmo#816842) Compartment mismatch with quickstubs returned values * MFSA 2013-10/CVE-2013-0747 (bmo#733305) Event manipulation in plugin handler to bypass same-origin policy * MFSA 2013-11/CVE-2013-0748 (bmo#806031) Address space layout leaked in XBL objects * MFSA 2013-12/CVE-2013-0750 (bmo#805121) Buffer overflow in Javascript string concatenation * MFSA 2013-13/CVE-2013-0752 (bmo#805024) Memory corruption in XBL with XML bindings containing SVG * MFSA 2013-14/CVE-2013-0757 (bmo#813901) Chrome Object Wrapper (COW) bypass through changing prototype * MFSA 2013-15/CVE-2013-0758 (bmo#813906) Privilege escalation through plugin objects 147600 0e5f09be26a050ac5cfc9018507ffda8 unknown adrianSuSE Split 12.3 from Factory c974f2c4e49058e4c7f913b81cdeb6d6 unknown coolo - update to Thunderbird 17.0.3 (bnc#804248) * MFSA 2013-21/CVE-2013-0783 Miscellaneous memory safety hazards * MFSA 2013-24/CVE-2013-0773 (bmo#809652) Web content bypass of COW and SOW security wrappers * MFSA 2013-25/CVE-2013-0774 (bmo#827193) Privacy leak in JavaScript Workers * MFSA 2013-26/CVE-2013-0775 (bmo#831095) Use-after-free in nsImageLoadingContent * MFSA 2013-27/CVE-2013-0776 (bmo#796475) Phishing on HTTPS connection through malicious proxy * MFSA 2013-28/CVE-2013-0780/CVE-2013-0782 Use-after-free, out of bounds read, and buffer overflow issues found using Address Sanitizer - update Enigmail to 1.5.1 * The release fixes the regressions found in the past few weeks 155862 be90c6e65637e3023da0fbb31a5f7166 unknown coolo - update to Thunderbird 17.0.4 (bnc#808243) * MFSA 2013-29/CVE-2013-0787 (bmo#848644) Use-after-free in HTML Editor 158562 edd2a174b68f78cdef429583f1009964 unknown coolo - update to Thunderbird 17.0.5 (bnc#813026) * requires NSPR 4.9.5 and NSS 3.14.3 * MFSA 2013-30/CVE-2013-0788/CVE-2013-0789 Miscellaneous memory safety hazards * MFSA 2013-31/CVE-2013-0800 (bmo#825721) Out-of-bounds write in Cairo library * MFSA 2013-35/CVE-2013-0796 (bmo#827106) WebGL crash with Mesa graphics driver on Linux * MFSA 2013-36/CVE-2013-0795 (bmo#825697) Bypass of SOW protections allows cloning of protected nodes * MFSA 2013-38/CVE-2013-0793 (bmo#803870) Cross-site scripting (XSS) using timed history navigations 162289 b6a8f58485426a777679cef559d12bb1 unknown coolo - update to Thunderbird 17.0.6 (bnc#819204) * MFSA 2013-41/CVE-2013-0801/CVE-2013-1669 Miscellaneous memory safety hazards * MFSA 2013-42/CVE-2013-1670 (bmo#853709) Privileged access for content level constructor * MFSA 2013-46/CVE-2013-1674 (bmo#860971) Use-after-free with video and onresize event * MFSA 2013-47/CVE-2013-1675 (bmo#866825) Uninitialized functions in DOMSVGZoomEvent * MFSA 2013-48/CVE-2013-1676/CVE-2013-1677/CVE-2013-1678/ CVE-2013-1679/CVE-2013-1680/CVE-2013-1681 Memory corruption found using Address Sanitizer 175659 2aee6c9a84788cb25ae1ece109234610 unknown coolo - prevent xpc-shell crashing on powerpc ppc-xpcshell.patch (forwarded request 177615 from k0da) 177943 29a6a3cc1e802ee3a214d6c2c664a25e unknown coolo - update to Thunderbird 17.0.7 (bnc#825935) * MFSA 2013-49/CVE-2013-1682 Miscellaneous memory safety hazards * MFSA 2013-50/CVE-2013-1684/CVE-2013-1685/CVE-2013-1686 Memory corruption found using Address Sanitizer * MFSA 2013-51/CVE-2013-1687 (bmo#863933, bmo#866823) Privileged content access and execution via XBL * MFSA 2013-53/CVE-2013-1690 (bmo#857883) Execution of unmapped memory through onreadystatechange event * MFSA 2013-54/CVE-2013-1692 (bmo#866915) Data in the body of XHR HEAD requests leads to CSRF attacks * MFSA 2013-55/CVE-2013-1693 (bmo#711043) SVG filters can lead to information disclosure * MFSA 2013-56/CVE-2013-1694 (bmo#848535) PreserveWrapper has inconsistent behavior * MFSA 2013-59/CVE-2013-1697 (bmo#858101) XrayWrappers can be bypassed to run user defined methods in a privileged context ppc-xpcshell.patch 180914 9b0a7de1919ffc627dea009c24bc71b9 unknown scarabeus_factory - update to Thunderbird 17.0.8 (bnc#833389) * MFSA 2013-63/CVE-2013-1701 Miscellaneous memory safety hazards * MFSA 2013-68/CVE-2013-1709 (bmo#838253) Document URI misrepresentation and masquerading * MFSA 2013-69/CVE-2013-1710 (bmo#871368) CRMF requests allow for code execution and XSS attacks * MFSA 2013-72/CVE-2013-1713 (bmo#887098) Wrong principal used for validating URI for some Javascript components * MFSA 2013-73/CVE-2013-1714 (bmo#879787) Same-origin bypass with web workers and XMLHttpRequest * MFSA 2013-75/CVE-2013-1717 (bmo#406541, bmo#738397) Local Java applets may read contents of local file system - update Enigmail to 1.5.2 * bugfix release 186306 9b0a7de1919ffc627dea009c24bc71b9 unknown adrianSuSE Split 13.1 from Factory f220066add1a8734deabadc57810ca17 unknown coolo - update to Thunderbird 24.0 (bnc#840485) * MFSA 2013-76/CVE-2013-1718/CVE-2013-1719 Miscellaneous memory safety hazards * MFSA 2013-77/CVE-2013-1720 (bmo#888820) Improper state in HTML5 Tree Builder with templates * MFSA 2013-79/CVE-2013-1722 (bmo#893308) Use-after-free in Animation Manager during stylesheet cloning * MFSA 2013-80/CVE-2013-1723 (bmo#891292) NativeKey continues handling key messages after widget is destroyed * MFSA 2013-81/CVE-2013-1724 (bmo#894137) Use-after-free with select element * MFSA 2013-82/CVE-2013-1725 (bmo#876762) Calling scope for new Javascript objects can lead to memory corruption * MFSA 2013-85/CVE-2013-1728 (bmo#883686) Uninitialized data in IonMonkey * MFSA 2013-88/CVE-2013-1730 (bmo#851353) Compartment mismatch re-attaching XBL-backed nodes * MFSA 2013-89/CVE-2013-1732 (bmo#883514) Buffer overflow with multi-column, lists, and floats * MFSA 2013-90/CVE-2013-1735/CVE-2013-1736 (bmo#898871, bmo#906301) Memory corruption involving scrolling * MFSA 2013-91/CVE-2013-1737 (bmo#907727) User-defined properties on DOM proxies get the wrong "this" object * MFSA 2013-92/CVE-2013-1738 (bmo#887334, bmo#882897) GC hazard with default compartments and frame chain restoration - moved greek to common translation package - require NSPR 4.10 and NSS 3.15.1 - add GStreamer build requirements for Gecko - added enigmail-build.patch to fix TB packaging (bmo#886095) - removed obsolete patches: 199621 2048f6256f724b0f8142dfc01abfa3af unknown scarabeus_factory 203067 34bca0fe1ada2d368655fcaf4d92b4fe unknown coolo - update to Thunderbird 24.1.0 (bnc#847708) * requires NSS 3.15.2 or above * MFSA 2013-93/CVE-2013-5590/CVE-2013-5591/CVE-2013-5592 Miscellaneous memory safety hazards * MFSA 2013-94/CVE-2013-5593 (bmo#868327) Spoofing addressbar through SELECT element * MFSA 2013-95/CVE-2013-5604 (bmo#914017) Access violation with XSLT and uninitialized data * MFSA 2013-96/CVE-2013-5595 (bmo#916580) Improperly initialized memory and overflows in some JavaScript functions * MFSA 2013-97/CVE-2013-5596 (bmo#910881) Writing to cycle collected object during image decoding * MFSA 2013-98/CVE-2013-5597 (bmo#918864) Use-after-free when updating offline cache * MFSA 2013-100/CVE-2013-5599/CVE-2013-5600/CVE-2013-5601 (bmo#915210, bmo#915576, bmo#916685) Miscellaneous use-after-free issues found through ASAN fuzzing * MFSA 2013-101/CVE-2013-5602 (bmo#897678) Memory corruption in workers * MFSA 2013-102/CVE-2013-5603 (bmo#916404) Use-after-free in HTML document templates 205266 c66354dc6c275bc5269bfbf77bf25370 unknown coolo Automatic submission by obs-autosubmit 209660 3cabcaddb32a34742c889c8e9c696f5c unknown coolo - update to Thunderbird 24.2.0 (bnc#854370) * requires NSS 3.15.3.1 or higher * MFSA 2013-104/CVE-2013-5609/CVE-2013-5610 Miscellaneous memory safety hazards * MFSA 2013-108/CVE-2013-5616 (bmo#938341) Use-after-free in event listeners * MFSA 2013-109/CVE-2013-5618 (bmo#926361) Use-after-free during Table Editing * MFSA 2013-111/CVE-2013-6671 (bmo#930281) Segmentation violation when replacing ordered list elements * MFSA 2013-113/CVE-2013-6673 (bmo#970380) Trust settings for built-in roots ignored during EV certificate validation * MFSA 2013-114/CVE-2013-5613 (bmo#930381, bmo#932449) Use-after-free in synthetic mouse movement * MFSA 2013-115/CVE-2013-5615 (bmo#929261) GetElementIC typed array stubs can be generated outside observed typesets * MFSA 2013-116/CVE-2013-6629/CVE-2013-6630 (bmo#891693) JPEG information leak * MFSA 2013-117 (bmo#946351) Mis-issued ANSSI/DCSSI certificate (fixed via NSS 3.15.3.1) 210493 df01da7f07af53b258274c4bc8fbbda2 unknown coolo Automatic submission by obs-autosubmit 213382 f553f764e9e821bedbd6aaf42a887fb7 unknown coolo - update to Thunderbird 24.3.0 (bnc#861847) * MFSA 2014-01/CVE-2014-1477/CVE-2014-1478 Miscellaneous memory safety hazards (rv:27.0 / rv:24.3) * MFSA 2014-02/CVE-2014-1479 (bmo#911864) Clone protected content with XBL scopes * MFSA 2014-04/CVE-2014-1482 (bmo#943803) Incorrect use of discarded images by RasterImage * MFSA 2014-08/CVE-2014-1486 (bmo#942164) Use-after-free with imgRequestProxy and image proccessing * MFSA 2014-09/CVE-2014-1487 (bmo#947592) Cross-origin information leak through web workers * MFSA 2014-12/CVE-2014-1490/CVE-2014-1491 (bmo#934545, bmo#930874, bmo#930857) NSS ticket handling issues * MFSA 2014-13/CVE-2014-1481(bmo#936056) Inconsistent JavaScript handling of access to Window objects - requires NSS 3.15.4 - renamed ppc64le patches to streamline with Firefox package 220930 838407665c5ce70b745b44e60ff9b589 unknown coolo - update to Thunderbird 24.4.0 (bnc#868603) * MFSA 2014-15/CVE-2014-1493/CVE-2014-1494 Miscellaneous memory safety hazards * MFSA 2014-17/CVE-2014-1497 (bmo#966311) Out of bounds read during WAV file decoding * MFSA 2014-26/CVE-2014-1508 (bmo#963198) Information disclosure through polygon rendering in MathML * MFSA 2014-27/CVE-2014-1509 (bmo#966021) Memory corruption in Cairo during PDF font rendering * MFSA 2014-28/CVE-2014-1505 (bmo#941887) SVG filters information disclosure through feDisplacementMap * MFSA 2014-29/CVE-2014-1510/CVE-2014-1511 (bmo#982906, bmo#982909) Privilege escalation using WebIDL-implemented APIs * MFSA 2014-30/CVE-2014-1512 (bmo#982957) Use-after-free in TypeObject * MFSA 2014-31/CVE-2014-1513 (bmo#982974) Out-of-bounds read/write through neutering ArrayBuffer objects * MFSA 2014-32/CVE-2014-1514 (bmo#983344) Out-of-bounds write through TypedArrayObject after neutering 226674 c17bdf659275701bd7c5a0193a5ad2e0 unknown coolo - update to Thunderbird 24.5.0 (bnc#875378) * MFSA 2014-34/CVE-2014-1518 Miscellaneous memory safety hazards * MFSA 2014-37/CVE-2014-1523 (bmo#969226) Out of bounds read while decoding JPG images * MFSA 2014-38/CVE-2014-1524 (bmo#989183) Buffer overflow when using non-XBL object as XBL * MFSA 2014-42/CVE-2014-1529 (bmo#987003) Privilege escalation through Web Notification API * MFSA 2014-43/CVE-2014-1530 (bmo#895557) Cross-site scripting (XSS) using history navigations * MFSA 2014-44/CVE-2014-1531 (bmo#987140) Use-after-free in imgLoader while resizing images * MFSA 2014-46/CVE-2014-1532 (bmo#966006) Use-after-free in nsHostResolver - use shipped-locales as the authoritative source for supported locales (some unsupported locales disappear from -other package) 232131 955ed8e063c5e57a5f674e89b185cf00 unknown coolo - update to Thunderbird 24.6.0 (bnc#881874) * MFSA 2014-48/CVE-2014-1533/CVE-2014-1534 (bmo#921622, bmo#967354, bmo#969517, bmo#969549, bmo#973874, bmo#978652, bmo#978811, bmo#988719, bmo#990868, bmo#991981, bmo#992274, bmo#994907, bmo#995679, bmo#995816, bmo#995817, bmo#996536, bmo#996715, bmo#999651, bmo#1000598, bmo#1000960, bmo#1002340, bmo#1005578, bmo#1007223, bmo#1009952, bmo#1011007) Miscellaneous memory safety hazards (rv:30.0 / rv:24.6) * MFSA 2014-49/CVE-2014-1536/CVE-2014-1537/CVE-2014-1538 (bmo#989994, bmo#999274, bmo#1005584) Use-after-free and out of bounds issues found using Address Sanitizer * MFSA 2014-52/CVE-2014-1541 (bmo#1000185) Use-after-free with SMIL Animation Controller * MFSA 2014-55/CVE-2014-1545 (bmo#1018783) Out of bounds write in NSPR - require NSPR 4.10.6 because of MFSA 2014-55/CVE-2014-1545 236869 2ce0e8615abb78c23f6e923071051f0f 24.7.0 coolo - update to Thunderbird 24.7.0 (bnc#887746) * MFSA 2014-56/CVE-2014-1547/CVE-2014-1548 Miscellaneous memory safety hazards * MFSA 2014-61/CVE-2014-1555 (bmo#1023121) Use-after-free with FireOnStateChange event * MFSA 2014-62/CVE-2014-1556 (bmo#1028891) Exploitable WebGL crash with Cesium JavaScript library * MFSA 2014-63/CVE-2014-1544 (bmo#963150) Use-after-free while when manipulating certificates in the trusted cache (solved with NSS 3.16.2 requirement) * MFSA 2014-64/CVE-2014-1557 (bmo#913805) Crash in Skia library when scaling high quality images - disabled enigmail build as with version 1.7 it's a standalone source package 241956 0ccca14db717c5d09f6328558de014b9 31.0 coolo - update to Thunderbird 31.0 * based on Gecko 31 * Autocompleting email addresses now matches against any part of the name or email * Composing a mail to a newsgroup will now autocomplete newsgroup names * Insecure NTLM (pre-NTLMv2) authentication disabled - rebased patches - removed enigmail entirely from source package - removed obsolete patches * libffi-ppc64le.patch * ppc64le-support.patch * xpcom-ppc64le.patch - use GStreamer 1.0 after 13.1 - switched source archives to use xz instead of bz2 242772 0ccca14db717c5d09f6328558de014b9 31.0 adrianSuSE Split 13.2 from Factory 4ab49d3ed9a2312075717a63045cd0cf 31.1.0 coolo - update to Thunderbird 31.1.0 (bnc#894370) * MFSA 2014-67/CVE-2014-1553/CVE-2014-1562 Miscellaneous memory safety hazards * MFSA 2014-68/CVE-2014-1563 (bmo#1018524) Use-after-free during DOM interactions with SVG * MFSA 2014-69/CVE-2014-1564 (bmo#1045977) Uninitialized memory use during GIF rendering * MFSA 2014-70/CVE-2014-1565 (bmo#1047831) Out-of-bounds read in Web Audio audio timeline * MFSA 2014-72/CVE-2014-1567 (bmo#1037641) Use-after-free setting text directionality - added mozilla-nullptr-gcc45.patch to build on gcc 4.5 dists (e.g. openSUSE 11.4) 247295 2e4a9ac977446109e9810e56c0552f42 31.1.1 coolo 249091 9507123d38d6c96ff6d6f0577c418893 31.2.0 coolo - update to Thunderbird 31.2.0 (bnc#900941) * MFSA 2014-74/CVE-2014-1574 Miscellaneous memory safety hazards * MFSA 2014-75/CVE-2014-1576 (bmo#1041512) Buffer overflow during CSS manipulation * MFSA 2014-76/CVE-2014-1577 (bmo#1012609) Web Audio memory corruption issues with custom waveforms * MFSA 2014-77/CVE-2014-1578 (bmo#1063327) Out-of-bounds write with WebM video * MFSA 2014-79/CVE-2014-1581 (bmo#1068218) Use-after-free interacting with text directionality * MFSA 2014-81/CVE-2014-1585/CVE-2014-1586 (bmo#1062876, bmo#1062981) Inconsistent video sharing within iframe - added basic appdata definition - update to Thunderbird 31.1.2 256558 bed0fc87bc515a40b2e7bde7fe30a9f0 31.2.0 coolo - remove add-plugins.sh and use /usr/share/myspell directly (bnc#900639) 258425 16b3eef7e377fb4453080533781823a8 31.2.0 coolo 1 259625 7c1965711a1929dc6afcc31ca53e3c98 31.2.0 dimstar_suse 262392 8f10a6ddb146314744a63aa8ba849cb3 31.3.0 dimstar_suse - update to Thunderbird 31.3.0 (bnc#908009) * MFSA 2014-83/CVE-2014-1587 Miscellaneous memory safety hazards * MFSA 2014-85/CVE-2014-1590 (bmo#1087633) XMLHttpRequest crashes with some input streams * MFSA 2014-87/CVE-2014-1592 (bmo#1088635) Use-after-free during HTML5 parsing * MFSA 2014-88/CVE-2014-1593 (bmo#1085175) Buffer overflow while parsing media content * MFSA 2014-89/CVE-2014-1594 (bmo#1074280) Bad casting from the BasicThebesLayer to BasicContainerLayer 263823 c145bf2fd86e8f047bdec8611305ffe1 31.4.0 coolo - update to Thunderbird 31.4.0 (bnc#910669) * MFSA 2015-01/CVE-2014-8634/CVE-2014-8635 Miscellaneous memory safety hazards * MFSA 2015-03/CVE-2014-8638 (bmo#1080987) sendBeacon requests lack an Origin header * MFSA 2015-04/CVE-2014-8639 (bmo#1095859) Cookie injection through Proxy Authenticate responses - added mozilla-icu-strncat.patch to fix post build checks 281363 03099431e810d6729ad61fb8be59f3df 31.5.0 dimstar_suse - update to Thunderbird 31.5.0 (bnc#917597) * MFSA 2015-11/CVE-2015-0836 Miscellaneous memory safety hazards * MFSA 2015-12/CVE-2015-0833 (bmo#945192) Invoking Mozilla updater will load locally stored DLL files (Windows only) * MFSA 2015-16/CVE-2015-0831 (bmo#1130514) Use-after-free in IndexedDB * MFSA 2015-19/CVE-2015-0827 (bmo#1117304) Out-of-bounds read and write while rendering SVG content * MFSA 2015-24/CVE-2015-0822 (bmo#1110557) Reading of local files through manipulation of form autocomplete 287636 49f936d233ed20e23b2379185ab19762 31.6.0 dimstar_suse - update to Thunderbird 31.6.0 (bnc#925368) * MFSA 2015-30/CVE-2015-0815 Miscellaneous memory safety hazards * MFSA 2015-31/CVE-2015-0813 (bmo#1106596)) Use-after-free when using the Fluendo MP3 GStreamer plugin * MFSA 2015-33/CVE-2015-0816 (bmo#1144991) resource:// documents can load privileged pages * MFSA-2015-37/CVE-2015-0807 (bmo#1111834) CORS requests should not follow 30x redirections after preflight * MFSA-2015-40/CVE-2015-0801 (bmo#1146339) Same-origin bypass through anchor navigation 293911 a3489ebcb27e8356860ab89c0f9de9ae 31.7.0 dimstar_suse - update to Thunderbird 31.7.0 (bnc#930622) * MFSA 2015-46/CVE-2015-2708 Miscellaneous memory safety hazards * MFSA 2015-47/VE-2015-0797 (bmo#1080995) Buffer overflow parsing H.264 video with Linux Gstreamer * MFSA 2015-48/CVE-2015-2710 (bmo#1149542) Buffer overflow with SVG content and CSS * MFSA 2015-51/CVE-2015-2713 (bmo#1153478) Use-after-free during text processing with vertical text enabled * MFSA 2015-54/CVE-2015-2716 (bmo#1140537) Buffer overflow when parsing compressed XML * MFSA 2015-57/CVE-2011-3079 (bmo#1087565) Privilege escalation through IPC channel messages 307239 78ec6f6230527f21b7b9b855fca4443d 31.7.0 dimstar_suse 1 309123 0141bae83ad4c65628a7be6a1e8904ad 38.1.0 coolo - update to Thunderbird 38.1.0 (bnc#935979) * MFSA 2015-59/CVE-2015-2724/CVE-2015-2725 Miscellaneous memory safety hazards * MFSA 2015-60/CVE-2015-2727 (bmo#1163422) Local files or privileged URLs in pages can be opened into new tabs * MFSA 2015-61/CVE-2015-2728 (bmo#1142210) Type confusion in Indexed Database Manager * MFSA 2015-62/CVE-2015-2729 (bmo#1122218) Out-of-bound read while computing an oscillator rendering range in Web Audio * MFSA 2015-63/CVE-2015-2731 (bmo#1149891) Use-after-free in Content Policy due to microtask execution error * MFSA 2015-64/CVE-2015-2730 (bmo#1125025) ECDSA signature validation fails to handle some signatures correctly (this fix is shipped by NSS 3.19.1 externally) * MFSA 2015-65/CVE-2015-2722/CVE-2015-2733 (bmo#1166924, bmo#1169867) Use-after-free in workers while using XMLHttpRequest * MFSA 2015-66/CVE-2015-2734/CVE-2015-2735/CVE-2015-2736/CVE-2015-2737 CVE-2015-2738/CVE-2015-2739/CVE-2015-2740 Vulnerabilities found through code inspection * MFSA 2015-67/CVE-2015-2741 (bmo#1147497) Key pinning is ignored when overridable errors are encountered * MFSA 2015-69/CVE-2015-2743 (bmo#1163109) Privilege escalation in PDF.js * MFSA 2015-70/CVE-2015-4000 (bmo#1138554) NSS accepts export-length DHE keys with regular DHE cipher suites (this fix is shipped by NSS 3.19.1 externally) * MFSA 2015-71/CVE-2015-2721 (bmo#1086145) NSS incorrectly permits skipping of ServerKeyExchange (this fix is shipped by NSS 3.19.1 externally) - requires NSS 3.19.2 316435 7e76ef03e8d6f01506c8bf8d20748740 38.2.0 dimstar_suse - update to Thunderbird 38.2.0 (bnc#940806) * MFSA 2015-79/CVE-2015-4473 Miscellaneous memory safety hazards * MFSA 2015-80/CVE-2015-4475 (bmo#1175396) Out-of-bounds read with malformed MP3 file * MFSA 2015-82/CVE-2015-4478 (bmo#1105914) Redefinition of non-configurable JavaScript object properties * MFSA 2015-83/CVE-2015-4479/CVE-2015-4480/CVE-2015-4493 Overflow issues in libstagefright * MFSA 2015-84/CVE-2015-4481 (bmo1171518) Arbitrary file overwriting through Mozilla Maintenance Service with hard links (only affected Windows) * MFSA 2015-85/CVE-2015-4482 (bmo#1184500) Out-of-bounds write with Updater and malicious MAR file (does not affect openSUSE RPM packages which do not ship the updater) * MFSA 2015-87/CVE-2015-4484 (bmo#1171540) Crash when using shared memory in JavaScript * MFSA 2015-88/CVE-2015-4491 (bmo#1184009) Heap overflow in gdk-pixbuf when scaling bitmap images * MFSA 2015-89/CVE-2015-4485/CVE-2015-4486 (bmo#1177948, bmo#1178148) Buffer overflows on Libvpx when decoding WebM video * MFSA 2015-90/CVE-2015-4487/CVE-2015-4488/CVE-2015-4489 Vulnerabilities found through code inspection * MFSA 2015-92/CVE-2015-4492 (bmo#1185820) Use-after-free in XMLHttpRequest with shared workers 323869 fdcf05ab1c00ff9165459e39cb574944 38.3.0 coolo 1 336566 41c6a0421d1543c8a80b2aec657e89bd 38.4.0 dimstar_suse - update to Thunderbird 38.4.0 (bnc#952810) * MFSA 2015-116/CVE-2015-4513/CVE-2015-4514 Miscellaneous memory safety hazards * MFSA 2015-122/CVE-2015-7188 (bmo#1199430) Trailing whitespace in IP address hostnames can bypass same-origin policy * MFSA 2015-123/CVE-2015-7189 (bmo#1205900) Buffer overflow during image interactions in canvas * MFSA 2015-127/CVE-2015-7193 (bmo#1210302) CORS preflight is bypassed when non-standard Content-Type headers are received * MFSA 2015-128/CVE-2015-7194 (bmo#1211262) Memory corruption in libjar through zip files * MFSA 2015-130/CVE-2015-7196 (bmo#1140616) JavaScript garbage collection crash with Java applet * MFSA 2015-131/CVE-2015-7198/CVE-2015-7199/CVE-2015-7200 (bmo#1188010, bmo#1204061, bmo#1204155) Vulnerabilities found through code inspection * MFSA 2015-132/CVE-2015-7197 (bmo#1204269) Mixed content WebSocket policy bypass through workers * MFSA 2015-133/CVE-2015-7181/CVE-2015-7182/CVE-2015-7183 (bmo#1202868, bmo#1205157) NSS and NSPR memory corruption issues (fixed in mozilla-nspr and mozilla-nss packages) - requires NSPR 4.10.10 and NSS 3.19.2.1 - added explicit appdata provides (bnc#952325) -------------------------------------------------------------------- 346366 d46209c81aea4bc277ecae74d91e4de2 38.5.0 dimstar_suse - update to Thunderbird 38.5.0 (bnc#959277) * MFSA 2015-134/CVE-2015-7201 Miscellaneous memory safety hazards * MFSA 2015-138/CVE-2015-7210 (bmo#1218326) Use-after-free in WebRTC when datachannel is used after being destroyed * MFSA 2015-139/CVE-2015-7212 (bmo#1222809) Integer overflow allocating extremely large textures * MFSA 2015-145/CVE-2015-7205 (bmo#1220493) Underflow through code inspection * MFSA 2015-146/CVE-2015-7213 (bmo#1206211) Integer overflow in MP4 playback in 64-bit versions * MFSA 2015-147/CVE-2015-7222 (bmo#1216748) Integer underflow and buffer overflow processing MP4 metadata in libstagefright * MFSA 2015-149/CVE-2015-7214 (bmo#1228950) Cross-site reading attack through data and view-source URIs 350596 ec3e8c2c5d7ed7871c67ce47c6e8b087 38.5.1 dimstar_suse 351297 916d89d61f022eb2c62c809233085b1e 38.5.1 dimstar_suse 1 354747 c9ee6640c9b97e0f87ba490be01a65af 38.5.1 dimstar_suse Automatic submission by obs-autosubmit 357295 98d322b86b4bc3ced16830ccb02a3749 38.6.0 dimstar_suse - update to Thunderbird 38.6.0 (boo#963520) * Filters ran on a different folder than selected * MFSA 2016-01/CVE-2016-1930 Miscellaneous memory safety hazards * MFSA 2016-03/CVE-2016-1935 (bmo#1220450) Buffer overflow in WebGL after out of memory allocation 359408 21d3d1362888f4eb4e43df73b33aef5c 38.6.0 dimstar_suse 1 362033 ebe5b879f77a474f414a8ade86a2033b 38.7.0 dimstar_suse - update to Thunderbird 38.7.0 (boo#969894) * MFSA 2015-81/CVE-2015-4477 (bmo#1179484) Use-after-free in MediaStream playback * MFSA 2015-136/CVE-2015-7207 (bmo#1185256) Same-origin policy violation using performance.getEntries and history navigation * MFSA 2016-16/CVE-2016-1952 Miscellaneous memory safety hazards * MFSA 2016-17/CVE-2016-1954 (bmo#1243178) Local file overwriting and potential privilege escalation through CSP reports * MFSA 2016-20/CVE-2016-1957 (bmo#1227052) Memory leak in libstagefright when deleting an array during MP4 processing * MFSA 2016-21/CVE-2016-1958 (bmo#1228754) Displayed page address can be overridden * MFSA 2016-23/CVE-2016-1960/ZDI-CAN-3545 (bmo#1246014) Use-after-free in HTML5 string parser * MFSA 2016-24/CVE-2016-1961/ZDI-CAN-3574 (bmo#1249377) Use-after-free in SetBody * MFSA 2016-25/CVE-2016-1962 (bmo#1240760) Use-after-free when using multiple WebRTC data channels * MFSA 2016-27/CVE-2016-1964 (bmo#1243335) Use-after-free during XML transformations * MFSA 2016-28/CVE-2016-1965 (bmo#1245264) Addressbar spoofing though history navigation and Location protocol property * MFSA 2016-31/CVE-2016-1966 (bmo#1246054) Memory corruption with malicious NPAPI plugin * MFSA 2016-34/CVE-2016-1974 (bmo#1228103) 373458 c2cfdd3a1d5a4870ebf3943c03d42a3d 38.7.1 dimstar_suse Automatic submission by obs-autosubmit 383091 fd9aebf42ff6d636ace66aada5cb47de 38.7.2 dimstar_suse 1 386004 0ebceb4ae122c19be6e5dfed68c9a837 45.1.0 dimstar_suse 1 396129 60ca3f608ddc8a025c8afd4c105bf663 45.1.0 dimstar_suse 1 398145 97d42b0cc00e25a4405901584e3393af 45.1.1 dimstar_suse 399148 b6df210318d130b68fbd5036b48134b5 45.1.1 dimstar_suse - build with -fno-delete-null-pointer-checks for Tumbleweed/gcc6 as long as underlying issues have been addressed upstream (boo#986162) - Fix running on 48bit va aarch64 (bsc#984126) - Add patch mozilla-aarch64-48bit-va.patch 404253 47fcb9a6917f26378a7ba8b3552e562a 45.1.1 dimstar_suse - mozilla-binutils-visibility.patch to fix build issues with gcc/binutils combination used in Leap 42.2 (boo#984637) 404805 9b61e73bb68db2dc2c995ede1cdf867e 45.2 dimstar_suse 1 407286 4d0e65f8072f50e1d87cb1d29887d257 45.2 dimstar_suse 1 412624 7a45868771e65a809351450ecaa9b788 45.2 dimstar_suse 1 417432 c84c6e6d0f52741044637772f5c5d657 45.3.0 dimstar_suse 1 423934 2d397ca63d3354aa0adf6bc6a3d95380 45.4.0 dimstar_suse - update to Thunderbird 45.4.0 (boo#999701) * Display name was truncated if no separating space before email address. * Recipient addresses were shown in wrong color in some circumstances. * Additional spaces were inserted when drafts were edited. * Mail saved as template copied In-Reply-To and References from original email. * Threading broken when editing message draft, due to loss of Message-ID * "Apply columns to..." did not honor special folders 433302 1e3bf4c02b04c00684fdd9e2e8e45e26 45.5.0 dimstar_suse 1 440959 b87c11f0d8b2b467f1f2e5966a3a9ba5 45.5.1 dimstar_suse 1 443070 711c71d228ff5a9700b78a5f26c5f627 45.6.0 lnussel_factory - update to Thunderbird 45.6.0 (boo#1015422) * The system integration dialog was shown every time when starting Thunderbird * MFSA 2016-96 CVE-2016-9899: Use-after-free while manipulating DOM events and audio elements (bmo#1317409) CVE-2016-9895: CSP bypass using marquee tag (bmo#1312272) CVE-2016-9897: Memory corruption in libGLES (bmo#1301381) CVE-2016-9898: Use-after-free in Editor while manipulating DOM subtrees (bmo#1314442) CVE-2016-9900: Restricted external resources can be loaded by SVG images through data URLs (bmo#1319122) CVE-2016-9904: Cross-origin information leak in shared atoms (bmo#1317936) CVE-2016-9905: Crash in EnumerateSubDocuments (bmo#1293985) CVE-2016-9893: Memory safety bugs fixed in Thunderbird 45.6 CVE-2016-5290: Memory safety bugs fixed in Thunderbird ESR 45.5 448120 5d6475eb88f7745a6e9055f901c4adb8 45.7.0 dimstar_suse 1 452950 ace51e59d73e37351d05e7e40c763c1a 45.7.1 dimstar_suse - update to Thunderbird 45.7.1 * fixed Crash when viewing certain IMAP messages (introduced in 45.7.0) 456391 030e3bad8493408fcadc3a24fd8ab20e 45.8.0 dimstar_suse fix typo in release date - update to Thunderbird 45.8.0 (boo#1028391) * MFSA 2017-07 CVE-2017-5400: asm.js JIT-spray bypass of ASLR and DEP (bmo#1334933) CVE-2017-5401: Memory Corruption when handling ErrorResult (bmo#1328861) CVE-2017-5402: Use-after-free working with events in FontFace objects (bmo#1334876) CVE-2017-5404: Use-after-free working with ranges in selections (bmo#1340138) CVE-2017-5407: Pixel and history stealing via floating-point timing side channel with SVG filters (bmo#1336622) CVE-2017-5410: Memory corruption during JavaScript garbage collection incremental sweeping (bmo#1330687) CVE-2017-5408: Cross-origin reading of video captions in violation of CORS (bmo#1313711) CVE-2017-5405: FTP response codes can cause use of uninitialized values for ports (bmo#1336699) CVE-2017-5398: Memory safety bugs fixed in Firefox 52 and Firefox ESR 45.8 478505 e63d07e412783eeeeb72add29a65425b 52.1.0 dimstar_suse - update to Thunderbird 52.1.0 * Background images not working and other issues related to embedded images when composing email have been fixed * Google Oauth setup can sometimes not progress to the next step * requires NSS >= 3.28.4 - security fixes (boo#1035082), MFSA 2017-13 * CVE-2017-5443 (bmo#1342661) Out-of-bounds write during BinHex decoding * CVE-2017-5429 (bmo#1341096, bmo#1342823, bmo#1343261, bmo#1348894, bmo#1348941, bmo#1349340, bmo#1350844, bmo#1352926, bmo#1353088) Memory safety bugs fixed in Firefox 53, Firefox ESR 45.9, and Firefox ESR 52.1 * CVE-2017-5464 (bmo#1347075) Memory corruption with accessibility and DOM manipulation * CVE-2017-5465 (bmo#1347617) Out-of-bounds read in ConvolvePixel * CVE-2017-5466 (bmo#1353975) Origin confusion when reloading isolated data:text/html URL * CVE-2017-5467 (bmo#1347262) Memory corruption when drawing Skia content * CVE-2017-5460 (bmo#1343642) Use-after-free in frame selection * CVE-2017-5461 (bmo#1344380) Out-of-bounds write in Base64 encoding in NSS * CVE-2017-5449 (bmo#1340127) Crash during bidirectional unicode manipulation with animation * CVE-2017-5446 (bmo#1343505) Out-of-bounds read when HTTP/2 DATA frames are sent with incorrect data * CVE-2017-5447 (bmo#1343552) Out-of-bounds read during glyph processing 492468 467b0edac3b1bc0eb855856a4e57bbfa 52.1.1 dimstar_suse - update to Thunderbird 52.1.1 * fixed crash when compacting IMAP folder (boo#1038753) * Some attachments could not be opened or saved if the message body is empty * Unable to load full message via POP if message was downloaded partially (or only headers) before * Large attachments may not be shown or saved correctly if the message is stored in an IMAP folder which is not synchronized for offline use 495327 7361487d04928ff18313151070cb0195 52.1.1 dimstar_suse - explicitely optimize with -O2 for openSUSE > 13.2/Leap 42 to work with gcc7 (boo#1040105, boo#1042090) 500304 f6cff385377a83b6c111ac8eac69ffd0 52.1.1 dimstar_suse - remove legacy -Os optimization breaking gcc7/i586 (boo#1042090) 500919 097803b1342fb3c49f4b2b12c1a01bd6 52.2 dimstar_suse - update to Thunderbird 52.2 (boo#1043960) * Embedded images not shown in email received from Hotmail/Outlook webmailer * Detection of non-ASCII font names in font selector * Attachment not forwarded correctly under certain circumstances * Multiple requests for master password when GMail OAuth2 is enabled * Large number of blank pages being printed under certain circumstances when invalid preferences were present * Messages sent via the Simple MAPI interface are forced to HTML * Calendar: Invitations can't be printed * Mailing list (group) not accessible from macOS or Outlook address book * Clicking on links with references/anchors where target doesn't exist in the message not opening in external browser MFSA 2017-17 * CVE-2017-5472 (bmo#1365602) Use-after-free using destroyed node when regenerating trees * CVE-2017-7749 (bmo#1355039) Use-after-free during docshell reloading * CVE-2017-7750 (bmo#1356558) Use-after-free with track elements * CVE-2017-7751 (bmo#1363396) Use-after-free with content viewer listeners * CVE-2017-7752 (bmo#1359547) Use-after-free with IME input * CVE-2017-7754 (bmo#1357090) Out-of-bounds read in WebGL with ImageInfo object * CVE-2017-7756 (bmo#1366595) Use-after-free and use-after-scope logging XHR header errors * CVE-2017-7757 (bmo#1356824) Use-after-free in IndexedDB 503951 63e3bc8789d3b3ac559b9c4caba45164 52.2.1 dimstar_suse 1 507003 54b59a7681464857d2b1d58f4c7eb249 52.3.0 dimstar_suse - update to Thunderbird 52.3 (boo#1052829) Fixed issues: * Unwanted inline images shown in rogue SPAM messages * Deleting message from the POP3 server not working when maildir storage was used * Message disposition flag (replied / forwarded) lost when reply or forwarded message was stored as draft and draft was sent later * Inline images not scaled to fit when printing * Selected text from another message sometimes included in a reply * No authorisation prompt displayed when inserting image into email body although image URL requires authentication * Large attachments taking a long time to open under some circumstances security Security fixes from Gecko 52.3esr * CVE-2017-7798 (bmo#1371586, bmo#1372112) XUL injection in the style editor in devtools * CVE-2017-7800 (bmo#1374047) Use-after-free in WebSockets during disconnection * CVE-2017-7801 (bmo#1371259) Use-after-free with marquee during window resizing * CVE-2017-7784 (bmo#1376087) Use-after-free with image observers * CVE-2017-7802 (bmo#1378147) Use-after-free resizing image elements * CVE-2017-7785 (bmo#1356985) Buffer overflow manipulating ARIA attributes in DOM * CVE-2017-7786 (bmo#1365189) Buffer overflow while painting non-displayable SVG * CVE-2017-7753 (bmo#1353312) Out-of-bounds read with cached style data and pseudo-elements# 517268 9eeab295e28d44467f0f5c4891c0cf4c 52.4.0 dimstar_suse - Mozilla Thunderbird 52.4.0 (bsc#1060445) * new behavior was introduced for replies to mailing list posts: "When replying to a mailing list, reply will be sent to address in From header ignoring Reply-to header". A new preference mail.override_list_reply_to allows to restore the previous behavior. * Under certain circumstances (image attachment and non-image attachment), attached images were shown truncated in messages stored in IMAP folders not synchronised for offline use. * IMAP UIDs > 0x7FFFFFFF now handled properly Security fixes from Gecko 52.4esr * CVE-2017-7793 (bmo#1371889) Use-after-free with Fetch API * CVE-2017-7818 (bmo#1363723) Use-after-free during ARIA array manipulation * CVE-2017-7819 (bmo#1380292) Use-after-free while resizing images in design mode * CVE-2017-7824 (bmo#1398381) Buffer overflow when drawing and validating elements with ANGLE * CVE-2017-7805 (bmo#1377618) (fixed via NSS requirement) Use-after-free in TLS 1.2 generating handshake hashes * CVE-2017-7814 (bmo#1376036) Blob and data URLs bypass phishing and malware protection warnings * CVE-2017-7825 (bmo#1393624, bmo#1390980) (OSX-only) OS X fonts render some Tibetan and Arabic unicode characters as spaces * CVE-2017-7823 (bmo#1396320) CSP sandbox directive did not create a unique origin * CVE-2017-7810 Memory safety bugs fixed in Firefox 56 and Firefox ESR 52.4 - Add alsa-devel BuildRequires: we care for ALSA support to be 532694 39c52e59f0aa659056f62a54a29d132a 52.5.0 dimstar_suse - update to Thunderbird 52.5.0 (bsc#1068101) * Better support for Charter/Spectrum IMAP: Thunderbird will now detect Charter's IMAP service and send an additional IMAP select command to the server. Check the various preferences ending in "force_select" to see whether auto-detection has discovered this case. * In search folders spanning multiple base folders clicking on a message sometimes marked another message as read * IMAP alerts have been corrected and now show the correct server name in case of connection problems * POP alerts have been corrected and now indicate connection problems in case the configured POP server cannot be found MFSA 2017-26 * CVE-2017-7828 (bmo#1406750. bmo#1412252) Use-after-free of PressShell while restyling layout * CVE-2017-7830 (bmo#1408990) Cross-origin URL information leak through Resource Timing API * CVE-2017-7826 Memory safety bugs fixed in Firefox 57 and Firefox ESR 52.5 - Drop obsolete libgnomeui-devel BuildRequires: No longer needed. - Add explicit pkgconfig(gconf-2.0), pkgconfig(gobject-2.0), pkgconfig(gtk+-2.0), pkgconfig(gtk+-unix-print-2.0), pkgconfig(glib-2.0), pkgconfig(gobject-2.0) and pkgconfig(gdk-x11-2.0) BuildRequires: Previously pulled in by libgnomeui-devel, and is what configure really checks for. 545445 a811505d49628fc9e21f9e09633feca1 52.5.0 dimstar_suse 555851 df71506f2aada63aab8040e311305728 52.5.2 dimstar_suse 559658 6c467f8daaea77696ae28e013a9874a6 52.6 dimstar_suse - update to Thunderbird 52.6 (bsc#1077291) * Searching message bodies of messages in local folders, including filter and quick filter operations, not working reliably: Content not found in base64-encode message parts, non-ASCII text not found and false positives found. * Defective messages (without at least one expected header) not shown in IMAP folders but shown on mobile devices * Calendar: Unintended task deletion if numlock is enabled * Mozilla platform security fixes MFSA 2018-04 * CVE-2018-5095 (bmo#1418447) Integer overflow in Skia library during edge builder allocation * CVE-2018-5096 (bmo#1418922) Use-after-free while editing form elements * CVE-2018-5097 (bmo#1387427) Use-after-free when source document is manipulated during XSLT * CVE-2018-5098 (bmo#1399400) Use-after-free while manipulating form input elements * CVE-2018-5099 (bmo#1416878) Use-after-free with widget listener * CVE-2018-5102 (bmo#1419363) Use-after-free in HTML media elements * CVE-2018-5103 (bmo#1423159) Use-after-free during mouse event handling * CVE-2018-5104 (bmo#1425000) Use-after-free during font face manipulation * CVE-2018-5117 (bmo#1395508) URL spoofing with right-to-left text aligned left-to-right * CVE-2018-5089 Memory safety bugs fixed in Firefox 58 and Firefox ESR 52.6 569795 edb1e9a61b0d103c3b79cc412a835005 52.6 dimstar_suse readded lost bsc bugnumbers for Leap 15 increased constraints to give i586 the chance to build again 577192 ee62488a4a0ba2005752c2a125debcf8 52.7 dimstar_suse - update to Thunderbird 52.7 * Searching message bodies of messages in local folders, including filter and quick filter operations, did not find content in message attachments * Better error handling for Yahoo accounts - The following security fixes are included as part of the mozilla platform. In general, these flaws cannot be exploited through email in the Thunderbird product because scripting is disabled when reading mail, but are potentially risks in browser or browser-like contexts (MFSA 2018-09, bsc#1085130, bsc#1085671): * CVE-2018-5127 (bmo#1430557) Buffer overflow manipulating SVG animatedPathSegList * CVE-2018-5129 (bmo#1428947) Out-of-bounds write with malformed IPC messages * CVE-2018-5144 (bmo#1440926) Integer overflow during Unicode conversion * CVE-2018-5146 (bmo#1446062) Out of bounds memory write in libvorbis * CVE-2018-5125 (bmo1416529,bmo#1434580,bmo#1434384,bmo#1437450, bmo#1437507,bmo#1426988,bmo#1438425,bmo#1324042,bmo#1437087, bmo#1443865,bmo#1425520) Memory safety bugs fixed in Firefox 59, Firefox ESR 52.7, and Thunderbird 52.7 * CVE-2018-5145 (bmo#1261175,bmo#1348955) Memory safety bugs fixed in Firefox ESR 52.7 and Thunderbird 52.7 591025 7d484c45bd8ba30410738141418410e9 52.7 dimstar_suse 592321 59d74f54cc45e421b5c40f074168c420 52.8 dimstar_suse - update to Thunderbird 52.8 (bsc#1092548) MFSA 2018-13 * CVE-2018-5183 (bmo#1454692) Backport critical security fixes in Skia * CVE-2018-5184 (bmo#1411592, bsc#1093152) Full plaintext recovery in S/MIME via chosen-ciphertext attack * CVE-2018-5154 (bmo#1443092) Use-after-free with SVG animations and clip paths * CVE-2018-5155 (bmo#1448774) Use-after-free with SVG animations and text paths * CVE-2018-5159 (bmo#1441941) Integer overflow and out-of-bounds write in Skia * CVE-2018-5161 (bmo#1411720) Hang via malformed headers * CVE-2018-5162 (bmo#1457721, bsc#1093152) Encrypted mail leaks plaintext through src attribute * CVE-2018-5170 (bmo#1411732) Filename spoofing for external attachments * CVE-2018-5168 (bmo#1449548) Lightweight themes can be installed without user interaction * CVE-2018-5174 (bmo#1447080) (Windows only) Windows Defender SmartScreen UI runs with less secure behavior for downloaded files in Windows 10 April 2018 Update * CVE-2018-5178 (bmo#1443891) Buffer overflow during UTF-8 to Unicode string conversion through legacy extension * CVE-2018-5185 (bmo#1450345) Leaking plaintext through HTML forms * CVE-2018-5150 (bmo#1388020,bmo#1433609,bmo#1409440,bmo#1448705, bmo#1451376,bmo#1452202,bmo#1444668,bmo#1393367,bmo#1411415, 610619 7f0b4851f5397ead93061a9978c7d106 52.9.0 dimstar_suse 620717 9b78a44aba2f35eaf48efafdde8f2c42 52.9.1 dimstar_suse boo#1100780 622019 5a7653e9e869846ee2d31f5494e212aa 60.0 maxlin_factory 632921 1817eef3eb2c974dba58d02fbb93651b 60.0 dimstar_suse Automatic submission by obs-autosubmit 636364 118f04aea1312c04ed18cf1ec5698f6b 60.2.1 dimstar_suse 640048 07b11b2f3372c3afa8ab9af26448b335 60.2.1 dimstar_suse 641723 9b37701309f1137bdc8d3500495b49f6 60.3.0 dimstar_suse - update to Thunderbird 60.3.0 * various theme fixes * Shift+PageUp/PageDown in Write window * Gloda attachment filtering * Mailing list address auto-complete enter/return handling * Thunderbird hung if HTML signature references non-existent image * Filters not working for headers that appear more than once - Security fixes for the Mozilla platform picked up from 60.3 (Firefox ESR release). In general, these flaws cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but are potentially risks in browser or browser-like contexts (MFSA 2018-28) (bsc#1112852) * CVE-2018-12391 (bmo#1478843) (Android only) HTTP Live Stream audio data is accessible cross-origin * CVE-2018-12392 (bmo#1492823) Crash with nested event loops * CVE-2018-12393 (bmo#1495011) Integer overflow during Unicode conversion while loading JavaScript * CVE-2018-12389 (bmo#1498460, bmo#1499198) Memory safety bugs fixed in Firefox ESR 60.3 * CVE-2018-12390 (bmo#1487098, bmo#1487660, bmo#1490234, bmo#1496159, bmo#1443748, bmo#1496340, bmo#1483905, bmo#1493347, bmo#1488803, bmo#1498701, bmo#1498482, bmo#1442010, bmo#1495245, bmo#1483699, bmo#1469486, bmo#1484905, bmo#1490561, bmo#1492524, bmo#1481844) Memory safety bugs fixed in Firefox 63 and Firefox ESR 60.3 - Update _constraints for armv6/7 - Add patch to fix build on armv7: * mozilla-bmo1463035.patch 645920 b43f41547c28b2ac1d95881df4f4405b 60.3.1 dimstar_suse - Mozilla Thunderbird 60.3.1: * Double-clicking on a word in the Write window sometimes launched the Advanced Property Editor or Link Properties dialog * Fixe Cookie removal * "Download rest of message" was not working if global inbox was used * Fix Encoding problems for users (especially in Poland) when a file was sent via a folder using "Sent to > Mail recipient" due to a problem in the Thunderbird MAPI interface * According to RFC 4616 and RFC 5721, passwords containing non-ASCII characters are encoded using UTF-8 which can lead to problems with non-compliant providers, for example office365.com. The SMTP LOGIN and POP3 USER/PASS authentication methods are now using a Latin-1 encoding again to work around this issue * Fix shutdown crash/hang after entering an empty IMAP password 649480 873efffff7c3236a1809fc7d511e9b7f 60.3.2 dimstar_suse 653563 49df030578dc78cd43b3790684b9c8ee 60.3.3 dimstar_suse - Mozilla Thunderbird 60.3.3 * Thunderbird 60 will migrate security databases (key3.db, cert8.db to key4.db, cert9.db). Thunderbird 60.3.2 and earlier contained a fault that potentially deleted saved passwords and private certificate keys for users using a master password. Version 60.3.3 will prevent the loss of data; affected users who have already upgraded to version 60.3.2 or earlier can restore the deleted key3.db file from backup to complete the migration. * Address book search and auto-complete slowness introduced in Thunderbird 60.3.2 * Plain text markup with * for bold, / for italics, _ for underline and | for code did not work when the enclosed text contained non-ASCII characters * While composing a message, a link not removed when link location was removed in the link properties panel 655853 4e2b335bd3b10364ed5dda49bfda9eb3 60.4.0 dimstar_suse So far no security information posted on https://www.mozilla.org/en-US/security/known-vulnerabilities/thunderbird/ But as always there are semi-relevant changes from the Gecko 60.4 baseline. Many times not directly affecting TB - Mozilla Thunderbird 60.4.0: * New WebExtensions FileLink API to facilitate add-ons * Fix decoding problems for messages with less common charsets (cp932, cp936) * New messages in the drafts folder (and other special or virtual folders) will no longer be included in the new messages notification - requires NSS 3.36.6 664269 dc0d217472ecbc1cbc4c626c6321f159 60.5.0 coolo - MozillaThunderbird 60.5.0: * FileLink provider WeTransfer to upload large attachments * Thunderbird now allows the addition of OpenSearch search engines from a local XML file using a minimal user inferface: [+] button to select a file an add, [-] to remove. * More search engines: Google and DuckDuckGo available by default in some locales * During account creation, Thunderbird will now detect servers using the Microsoft Exchange protocol. It will offer the installation of a 3rd party add-on (Owl) which supports that protocol. * Thunderbird now compatible with other WebExtension-based FileLink add-ons like the Dropbox add-on MFSA 2019-03 (bsc#1122983) * CVE-2018-18500 bmo#1510114 Use-after-free parsing HTML5 stream * CVE-2018-18505 bmo#1497749 Privilege escalation through IPC channel messages * CVE-2016-5824 bmo#1275400 DoS (use-after-free) via a crafted ics file * CVE-2018-18501 bmo#1512450 bmo#1517542 bmo#1513201 bmo#1460619 bmo#1502871 bmo#1516738 bmo#1516514 Memory safety bugs fixed in Firefox 65 and Firefox ESR 60.5 - requires NSS 3.36.7 - removed obsolete patch mozilla-no-stdcxx-check.patch - rebased patches MFSA 2018-31 * CVE-2018-17466 bmo#1488295 669999 100b8fec8cf4a762891f37d916d2affd 60.5.1 coolo - Mozilla Thunderbird 60.5.1 * CalDav access to some servers not working MFSA 2019-06 (bsc#1125330) * CVE-2018-18356 bmo#1525817 Use-after-free in Skia * CVE-2019-5785 bmo#1525433 Integer overflow in Skia * CVE-2018-18335 bmo#1525815 Buffer overflow in Skia with accelerated Canvas 2D * CVE-2018-18509 bmo#1507218 S/MIME signature spoofing - Mozilla Thunderbird 60.5.0: 676696 2b90de27e74a9a3bd31e309462ad849b 60.5.2 dimstar_suse - Mozilla Thunderbird 60.5.2 * UTF-8 support for MAPISendMail * Problem with S/MIME certificate verification when receiving email from Outlook (issue introduced in version 60.5.1) 680129 13a38de5f658cd2030182ab178e44106 60.6.0 dimstar_suse - Mozilla Thunderbird 60.6.0 * Calendar: Can't create repeating event with end date when using certain time zones, for example Europe/Minsk * some minor bugfixes * using 60.6.0esr Mozilla platform (bsc#1129821) - Mozilla Thunderbird 60.5.3 * fixed a regression on the Windows platform: Problem when using "Send to > Mail recipient" on Windows 687466 ffcf6d08ec966a51728fd9c57cfb51bb 60.6.1 dimstar_suse - Mozilla Thunderbird 60.6.1 MFSA 2019-12 (bsc#1130262) * CVE-2019-9810 (bmo#1537924) IonMonkey MArraySlice has incorrect alias information * CVE-2019-9813 (bmo#1538006) Ionmonkey type confusion with __proto__ mutations 689134 e6bcea05f4d789156e235570d892316a 60.6.1 dimstar_suse old patch was missing a piece - Add patch to fix build using rust-1.33: (boo#1130694) * mozilla-bmo1519629.patch (bmo#1519629) 690073 0e0450ce67fb2d34cbd31e7142363d90 60.6.1 maxlin_factory 697648 d9d149b4afebe4cb46d9b219da815213 60.7.0 dimstar_suse - Mozilla Thunderbird 60.7.0 * Attachment pane of Write window no longer focussed when attaching files using a keyboard shortcut MFSA 2019-15 (boo#1135824) * CVE-2019-9815 (bmo#1546544) Disable hyperthreading on content JavaScript threads on macOS * CVE-2019-9816 (bmo#1536768) Type confusion with object groups and UnboxedObjects * CVE-2019-9817 (bmo#1540221) Stealing of cross-domain images using canvas * CVE-2019-9818 (bmo#1542581) (Windows only) Use-after-free in crash generation server * CVE-2019-9819 (bmo#1532553) Compartment mismatch with fetch API * CVE-2019-9820 (bmo#1536405) Use-after-free of ChromeEventHandler by DocShell * CVE-2019-11691 (bmo#1542465) Use-after-free in XMLHttpRequest * CVE-2019-11692 (bmo#1544670) Use-after-free removing listeners in the event listener manager * CVE-2019-11693 (bmo#1532525) Buffer overflow in WebGL bufferdata on Linux * CVE-2019-7317 (bmo#1542829) Use-after-free in png_image_free of libpng library * CVE-2019-9797 (bmo#1528909) Cross-origin theft of images with createImageBitmap * CVE-2018-18511 (bmo#1526218) Cross-origin theft of images with ImageBitmapRenderingContext * CVE-2019-11694 (bmo#1534196) (Windows only) Uninitialized memory memory leakage in Windows sandbox 705454 cac800f405101844ff87974dd9c75acc 60.7.1 dimstar_suse (also updated keyring) - Mozilla Thunderbird 60.7.1 * fixed: No prompt for smartcard PIN when S/MIME signing is used MFSA 2019-17 (boo#1137595) * CVE-2019-11703 (bmo#1553820) Heap buffer overflow in icalparser.c * CVE-2019-11704 (bmo#1553814) Heap buffer overflow in icalvalue.c * CVE-2019-11705 (bmo#1553808) Stack buffer overflow in icalrecur.c * CVE-2019-11706 (bmo#1555646) Type confusion in icalproperty.c - Increase disk space requirements in _constraints. 709837 5a11fadfdcd3091e1e3d9b1a81224a00 60.7.2 dimstar_suse - Mozilla Thunderbird 60.7.2 MFSA 2019-20 (boo#1138872) * CVE-2019-11707 (bmo#1544386) Type confusion in Array.pop * CVE-2019-11708 (bmo#1559858) sandbox escape using Prompt:Open 711281 9bde053a7506367f0aea11d9a2299e2c 60.8.0 dimstar_suse - Generate langpacks sequentially to avoid file corruption from racy file writes (boo#1137970) - Mozilla Thunderbird 60.8.0 * Calendar: Problems when editing event times, some related to AM/PM setting in non-English locales MFSA 2019-23 (boo#1140868) * CVE-2019-9811 (bmo#1538007, bmo#1539598, bmo#1563327) Sandbox escape via installation of malicious languagepack * CVE-2019-11711 (bmo#1552541) Script injection within domain through inner window reuse * CVE-2019-11712 (bmo#1543804) Cross-origin POST requests can be made with NPAPI plugins by following 308 redirects * CVE-2019-11713 (bmo#1528481) Use-after-free with HTTP/2 cached stream * CVE-2019-11729 (bmo#1515342) Empty or malformed p256-ECDH public keys may trigger a segmentation fault * CVE-2019-11715 (bmo#1555523) HTML parsing error can contribute to content XSS * CVE-2019-11717 (bmo#1548306) Caret character improperly escaped in origins * CVE-2019-11719 (bmo#1540541) Out-of-bounds read when importing curve25519 private key * CVE-2019-11730 (bmo#1558299) Same-origin policy treats all files in a directory as having the same-origin * CVE-2019-11709 (bmo#1547266, bmo#1540759, bmo#1548822, bmo#1550498 bmo#1515052, bmo#1539219, bmo#1547757, bmo#1550498, bmo#1533522) Memory safety bugs fixed in Firefox 68 and Firefox ESR 60.8 and 714774 4a57da4eb7ff376c6e450a681568f797 60.8.0 dimstar_suse 720733 1482643e205dfea07bb2ad5475052d13 68.1.0 maxlin_factory - Mozilla Thunderbird 68.1.0 * Offer to configure Exchange accounts for Office365. A third-party add-on is required for this account type. IMAP still exists as alternative. * several bugfixes MFSA 2019-30 * CVE-2019-11739 (bmo#1571481) Covert Content Attack on S/MIME encryption using a crafted multipart/alternative message * CVE-2019-11746 (bmo#1564449) Use-after-free while manipulating video * CVE-2019-11744 (bmo#1562033) XSS by breaking out of title and textarea elements using innerHTML * CVE-2019-11742 (bmo#1559715) Same-origin policy violation with SVG filters and canvas to steal cross-origin images * CVE-2019-11752 (bmo#1501152) Use-after-free while extracting a key value in IndexedDB * CVE-2019-11743 (bmo#1560495) Cross-origin access to unload event attributes * CVE-2019-11740 (bmo#1563133,bmo#1573160) Memory safety bugs fixed in Firefox 69, Firefox ESR 68.1, and Firefox ESR 60.9, Thunderbird 68.1, and Thunderbird 60.9 - removed upstreamed fix-build-after-y2038-changes-in-glibc.patch - added thunderbird-locale-build.patch to fix locale build - Add -L flag to the stat call for checking file size of %{SOURCE4}. - Add fix-missing-return-warning.patch to silence a compiler warning. - Mozilla Thunderbird 68.0 730872 f1e505f49f916ba3945c601c4f4691ed 68.1.1 dimstar_suse 733855 c686564ceb58d4122602b143c6ec70da 68.1.2 dimstar_suse - Mozilla Thunderbird 68.1.2 Bugfixes * Some attachments couldn't be opened in messages originating from MS Outlook 2016 * Address book import from CSV * Performance problem in message body search * Ctrl+Enter to send a message would open an attachment if the attachment pane had focus * Calendar: Issues with "Today Pane" start-up * Calendar: Glitches with custom repeat and reminder number input * Calendar: Problems with WCAP provider - add mozilla-bmo1585099.patch to fix build with rust >= 1.38 737931 8e104d012b599245a870a498ea2af16e 68.2.0 dimstar_suse - Mozilla Thunderbird 68.2.0 * Message Display WebExtension API * Message Search WebExtension API * Better visual feedback for unread messages when using the dark theme * Fixed various issues when editing mailing list * Fixed application windows not maintaining their size after restart MFSA 2019-33 (bsc#1154738) * CVE-2019-15903 (bmo#1584907) Heap overflow in expat library in XML_GetCurrentLineNumber * CVE-2019-11757 (bmo#1577107) Use-after-free when creating index updates in IndexedDB * CVE-2019-11758 (bmo#1536227) Potentially exploitable crash due to 360 Total Security * CVE-2019-11759 (bmo#1577953) Stack buffer overflow in HKDF output * CVE-2019-11760 (bmo#1577719) Stack buffer overflow in WebRTC networking * CVE-2019-11761 (bmo#1561502) Unintended access to a privileged JSONView object * CVE-2019-11762 (bmo#1582857) document.domain-based origin isolation has same-origin-property violation * CVE-2019-11763 (bmo#1584216) Incorrect HTML parsing results in XSS bypass technique * CVE-2019-11764 (bmo#1558522, bmo#1577061, bmo#1548044, bmo#1571223, bmo#1573048, bmo#1578933, bmo#1575217, bmo#1583684, bmo#1586845, bmo#1581950, bmo#1583463, bmo#1586599) Memory safety bugs fixed in Firefox 70 and Firefox ESR 68.2 - removed obsolete patches mozilla-bmo1573381.patch mozilla-bmo1512162.patch 742150 dead8f8b7d9033bea75d10aa9eb18899 68.2.1 dimstar_suse - Mozilla Thunderbird 68.2.1 * A language for the user interface can now be chosen in the advanced settings (multilingual UI) * Fixed problem with Google authentication (OAuth2) * Selected or unread messages were not shown in the correct color in the thread pane (message list) under some circumstances * When using a language pack, names of standard folders weren't localized (boo#1149126) * Address book default startup directory in preferences panel was not persisted * Chat: Extended context menu on Instant messaging status dialog (Show Accounts) - added mozilla-bmo1504834-part4.patch to fix some visual issues on big endian platforms 744761 1747d751e6d7bf8b32f089c98d497b03 68.2.2 dimstar_suse 747029 736fbd08be5f9af5acefe6dba5e40bbc 68.3.0 dimstar_suse - Mozilla Thunderbird 68.3.0: * Message display toolbar action WebExtension API * Navigation buttons are now available in content tabs, for example those opened via an add-on search * other bugfixes MFSA 2019-38 * CVE-2019-17008 (bmo#1546331) Use-after-free in worker destruction * CVE-2019-13722 (bmo#1580156) Stack corruption due to incorrect number of arguments in WebRTC code * CVE-2019-17010 (bmo#1581084) Use-after-free when performing device orientation checks * CVE-2019-17005 (bmo#1584170) Buffer overflow in plain text serializer * CVE-2019-17011 (bmo#1591334) Use-after-free when retrieving a document in antitracking * CVE-2019-17012 (bmo#1449736, bmo#1533957, bmo#1560667, bmo#1567209, bmo#1580288, bmo#1585760, bmo#1592502) Memory safety bugs fixed in Firefox 71 and Firefox ESR 68.3 * Various updates to improve performance and stability - updated create-tar.sh to cover buildid and origin repo information - changed locale building procedure * removed obsolete compare-locales.tar.xz and thunderbird-broken-locales-build.patch - add mozilla-bmo849632.patch to fix color issues on big endian 754691 448390a102c9d1bdd3b87c903226e3ad 68.3.1 dimstar_suse - add mozilla-bmo1583471.patch to allow building with rust 1.39 - Mozilla Thunderbird 68.3.1 * In dark theme unread messages no longer shown in blue to distinguish from tagged messages * Account setup is now using client side DNS MX lookup instead of relying on a server Bugfixes * Searching LDAP address book crashed in some circumstances * Message navigation with backward and forward buttons did not work in some circumstances * WebExtension toolbar icons were displayed too small * Calendar: Tasks due today were not listed in bold * Calendar: Last day of long-running events was not shown 759724 6b7b70ea89fa83df1fb0d30d172808dd 68.4.1 dimstar_suse - Mozilla Thunderbird 68.4.1 * Various improvements when setting up an account for a Microsoft Exchange server: Now offers IMAP/SMTP if available, better detection for Office 365 accounts; re-run configuration after password change Fixes: * After changing view layout, the message display pane showed garbled content under some circumstances * Various theme changes to achieve "pixel perfection": Unread icon, "no results" icon, paragraph format and font selector, background of folder summary tooltip * Tags were lost on messages in shared IMAP folders under some circumstances * Calendar: Event attendee dialog was not displayed correctly MFSA 2020-04 (bsc#1160498, bsc#1160305) * CVE-2019-17026 (bmo#1607443) IonMonkey type confusion with StoreElementHole and FallibleStoreElement * CVE-2019-17015 (bmo#1599005) Memory corruption in parent process during new content process initialization on Windows * CVE-2019-17016 (bmo#1599181) Bypass of @namespace CSS sanitization during pasting * CVE-2019-17017 (bmo#1603055) Type Confusion in XPCVariant.cpp * CVE-2019-17021 (bmo#1599008) Heap address disclosure in parent process during content process initialization on Windows * CVE-2019-17022 (bmo#1602843) CSS sanitization does not escape HTML tags * CVE-2019-17024 (bmo#1507180, bmo#1595470, bmo#1598605, bmo#1601826) 763056 605af520015ca8e1cb935e4b38532943 68.4.2 dimstar_suse - Mozilla Thunderbird 68.4.2 * Calendar: Task and Event tree colours adjusted for the dark theme * Retrieval of S/MIME certificates from LDAP failed * Address-parsing crash on some IMAP servers when mail.imap.use_envelope_cmd is set * Incorrect forwarding of HTML messages caused SMTP servers to respond with a timeout * Calendar: Various parts of the calendar UI stopped working when a second Thunderbird window opened 767881 03fd2e308fc6429ceafdf920e51e98a7 68.4.2 dimstar_suse 769383 1d64841cbdf624ada484437b5e6723be 68.5.0 okurz-factory - Mozilla Thunderbird 68.5.0 New * Support for Client Identity IMAP/SMTP Service Extension * Support for OAuth 2.0 authentication for POP3 accounts Fixes * Status area goes blank during account setup * Calendar: Could not remove color for default categories * Calendar: Prevent calendar component loading multiple times * Calendar: Today pane did not retain width between sessions MFSA 2020-07 (bsc#1163368) * CVE-2020-6793 (bmo#1608539) Out-of-bounds read when processing certain email messages * CVE-2020-6794 (bmo#1606619) Setting a master password post-Thunderbird 52 does not delete unencrypted previously stored passwords * CVE-2020-6795 (bmo#1611105) Crash processing S/MIME messages with multiple signatures * CVE-2020-6797 (bmo#1596668) (Mac OSX only) Extensions granted downloads.open permission could open arbitrary applications on Mac OSX * CVE-2020-6798 (bmo#1602944) Incorrect parsing of template tag could result in JavaScript injection * CVE-2020-6792 (bmo#1609607) Message ID calculcation was based on uninitialized data * CVE-2020-6800 (bmo#1595786,bmo#1596706,bmo#1598543,bmo#1604851, bmo#1608580,bmo#1608785,bmo#1605777) Memory safety bugs fixed in Thunderbird 68.5 773527 904ae93d0be9106f11e10abf90ae2ed7 68.6.0 dimstar_suse Automatic submission by obs-autosubmit 787142 25058cc05ecec1896ccbb1196cc87a0e 68.7.0 dimstar_suse 793242 c6add08517b15d49ac9b9e9b752aed8f 68.8.0 dimstar_suse - Mozilla Thunderbird 68.8.0 * Account Manager fixes and improvements * https://www.thunderbird.net/en-US/thunderbird/68.8.0/releasenotes MFSA 2020-18 (bsc#1171186) * CVE-2020-12397 (bmo#1617370) Sender Email Address Spoofing using encoded Unicode characters * CVE-2020-12387 (bmo#1545345) Use-after-free during worker shutdown * CVE-2020-6831 (bmo#1632241) Buffer overflow in SCTP chunk input validation * CVE-2020-12392 (bmo#1614468) Arbitrary local file access with 'Copy as cURL' * CVE-2020-12393 (bmo#1615471) Devtools' 'Copy as cURL' feature did not fully escape website-controlled data, potentially leading to command injection * CVE-2020-12395 (bmo#1595886, bmo#1611482, bmo#1614704, bmo#1624098, bmo#1625749, bmo#1626382, bmo#1628076, bmo#1631508) Memory safety bugs fixed in Thunderbird 68.8.0 - removed obsolete patch mozilla-bmo1580963.patch - Add mozilla-bmo1580963.patch to fix build with rust 1.43 (bmo#1580963) In general, these flaws cannot be exploited through email in 800587 021193f2224f39a2e0813434440377a5 68.8.1 maxlin_factory 808609 939f713da4545ee56da679db40912366 68.9.0 dimstar_suse 812112 64095bcbf99a3c57697ecbda742f26f2 68.9.0 dimstar_suse - build with nodejs10 to be able to drop nodejs8 from TW - updated create-tar.sh 813558 592c9ef9900c9ae29679ce4fb307a0db 68.10.0 dimstar_suse 818251 b5d10cebb962d84edc8362e9ec929e30 68.11.0 dimstar_suse 823878 61ba501f5f6339664319b912f441699b 68.11.0 dimstar_suse 828128 cd21a5f0881ffaae7e99c7b49235e0b7 68.12.0 dimstar_suse Automatic submission by obs-autosubmit 832601 e92059184da46b9d08afc8bbccc0a8f7 78.3.1 dimstar_suse - Mozilla Thunderbird 78.3.1 * fix crash in nsImapProtocol::CreateNewLineFromSocket (bmo#1667120) - Mozilla Thunderbird 78.3.0 MFSA 2020-44 (bsc#1176756) * CVE-2020-15677 (bmo#1641487) Download origin spoofing via redirect * CVE-2020-15676 (bmo#1646140) XSS when pasting attacker-controlled data into a contenteditable element * CVE-2020-15678 (bmo#1660211) When recursing through layers while scrolling, an iterator may have become invalid, resulting in a potential use-after- free scenario * CVE-2020-15673 (bmo#1648493, bmo#1660800) Memory safety bugs fixed in Thunderbird 78.3 - requires NSPR >= 4.25.1 - removed obsolete thunderbird-bmo1664607.patch - Mozilla Thunderbird 78.2.2 https://www.thunderbird.net/en-US/thunderbird/78.2.2/releasenotes - added thunderbird-bmo1664607.patch required for builds w/o updater (boo#1176384) - Mozilla Thunderbird 78.2.1 * based on Mozilla's 78 ESR codebase * many new and changed features https://www.thunderbird.net/en-US/thunderbird/78.0/releasenotes/#whatsnew * built-in OpenPGP support (enigmail neither required nor supported) - added platform patches: 838449 5bd9c7fa41bc48f4538a657082a7fe43 78.3.2 dimstar_suse - Mozilla Thunderbird 78.3.2 * OpenPGP: Improved support for encrypting with subkeys * OpenPGP: Encrypted messages with international characters were sometimes displayed incorrectly * Single-click deletion of recipient pills with middle mouse button restored * Searching an address book list did not display results * Dark mode, high contrast, and Windows theming fixes 840001 5b8b03040b853a037a7de09c9dc3e7a6 78.3.3 dimstar_suse - Mozilla Thunderbird 78.3.3 * OpenPGP: Improved support for encrypting with subkeys * OpenPGP message status icons were not visible in message header pane * OpenPGP Key Manager was missing from Tools menu on macOS * Creating a new calendar event did not require an event title - remove python2 dependencies for TW - support wayland mode/autodetection in startup wrapper - replace some Requires to use requires_ge macro where appropriate - improve langpack build (as already used for Firefox) - add ccache statistics output to build 842109 9288b92e12768722d016e5eccf5492c0 78.4.0 dimstar_suse - Mozilla Thunderbird 78.4.0 * MailExtensions: browser.tabs.sendMessage API added * MailExtensions: messageDisplayScripts API added * Yahoo and AOL mail users using password authentication will be migrated to OAuth2 * MailExtensions: messageDisplay APIs extended to support multiple selected messages * MailExtensions: compose.begin functions now support creating a message with attachments * multiple bugfixes MFSA 2020-47 (bsc#1177872) * CVE-2020-15969 (bmo#1666570) Use-after-free in usersctp * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954, bmo#1662760, bmo#1663439, bmo#1666140) Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4 843275 1ab7ca7ce84842fb40478cd8ff57247e 78.4.3 dimstar_suse Please give this a try with rust 1.47. The patch is taken from the Fedora repo to fix the build. I cannot test locally unfortunately. (Please note that TB 78.4.3 is currently not fully released upstream but in the pipeline as RC but it most likely means that the source check service fails.) - Mozilla Thunderbird 78.4.3 https://www.thunderbird.net/en-US/thunderbird/78.4.3/releasenotes/ - added mozilla-rust-1.47.patch to fix build with rust 1.47 - Mozilla Thunderbird 78.4.2 MFSA 2020-49 * CVE-2020-26950 (bmo#1675905) Write side effects in MCallGetProperty opcode not accounted for - Mozilla Thunderbird 78.4.1 * Bugfixes and minor features https://www.thunderbird.net/en-US/thunderbird/78.4.1/releasenotes/ 847757 ca6d45f77b369d08f81aaa4e24558b8e 78.5.0 dimstar_suse - Mozilla Thunderbird 78.5.0 MFSA 2020-52 (bsc#1178894) * CVE-2020-26951 (bmo#1667113) Parsing mismatches could confuse and bypass security sanitizer for chrome privileged code * CVE-2020-16012 (bmo#1642028) Variable time processing of cross-origin images during drawImage calls * CVE-2020-26953 (bmo#1656741) Fullscreen could be enabled without displaying the security UI * CVE-2020-26956 (bmo#1666300) XSS through paste (manual and clipboard API) * CVE-2020-26958 (bmo#1669355) Requests intercepted through ServiceWorkers lacked MIME type restrictions * CVE-2020-26959 (bmo#1669466) Use-after-free in WebRequestService * CVE-2020-26960 (bmo#1670358) Potential use-after-free in uses of nsTArray * CVE-2020-15999 (bmo#1672223) Heap buffer overflow in freetype * CVE-2020-26961 (bmo#1672528) DoH did not filter IPv4 mapped IP Addresses * CVE-2020-26965 (bmo#1661617) Software keyboards may have remembered typed passwords * CVE-2020-26966 (bmo#1663571) Single-word search queries were also broadcast to local network * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697, 849310 eb63c2155c4a33aebce8fc979606c7ba 78.5.1 dimstar_suse - Mozilla Thunderbird 78.5.1 MFSA 2020-53 (bsc#1179530) * CVE-2020-26970 (bmo#1677338) Stack overflow due to incorrect parsing of SMTP server response codes 852686 9ae7eac9699771f600dce2e3686cfb71 78.6.0 dimstar_suse - Mozilla Thunderbird 78.6.0 * changes and additions in MailExtensions * several bugfixes * https://www.thunderbird.net/en-US/thunderbird/78.6.0/releasenotes/ MFSA 2020-56 (bsc#1180039)) * CVE-2020-16042 (bmo#1679003) Operations on a BigInt could have caused uninitialized memory to be exposed * CVE-2020-26971 (bmo#1663466) Heap buffer overflow in WebGL * CVE-2020-26973 (bmo#1680084) CSS Sanitizer performed incorrect sanitization * CVE-2020-26974 (bmo#1681022) Incorrect cast of StyleGenericFlexBasis resulted in a heap use-after-free * CVE-2020-26978 (bmo#1677047) Internal network hosts could have been probed by a malicious webpage * CVE-2020-35111 (bmo#1657916) The proxy.onRequest API did not catch view-source URLs * CVE-2020-35112 (bmo#1661365) Opening an extension-less download may have inadvertently launched an executable instead * CVE-2020-35113 (bmo#1664831, bmo#1673589) Memory safety bugs fixed in Thunderbird 78.6 856497 c50e43c871c314101679c86d28bc3a76 78.6.1 dimstar_suse - Mozilla Thunderbird 78.6.1 MFSA 2021-02 (bsc#1180623) * CVE-2020-16044 (bmo#1683964) Use-after-free write when handling a malicious COOKIE-ECHO SCTP chunk 862980 ee97ffe140d4f246c6a30b92b41456ad 78.7.0 dimstar_suse - Mozilla Thunderbird 78.7.0 MFSA 2021-05 (bsc#1181414) * CVE-2021-23953 (bmo#1683940) Cross-origin information leakage via redirected PDF requests * CVE-2021-23954 (bmo#1684020) Type confusion when using logical assignment operators in JavaScript switch statements * CVE-2020-15685 (bmo#1622640) IMAP Response Injection when using STARTTLS * CVE-2020-26976 (bmo#1674343) HTTPS pages could have been intercepted by a registered service worker when they should not have been * CVE-2021-23960 (bmo#1675755) Use-after-poison for incorrectly redeclared JavaScript variables during GC * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526, bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844, bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410, bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736, bmo#1685260, bmo#1685925) Memory safety bugs fixed in Thunderbird 78.7 - MozillaThunderbird.spec: Don't abuse BUILDROOT during %build as newer rpm versions in TW remove everything there as the first action of %install 867009 0fb80c2143dbfb3222746021862345c5 78.7.1 dimstar_suse - Mozilla Thunderbird 78.7.1 * CardDAV address books now support OAuth2 and Google Contacts * Thunderbird will no longer allow installation of addons that use legacy APIs 869925 2101365761ac5df1301a3ddaab6d8067 78.8.0 RBrownSUSE - Mozilla Thunderbird 78.8.0 * various bugfixes MFSA 2021-09 (bsc#1182614) * CVE-2021-23969 (bmo#1542194) Content Security Policy violation report could have contained the destination of a redirect * CVE-2021-23968 (bmo#1687342) Content Security Policy violation report could have contained the destination of a redirect * CVE-2021-23973 (bmo#1690976) MediaError message property could have leaked information about cross-origin resources * CVE-2021-23978 (bmo#786797, bmo#1682928, bmo#1687391, bmo#1687597) Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8 874775 b24cfb4940778efbfbb86566680094a7 78.8.1 dimstar_suse - Mozilla Thunderbird 78.8.1 * several bugfixes and improvements * https://www.thunderbird.net/en-US/thunderbird/78.8.1/releasenotes/ - updated create-tar.sh (bsc#1182357) 878160 350e2e1347b816d48ce7256174447f19 78.9.0 RBrownSUSE - Mozilla Thunderbird 78.9.0 * bugfixes: https://www.thunderbird.net/en-US/thunderbird/78.9.0/releasenotes MFSA 2021-12 (boo#1183942) * CVE-2021-23981 (bmo#1692832) Texture upload into an unbound backing buffer resulted in an out-of-bound read * MOZ-2021-0002 (bmo#1691547) Angle graphics library out of date * CVE-2021-23982 (bmo#1677046) Internal network hosts could have been probed by a malicious webpage * CVE-2021-23984 (bmo#1693664) Malicious extensions could have spoofed popup information * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169, bmo#1690718) Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9 - cleaned up and fixed mozilla.sh.in for wayland (boo#1177542) 881213 d8d33a3af7ecec70a7c6e704e6f36eca 78.9.1 dimstar_suse - Mozilla Thunderbird 78.9.1 * Support recipient aliases for OpenPGP encryption * The key and signature parts of the message security popup on a received message could not be selected for copy/paste * Various UX and theme improvements MFSA 2021-13 * CVE-2021-23991 (bmo#1673240) An attacker may use Thunderbird's OpenPGP key refresh mechanism to poison an existing key * MOZ-2021-23992 (bmo#1666236) A crafted OpenPGP key with an invalid user ID could be used to confuse the user * CVE-2021-23993 (bmo#1666360) Inability to send encrypted OpenPGP email after importing a crafted OpenPGP key 884316 50fdc1c252c6df39a18ac72d062fbd70 78.10.0 dimstar_suse - Mozilla Thunderbird 78.10.0 MFSA 2021-14 (bsc#1184960) * CVE-2021-23994 (bmo#1699077) Out of bound write due to lazy initialization * CVE-2021-23995 (bmo#1699835) Use-after-free in Responsive Design Mode * CVE-2021-23998 (bmo#1667456) Secure Lock icon could have been spoofed * CVE-2021-23961 (bmo#1677940) More internal network hosts could have been probed by a malicious webpage * CVE-2021-23999 (bmo#1691153) Blob URLs may have been granted additional privileges * CVE-2021-24002 (bmo#1702374) Arbitrary FTP command execution on FTP servers using an encoded URL * CVE-2021-29945 (bmo#1700690) Incorrect size computation in WebAssembly JIT could lead to null-reads * CVE-2021-29946 (bmo#1698503) Port blocking could be bypassed * CVE-2021-29948 (bmo#1692899) Race condition when reading from disk while verifying signatures - recommend libotr5 886906 e7181ec2ebe372c1f3775c2d132568ad 78.10.1 dimstar_suse 891142 5f25da428ceaad3dc432221a4eff56af 78.10.2 dimstar_suse - Mozilla Thunderbird 78.10.2 * Added support for importing OpenPGP keys without a primary secret key * Add-ons manager displays a preferences icon for mail extensions that include an options page Fixed * OpenPGP messages with a high compression ratio (over 10x) could not be decrypted * Selected OpenPGP key was lost after opening the Key Properties dialog in Account Settings * Parsing some OpenPGP user IDs failed * Various improvements to OpenPGP partial encryption reminders * Mail toolbar buttons were too big when displaying both icons and text MFSA 2021-22 * CVE-2021-29956 (bmo#1710290) Thunderbird stored OpenPGP secret keys without master password protection * CVE-2021-29957 (bmo#1673241) Partial protection of inline OpenPGP message not indicated - do not rely on nodejs10 explicitely 894215 8f3061d0f0d918837ada61386d9e6ee0 78.11.0 dimstar_suse - Mozilla Thunderbird 78.11.0 * OpenPGP could not be disabled for an account if a key was previously configured * Recipients were unable to decrypt some messages when the sender had changed the message encryption from OpenPGP to S/MIME * Contacts moved between CardDAV address books were not synced to the new server * CardDAV compatibility fixes for Google Contacts MFSA 2021-26 (bsc#1186696) * CVE-2021-29964 (bmo#1706501) Out of bounds-read when parsing a `WM_COPYDATA` message * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760, bmo#1704722, bmo#1706041) Memory safety bugs fixed in Thunderbird 78.11 - renewed expired mozilla.keyring * CVE-2021-29956 (boo#1186199, bmo#1710290) * CVE-2021-29957 (boo#1186198, bmo#1673241) 897289 8575886d2601e7a94cf6a870d683b5e5 78.12.0 dimstar_suse - Mozilla Thunderbird 78.12.0 MFSA 2021-30 (bsc#1188275) * CVE-2021-29969 (bmo#1682370) IMAP server responses sent by a MITM prior to STARTTLS could be processed * CVE-2021-29970 (bmo#1709976) Use-after-free in accessibility features of a document * CVE-2021-30547 (bmo#1715766) Out of bounds write in ANGLE * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910, bmo#1711576, bmo#1714391) Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12 906332 155497b61b3c32946b20d68b7e34345b 78.13.0 RBrownSUSE - Mozilla Thunderbird 78.13.0 * removed WeTransfer integration package (not supported by vendor any longer) MFSA 2021-35 (bsc#1188891) * CVE-2021-29986 (bmo#1696138) Race condition when resolving DNS names could have led to memory corruption * CVE-2021-29988 (bmo#1717922) Memory corruption as a result of incorrect style treatment * CVE-2021-29984 (bmo#1720031) Incorrect instruction reordering during JIT optimization * CVE-2021-29980 (bmo#1722204) Uninitialized memory in a canvas object could have led to memory corruption * CVE-2021-29985 (bmo#1722083) Use-after-free media channels * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178, bmo#1719998, bmo#1720568) Memory safety bugs fixed in Thunderbird 78.13 911495 c84bd4669d0a86e6ed6ddde07cacc223 91.0.1 dimstar_suse - Mozilla Thunderbird 91.0.1 MFSA 2021-37 (bsc#1189547) * CVE-2021-29991 (bmo#1724896) Header Splitting possible with HTTP/3 Responses - appdate screenshot URL updated (by mailaender@opensuse.org) - Mozilla Thunderbird 91.0 * based on Mozilla's 91 ESR codebase * many new and changed features https://www.thunderbird.net/en-US/thunderbird/91.0/releasenotes/#whatsnew * Renamed "Add-ons" to "Add-ons and Themes" and "Options" to "Preferences" * Thunderbird now operates in multi-process (e10s) mode by default * New user interface for adding attachments * Enable redirect of messages * CardDAV address book support - Removed obsolete patches: * mozilla-bmo1463035.patch * mozilla-ppc-altivec_static_inline.patch * mozilla-pipewire-0-3.patch * mozilla-bmo1554971.patch - add mozilla-libavcodec58_91.patch - removed obsolete BigEndian ICU build workaround - updated build requirements - build using clang 913013 f64e03666e751d4dd4f466d03204a9b5 91.0.3 dimstar_suse 914797 992625b882f4725fcd0225e2546a6dfc 91.1.0 dimstar_suse - Mozilla Thunderbird 91.1.0 * Thunderbird registered Accessibility Handlers using same GUIDs as Firefox, causing performance issues for NVDA users * Focus lost when reordering accounts by keyboard in the Account Manager * Account setup did not use provider display name for setting up calendars * Various theme and UX fixes MFSA 2021-41 (bsc#1190269) * CVE-2021-38492 (bmo#1721107) Navigating to `mk:` URL scheme could load Internet Explorer * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101, bmo#1724107) Memory safety bugs fixed in Thunderbird 91.1 - (re-)added mozilla-silence-no-return-type.patch - add mozilla-bmo531915.patch to fix build for i586 917701 53d2ec2e1a04726189c164837fd8a84d 91.1.1 dimstar_suse Automatic submission by obs-autosubmit 921250 bceea3e18b99237bf6d14a3bb04662b3 91.1.2 dimstar_suse - Mozilla Thunderbird 91.1.2 * Thunderbird will now warn if an S/MIME encrypted message includes BCC recipients * several bugfixes listed on https://www.thunderbird.net/en-US/thunderbird/91.1.2/releasenotes/ 922125 1600de8b48587053f4bd99b2f15ad067 91.2.0 dimstar_suse - Mozilla Thunderbird 91.2.0 * Saving a single message as .eml now uses a unique filename * New mail notifications did not properly take subfolders into account * Decrypting binary attachments when using an external GnuPG configuration failed * Account name fields in the account manager were not big enough for long names * LDAP searches using an extensibleMatch filter returned no results * Read-only CalDAV calendars and CardDAV address books were not detected * Multipart messages containing a calendar invite did not display any of the human-readable alternatives * Some calendar days were displayed incorrectly or duplicated (eg. two "29th" days of a particular month) * Phantom event was shown at the end of each day in Calendar week view MFSA 2021-46 (bsc#1191332) * CVE-2021-38496 (bmo#1725335) Use-after-free in MessageTask * CVE-2021-38497 (bmo#1726621) Validation message could have been overlaid on another origin * CVE-2021-38498 (bmo#1729642) Use-after-free of nsLanguageAtomService object * CVE-2021-32810 (bmo#1729813, https://github.com/crossbeam- rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw) Data race in crossbeam-deque * CVE-2021-38500 (bmo#1725854, bmo#1728321) Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15, and Firefox ESR 91.2 * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176) Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2 924567 68087215d678c2e8dd604acf5f269e20 91.2.1 dimstar_suse 927299 a9ae13bf5bc57a6f0ef2ac3d98409c55 91.3.0 dimstar_suse - Mozilla Thunderbird 91.3.0 * several fixes as outlined here https://www.thunderbird.net/en-US/thunderbird/91.3.0/releasenotes/ MFSA 2021-50 (bsc#1192250) * CVE-2021-38503 (bmo#1729517) iframe sandbox rules did not apply to XSLT stylesheets * CVE-2021-38504 (bmo#1730156) Use-after-free in file picker dialog * CVE-2021-38505 (bmo#1730194) Windows 10 Cloud Clipboard may have recorded sensitive user data * CVE-2021-38506 (bmo#1730750) Thunderbird could be coaxed into going into fullscreen mode without notification or warning * CVE-2021-38507 (bmo#1730935) Opportunistic Encryption in HTTP2 could be used to bypass the Same-Origin-Policy on services hosted on other ports * MOZ-2021-0008 (bmo#1667102) Use-after-free in HTTP2 Session object * CVE-2021-38508 (bmo#1366818) Permission Prompt could be overlaid, resulting in user confusion and potential spoofing * CVE-2021-38509 (bmo#1718571) Javascript alert box could have been spoofed onto an arbitrary domain * CVE-2021-38510 (bmo#1731779) Download Protections were bypassed by .inetloc files on Mac OS * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048, bmo#1735152) Memory safety bugs fixed in Thunderbird ESR 91.3 - Drop unused pkgconfig(gdk-x11-2.0) BuildRequires 929062 f62096b10afe22641953f10b3dcf2ff6 91.3.2 dimstar_suse - Mozilla Thunderbird 91.3.2 * Date selection in Calendar print settings widget changed to use mini calendar widget * Bugfixes as outlined in release notes https://www.thunderbird.net/en-US/thunderbird/91.3.2/releasenotes/ - Mozilla Thunderbird 91.3.1 * OpenPGP public keys will no longer count as an attachment in the message list * Adding a search engine via URL now supported * FileLink messages' template updated; Thunderbird advertisement removed * After an update, Thunderbird will now check installed addons for updates * Bugfixes as outlined in release notes https://www.thunderbird.net/en-US/thunderbird/91.3.1/releasenotes/ 932690 77f49d84357ee959b64dabac7cff6399 91.4.0 dimstar_suse - Mozilla Thunderbird 91.4.0 * several fixes as outlined here https://www.thunderbird.net/en-US/thunderbird/91.4.0/releasenotes MFSA 2021-54 (bsc#1193485) * CVE-2021-43536 (bmo#1730120) URL leakage when navigating while executing asynchronous function * CVE-2021-43537 (bmo#1738237) Heap buffer overflow when using structured clone * CVE-2021-43538 (bmo#1739091) Missing fullscreen and pointer lock notification when requesting both * CVE-2021-43539 (bmo#1739683) GC rooting failure when calling wasm instance methods * CVE-2021-43541 (bmo#1696685) External protocol handler parameters were unescaped * CVE-2021-43542 (bmo#1723281) XMLHttpRequest error codes could have leaked the existence of an external protocol handler * CVE-2021-43543 (bmo#1738418) Bypass of CSP sandbox directive when embedding * CVE-2021-43545 (bmo#1720926) Denial of Service when using the Location API in a loop * CVE-2021-43546 (bmo#1737751) Cursor spoofing could overlay user interface when native cursor is zoomed * CVE-2021-43528 (bmo#1742579) JavaScript unexpectedly enabled for the composition area * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751, bmo#1737009, bmo#1739372, bmo#1739421) 936365 16b75a5a800d17963896328ee1bfd9b3 91.4.1 dimstar_suse - Mozilla Thunderbird 91.4.1 * several fixes as outlined here https://www.thunderbird.net/en-US/thunderbird/91.4.1/releasenotes/ MFSA 2021-55 (bsc#1193845) * CVE-2021-4126 (bmo#1732310) OpenPGP signature status doesn't consider additional message content * CVE-2021-44538 (bmo#1744056) Matrix chat library libolm bundled with Thunderbird vulnerable to a buffer overflow - updated _constraints 941707 b5b7067c1893e7b0385046c6d8ec6c92 91.4.1 dimstar_suse 943034 8fe1a174975d45f36083dd2ca6e8267a 91.5.0 dimstar_suse - Mozilla Thunderbird 91.5.0 https://www.thunderbird.net/en-US/thunderbird/91.5.0/releasenotes MFSA 2022-03 (bsc#1194547) * CVE-2022-22746 (bmo#1735071) Calling into reportValidity could have lead to fullscreen window spoof * CVE-2022-22743 (bmo#1739220) Browser window spoof using fullscreen mode * CVE-2022-22742 (bmo#1739923) Out-of-bounds memory access when inserting text in edit mode * CVE-2022-22741 (bmo#1740389) Browser window spoof using fullscreen mode * CVE-2022-22740 (bmo#1742334) Use-after-free of ChannelEventQueue::mOwner * CVE-2022-22738 (bmo#1742382) Heap-buffer-overflow in blendGaussianBlur * CVE-2022-22737 (bmo#1745874) Race condition when playing audio files * CVE-2021-4140 (bmo#1746720) Iframe sandbox bypass with XSLT * CVE-2022-22748 (bmo#1705211) Spoofed origin on external protocol launch dialog * CVE-2022-22745 (bmo#1735856) Leaking cross-origin URLs through securitypolicyviolation event * CVE-2022-22744 (bmo#1737252) The 'Copy as curl' feature in DevTools did not fully escape website-controlled data, potentially leading to command injection * CVE-2022-22747 (bmo#1735028) Crash when handling empty pkcs7 sequence * CVE-2022-22739 (bmo#1744158) 945701 2af08f2dad48ff71ffda3b41793496ff 91.5.1 dimstar_suse - Mozilla Thunderbird 91.5.1 * JS LDAP implementation did not support self-signed SSL certificates * After saving a draft and subsequently sending a FileLink email, the original file was removed from disk * Chat OTR encryption did not work * OTR verification bar was not removed after completing verification * Various theme improvements - Enable -fimplicit-constexpr for GCC 12+. 949349 6cb6b9be896be09e5a45ad479c37275c 91.6.0 dimstar_suse - Mozilla Thunderbird 91.6.0 * TB will now offer to send large forwarded attachments via FileLink * Partially signed unencrypted messages displayed an incorrect "parrtially encrypted" notification * Attachments filenames were not sanitized before saving to disk * In the attachment bar, the "Import OpenPGP Key" item displayed for public keys displayed an error and did not import the key * "Open with" attachment dialog did not have a selected radio button option MFSA 2022-06 (bsc#1195682) * CVE-2022-22753 (bmo#1732435) Privilege Escalation to SYSTEM on Windows via Maintenance Service * CVE-2022-22754 (bmo#1750565) Extensions could have bypassed permission confirmation during update * CVE-2022-22756 (bmo#1317873) Drag and dropping an image could have resulted in the dropped object being an executable * CVE-2022-22759 (bmo#1739957) Sandboxed iframes could have executed script if the parent appended elements * CVE-2022-22760 (bmo#1740985, bmo#1748503) Cross-Origin responses could be distinguished between script and non-script content-types * CVE-2022-22761 (bmo#1745566) frame-ancestors Content Security Policy directive was not enforced for framed extension pages * CVE-2022-22763 (bmo#1740534) Script Execution during invalid object state 953831 0acefa256d13b4c3007e4d5d338a5cd0 91.6.1 dimstar_suse just added the bsc bug security bug reference - Mozilla Thunderbird 91.6.1 * generated views of meeting invitations are now expanded by default * Emails were not downloading at startup under some conditions * Port numbers were not shown in "Confirm Security Exception" dialog for CalDAV connections MFSA 2022-07 (bsc#1196072) * CVE-2022-0566 (bmo#1753094) Crafted email could trigger an out-of-bounds write 955596 ceda58527b8bdf69f80f8f90f6f07556 91.7.0 dimstar_suse - Mozilla Thunderbird 91.7.0 * Thunderbird will use the first occurrence of headers that should only appear once * Auto-complete incorrectly changed a pasted email address to the primary address of a contact * Attachments with filename extensions that were not registered in MIME types could not be opened * Copy/Cut/Paste actions not working in Thunderbird Preferences * Improved screen reader support of displayed message headers MFSA 2022-12 (bsc#1196900) * CVE-2022-26383 (bmo#1742421) Browser window spoof using fullscreen mode * CVE-2022-26384 (bmo#1744352) iframe allow-scripts sandbox bypass * CVE-2022-26387 (bmo#1752979) Time-of-check time-of-use bug when verifying add-on signatures * CVE-2022-26381 (bmo#1736243) Use-after-free in text reflows * CVE-2022-26386 (bmo#1752396) Temporary files downloaded to /tmp and accessible by other local users - Mozilla Thunderbird 91.6.2 MFSA 2022-09 * CVE-2022-26485 (bmo#1758062) Use-after-free in XSLT parameter processing * CVE-2022-26486 (bmo#1758070) Use-after-free in WebGPU IPC Framework 960657 18a7484fb1d43d8b9474e979cc0f24cc 91.7.0 dimstar_suse - skip slow workers, this is a tough build job 964779 4af7dd9abb84e410c09ac9e34edcf521 91.7.0 dimstar_suse 969350 e3f7f01a9c60b29360153160e6175f78 91.8.1 dimstar_suse - Mozilla Thunderbird 91.8.1 * CLIENTID extension to SMTP was not supported by smtp-js# * Additional SMTP errors now propagated to user * OpenPGP was not able to use some previously supported key types * OpenPGP Key Manager did not always display correct information after importing additional IDs * Duplicate new mail notifications could be displayed when server-side filters were in use * Cancelling an SMTP password entry resulted in multiple failure dialogs being displayed - Mozilla Thunderbird 91.8.0 * Google accounts using password authentication will be migrated to OAuth2. * bugfixes https://www.thunderbird.net/en-US/thunderbird/91.8.0/releasenotes MFSA 2022- (bsc#1197903) - update create-tar.sh - skip slow workers, this is a tough build job 970866 f3fdfb5256c193b120d48f150d17b2f1 91.9.0 dimstar_suse - Mozilla Thunderbird 91.9.0 * A warning is now displayed if an OpenPGP key has unsafe attributes that are ignored * OpenPGP integration in Thunderbird 91.8.0 and 91.8.1 did not allow SHA-1 key signatures * CalDAV calendars were marked read-only on startup MFSA 2022-18 (bsc#1198970) * CVE-2022-1520 (bmo#1745019) Incorrect security status shown after viewing an attached email * CVE-2022-29914 (bmo#1746448) Fullscreen notification bypass using popups * CVE-2022-29909 (bmo#1755081) Bypassing permission prompt in nested browsing contexts * CVE-2022-29916 (bmo#1760674) Leaking browser history with CSS variables * CVE-2022-29911 (bmo#1761981) iframe sandbox bypass * CVE-2022-29912 (bmo#1692655) Reader mode bypassed SameSite cookies * CVE-2022-29913 (bmo#1764778) Speech Synthesis feature not properly disabled * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298, bmo#1762614, bmo#1762620) Memory safety bugs fixed in Thunderbird 91.9 975202 f1c4b2f4c5ea67bc6cd68118187eaa42 91.9.1 dimstar_suse - Mozilla Thunderbird 91.9.1 MFSA 2022-19 (bsc#1199768) * CVE-2022-1802 (bmo#1770137) Prototype pollution in Top-Level Await implementation * CVE-2022-1529 (bmo#1770048) Untrusted input used in JavaScript object indexing, leading to prototype pollution 978422 01640132e951ad5fa44e8302e513fbce 91.10.0 dimstar_suse - Mozilla Thunderbird 91.10.0 * Various UX and theme improvements MFSA 2022-22 (bsc#1200027) * CVE-2022-31736 (bmo#1735923) Cross-Origin resource's length leaked * CVE-2022-31737 (bmo#1743767) Heap buffer overflow in WebGL * CVE-2022-31738 (bmo#1756388) Browser window spoof using fullscreen mode * CVE-2022-31739 (bmo#1765049) Attacker-influenced path traversal when saving downloaded files * CVE-2022-31740 (bmo#1766806) Register allocation problem in WASM on arm64 * CVE-2022-31741 (bmo#1767590) Uninitialized variable leads to invalid memory read * CVE-2022-1834 (bmo#1767816) Braille space character caused incorrect sender email to be shown for a digitally signed email * CVE-2022-31742 (bmo#1730434) Querying a WebAuthn token with a large number of allowCredential entries may have leaked cross-origin information * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283, bmo#1767365, bmo#1768559, bmo#1768734) Memory safety bugs fixed in Thunderbird 91.10 980158 ac57cfe86d7db6b32491e0a249375b12 91.11.0 dimstar_suse - Mozilla Thunderbird 91.11.0 * CLIENTID fix for bmo#1759197 in Thunderbird 91.8.1 did not work additional fix applied * "Save-As" attachment dialog did not have filename pre-populated MFSA 2022-26 (bsc#1200793) * CVE-2022-34479 (bmo#1745595) A popup window could be resized in a way to overlay the address bar with web content * CVE-2022-34470 (bmo#1765951) Use-after-free in nsSHistory * CVE-2022-34468 (bmo#1768537) CSP sandbox header without `allow-scripts` can be bypassed via retargeted javascript: URI * CVE-2022-2226 (bmo#1775441) An email with a mismatching OpenPGP signature date was accepted as valid * CVE-2022-34481 (bmo#1497246) Potential integer overflow in ReplaceElementsAt * CVE-2022-31744 (bmo#1757604) CSP bypass enabling stylesheet injection * CVE-2022-34472 (bmo#1770123) Unavailable PAC file resulted in OCSP requests being blocked * CVE-2022-34478 (bmo#1773717) Microsoft protocols can be attacked if a user accepts a prompt * CVE-2022-2200 (bmo#1771381) Undesired attributes could be set as part of prototype pollution * CVE-2022-34484 (bmo#1763634, bmo#1772651) Memory safety bugs fixed in Thunderbird 91.11 and Thunderbird 102 985736 f615ab8ce6d3f3893a3b8681b222ed50 102.1.0 dimstar_suse - Mozilla Thunderbird 102.1.0 * https://www.thunderbird.net/en-US/thunderbird/102.1.0/releasenotes MFSA 2022-32 (bsc#1201758) * CVE-2022-36319 (bmo#1737722) Mouse Position spoofing with CSS transforms * CVE-2022-36318 (bmo#1771774) Directory indexes for bundled resources reflected URL parameters * CVE-2022-36314 (bmo#1773894) Opening local <code>.lnk</code> files could cause unexpected network loads * CVE-2022-2505 (bmo#1769739, bmo#1772824) Memory safety bugs fixed in Thunderbird 102.1 - added mozilla-newer-cbindgen.patch to fix build with rust-cbindgen >= 0.24 (and also require that for build) - added mozilla-pgo.patch to fix LTO builds with gcc - Mozilla Thunderbird 102.0.3 Bugfixes as in * https://www.thunderbird.net/en-US/thunderbird/102.0.3/releasenotes/ - Mozilla Thunderbird 102.0.2 * https://www.thunderbird.net/en-US/thunderbird/102.0/releasenotes/ - removed obsolete patches mozilla-bmo1504834-part2.patch mozilla-bmo1504834-part4.patch mozilla-bmo1602730.patch mozilla-bmo1626236.patch mozilla-bmo1724679.patch mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch mozilla-sandbox-fips.patch 992051 3c104511a1f7d9d6c921d953c4da4917 102.1.2 dimstar_suse - Mozilla Thunderbird 102.1.2 * fix for bmo#1777765 (no POP download progress bar) was backed out from this release to address broken POP message download with Fetch headers only selected in Account Settings (bmo#1783552) - Mozilla Thunderbird 102.1.1 Bugfixes: * https://www.thunderbird.net/en-US/thunderbird/102.1.1/releasenotes/ 993911 b4c6f525d4a7ce52eef7b83c794cf335 102.1.2 dimstar_suse - added mozilla-glibc236.patch (bmo#1782988, boo#1202323) 995033 c9f4be2444c3fb1cd765dedf91409f3a 102.2.0 dimstar_suse - Mozilla Thunderbird 102.2.0 * https://www.thunderbird.net/en-US/thunderbird/102.2.0/releasenotes/ MFSA 2022-36 (bsc#1202645) * CVE-2022-38472 (bmo#1769155) Address bar spoofing via XSLT error handling * CVE-2022-38473 (bmo#1771685) Cross-origin XSLT Documents would have inherited the parent's permissions * CVE-2022-38476 (bmo#1760998) Data race and potential use-after-free in PK11_ChangePW * CVE-2022-38477 (bmo#1760611, bmo#1770219, bmo#1771159, bmo#1773363) Memory safety bugs fixed in Thunderbird 102.2 * CVE-2022-38478 (bmo#1770630, bmo#1776658) Memory safety bugs fixed in Thunderbird 102.2, and Thunderbird 91.13 - disabled automatic usage of wayland because of known issues using MOZ_ENABLE_WAYLAND=1 in environment would still enable it (boo#1202606) 999347 e0b79bf7074709b756ef0ec80830d864 102.2.1 dimstar_suse - Mozilla Thunderbird 102.2.1 MFSA 2022-38 (bsc#1203007) * CVE-2022-3033 (bmo#1784838) Leaking of sensitive information when composing a response to an HTML email with a META refresh tag * CVE-2022-3032 (bmo#1783831) Remote content specified in an HTML document that was nested inside an iframe's srcdoc attribute was not blocked * CVE-2022-3034 (bmo#1745751) An iframe element in an HTML email could trigger a network request * CVE-2022-36059 (bmo#1787741) Matrix SDK bundled with Thunderbird vulnerable to denial-of- service attack 1000596 0abbc302dc62665cbd1db462e6c4550a 102.2.2 dimstar_suse - Mozilla Thunderbird 102.2.2 https://www.thunderbird.net/en-US/thunderbird/102.2.2/releasenotes/ * Setting added to change Calendar event double-click action to open Edit Event dialog rather than view only; Set calendar.events.defaultActionEdit to true * Running Compact Folders on maildir folders caused a redownload of all messages in the folder * Accessing mail folders in profiles with many folders was slow * SMTP servers were not always properly initialized, and were not listed in Account Settings * APOP authentication unsupported when connecting to POP3 server * OpenPGP key discovery failed * POP accounts hosted by AOL were not able to authenticate using OAuth2 * Unable to open context menu in newsgroups header for groups that are not subscribed 1001927 e9a5f9bbe946f4e350e32d4c1609e7c0 102.3.0 dimstar_suse - Mozilla Thunderbird 102.3.0 https://www.thunderbird.net/en-US/thunderbird/102.3.0/releasenotes/ * Thunderbird will no longer attempt to import account passwords when importing from another Thunderbird profile in order to prevent profile corruption and permanent data loss. (bmo#1790605) * Devtools performance profile will use Thunderbird presets instead of Web Developer presets (bmo#1785954) * Thunderbird startup performance improvements (bmo#1785967) * Saving email source and images failed (bmo#1777323, bmo#1778804) * Error message was shown repeatedly when temporary disk space was full (bmo#1788580) * Attaching OpenPGP keys without a set size to non-encrypted messages briefly displayed a size of zero bytes (bmo#1788952) * Global Search entry box initially contained "undefined" (bmo#1780963) * Delete from POP Server mail filter rule intermittently failed to trigger (bmo#1789418) * Connections to POP3 servers without UIDL support failed (bmo#1789314) * Pop accounts with "Fetch headers only" set downloaded complete messages if server did not advertise TOP capability (bmo#1789356) * "File -> New -> Address Book Contact" from Compose window did not work (bmo#1782418) * Attach "My vCard" option in compose window was not available (bmo#1787614) * Improved performance of matching a contact to an email address (bmo#1782725) * Address book only recognized a contact's first two email addresses (bmo#1777156) * Address book search and autocomplete failed if a contact vCard could not be parsed (bmo#1789793) * Downloading NNTP messages for offline use failed (bmo#1785773) 1005289 5e92ce6d6f78ce0ec3861f02dfad406f 102.3.1 dimstar_suse - Mozilla Thunderbird 102.3.1 * Compose window encryption options now only appear for encryption technologies that have already been configured * Number of contacts in currently selected address book now displayed at bottom of Address Book list column Fixes * Password prompt did not include server hostname for POP servers * Edit Contact was missing from Contacts sidebar context menus * Address Book contact lists cut off display of some characters, the result being unreadable MFSA 2022-43 * CVE-2022-39249 (bmo#1791765) Matrix SDK bundled with Thunderbird vulnerable to an impersonation attack by malicious server administrators * CVE-2022-39250 (bmo#1791765) Matrix SDK bundled with Thunderbird vulnerable to a device verification attack * CVE-2022-39251 (bmo#1791765) Matrix SDK bundled with Thunderbird vulnerable to an impersonation attack * CVE-2022-39236 (bmo#1791765) Matrix SDK bundled with Thunderbird vulnerable to a data corruption issue 1007573 6e9fb5ee831122e85d8a2d120d85d77d 102.3.1 RBrownFactory - build using rust 1.63 1007697 2f73bb05b8e93d2f5e5faf47a7eb56f5 102.3.2 favogt_factory - Mozilla Thunderbird 102.3.2 * Thunderbird will try to use POP CRAM-MD5 authentication even if not advertised by server * more bugfixes as in https://www.thunderbird.net/en-US/thunderbird/102.3.2/releasenotes 1009070 ebae8bfcd5973175a8487ee84bf6ca77 102.3.3 dimstar_suse - Mozilla Thunderbird 102.3.3 * Option added to show containing address book for a contact when using All Address Books in vertical mode * Thunderbird will try to use POP NTLM authentication even if not advertised by server * Task List and Today Pane sidebars will no longer load when not visible * bugfixes as documented here https://www.thunderbird.net/en-US/thunderbird/102.3.3/releasenotes 1010277 009471935a45a4142d863909872d22f3 102.4.0 dimstar_suse - Mozilla Thunderbird 102.4.0 https://www.thunderbird.net/en-US/thunderbird/102.4.0/releasenotes 1030125 de54d622a4ba7bafdab9938278d0b50d 102.4.0 dimstar_suse MFSA 2022-46 (bsc#1203477) * CVE-2022-42927 (bmo#1789128) Same-origin policy violation could have leaked cross-origin URLs * CVE-2022-42928 (bmo#1791520) Memory Corruption in JS Engine * CVE-2022-42929 (bmo#1789439) Denial of Service via window.print * CVE-2022-42932 (bmo#1789729, bmo#1791363, bmo#1792041) Memory safety bugs fixed in Firefox 106, Firefox ESR 102.4 and Thunderbird 102.4.0 1030583 3af897b52c71da7643e14dae57f36412 102.4.1 dimstar_suse - Mozilla Thunderbird 102.4.1 * Thunderbird will now catch and report errors parsing vCards that contain incorrectly formatted dates * Dynamic language switching did not update interface when switched to right-to-left languages * Custom header data was discarded after messages were saved as draft and reopened * -remote command line argument did not work, affecting integration with various applications such as LibreOffice * Messages received via some SMS-to-email services could not display images * VCards with nickname field set could not be edited * Some recurring events were missing from Agenda on first load * Download requests for remote ICS calendars incorrectly set "Accept" header to text/xml * Monthly events created on the 31st of a month with <30 days placed first occurrence 1-2 days after the beginning of the following month * Various visual and UX improvements 1031395 ac67cc386082835a6029c1357612ac86 102.4.2 dimstar_suse - Mozilla Thunderbird 102.4.2 * "Address Book" button in Account Central will now create a CardDAV address book instead of a local address book * Bugfixes as described here https://www.thunderbird.net/en-US/thunderbird/102.4.2/releasenotes 1033698 73582148d549960c84b02dae7020f5e2 102.5.0 dimstar_suse - Mozilla Thunderbird 102.5.0 * changes and fixes as described here https://www.thunderbird.net/en-US/thunderbird/102.5.0/releasenotes MFSA 2022-49 (bsc#1205270) * CVE-2022-45403 (bmo#1762078) Service Workers might have learned size of cross-origin media files * CVE-2022-45404 (bmo#1790815) Fullscreen notification bypass * CVE-2022-45405 (bmo#1791314) Use-after-free in InputStream implementation * CVE-2022-45406 (bmo#1791975) Use-after-free of a JavaScript Realm * CVE-2022-45408 (bmo#1793829) Fullscreen notification bypass via windowName * CVE-2022-45409 (bmo#1796901) Use-after-free in Garbage Collection * CVE-2022-45410 (bmo#1658869) ServiceWorker-intercepted requests bypassed SameSite cookie policy * CVE-2022-45411 (bmo#1790311) Cross-Site Tracing was possible via non-standard override headers * CVE-2022-45412 (bmo#1791029) Symlinks may resolve to partially uninitialized buffers * CVE-2022-45416 (bmo#1793676) Keystroke Side-Channel Leakage * CVE-2022-45418 (bmo#1795815) Custom mouse cursor could have been drawn over browser UI * CVE-2022-45420 (bmo#1792643) Iframe contents could be rendered outside the iframe * CVE-2022-45421 (bmo#1767920, bmo#1789808, bmo#1794061) Memory safety bugs fixed in Thunderbird 102.5 1036233 373bbd35e892c18a92c20adb3e657715 102.5.1 dimstar_suse - Mozilla Thunderbird 102.5.1 MFSA 2022-50 * CVE-2022-45414 (bmo#1788096) Quoting from an HTML email with certain tags will trigger network requests and load remote content, regardless of a configuration to block remote content 1039407 7d82666780166210d027a925953985e0 102.6.0 dimstar_suse - Mozilla Thunderbird 102.6.0 https://www.thunderbird.net/en-US/thunderbird/102.6.0/releasenotes/ MFSA 2022-53 (bsc#1206242) * CVE-2022-46880 (bmo#1749292) Use-after-free in WebGL * CVE-2022-46872 (bmo#1799156) Arbitrary file read from a compromised content process * CVE-2022-46881 (bmo#1770930) Memory corruption in WebGL * CVE-2022-46874 (bmo#1746139) Drag and Dropped Filenames could have been truncated to malicious extensions * CVE-2022-46875 (bmo#1786188) Download Protections were bypassed by .atloc and .ftploc files on Mac OS * CVE-2022-46882 (bmo#1789371) Use-after-free in WebGL * CVE-2022-46878 (bmo#1782219, bmo#1797370, bmo#1797685, bmo#1801102, bmo#1801315, bmo#1802395) Memory safety bugs fixed in Thunderbird 102.6 - removed obsolete patches mozilla-newer-cbindgen.patch mozilla-glibc236.patch 1042791 ce7cd863baaa13028255534881630614 102.6.1 dimstar_suse - Mozilla Thunderbird 102.6.1 * Remote content did not load in user-defined signatures * Addons that added new action buttons were not shown for addon upgrades, requiring removal and reinstall * Various stability improvements MFSA 2022-54 * CVE-2022-46874 (bmo#1746139) Drag and Dropped Filenames could have been truncated to malicious extensions 1044166 d84f60856d3a0939066a6300550ebbf3 102.7.1 dimstar_suse - Mozilla Thunderbird 102.7.1 * Microsoft Office 365 accounts were unable to authenticate * https://www.thunderbird.net/en-US/thunderbird/102.7.1/releasenotes/ MFSA 2023-04 * CVE-2023-0430 (bmo#1769000) Revocation status of S/Mime signature certificates was not checked - update create-tar.sh - Mozilla Thunderbird 102.7.0 https://www.thunderbird.net/en-US/thunderbird/102.7.0/releasenotes/ MFSA 2023-03 (bsc#1207119) * CVE-2022-46871 (bmo#1795697) libusrsctp library out of date * CVE-2023-23598 (bmo#1800425) Arbitrary file read from GTK drag and drop on Linux * CVE-2023-23599 (bmo#1777800) Malicious command could be hidden in devtools output on Windows * CVE-2023-23601 (bmo#1794268) URL being dragged from cross-origin iframe into same tab triggers navigation * CVE-2023-23602 (bmo#1800890) Content Security Policy wasn't being correctly applied to WebSockets in WebWorkers * CVE-2022-46877 (bmo#1795139) Fullscreen notification bypass * CVE-2023-23603 (bmo#1800832) Calls to <code>console.log</code> allowed bypasing Content Security Policy via format directive * CVE-2023-23605 (bmo#1764921, bmo#1802690, bmo#1806974) 1062396