-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ===================================================================== Red Hat Security Advisory Synopsis: Important: thunderbird security update Advisory ID: RHSA-2021:4134-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2021:4134 Issue date: 2021-11-04 CVE Names: CVE-2021-38503 CVE-2021-38504 CVE-2021-38506 CVE-2021-38507 CVE-2021-38508 CVE-2021-38509 ===================================================================== 1. Summary: An update for thunderbird is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux Client (v. 7) - x86_64 Red Hat Enterprise Linux Server Optional (v. 7) - ppc64le, x86_64 Red Hat Enterprise Linux Workstation (v. 7) - x86_64 3. Description: Mozilla Thunderbird is a standalone mail and newsgroup client. This update upgrades Thunderbird to version 91.3.0. Security Fix(es): * Mozilla: Use-after-free in HTTP2 Session object * Mozilla: Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3 * Mozilla: iframe sandbox rules did not apply to XSLT stylesheets (CVE-2021-38503) * Mozilla: Use-after-free in file picker dialog (CVE-2021-38504) * Mozilla: Firefox could be coaxed into going into fullscreen mode without notification or warning (CVE-2021-38506) * Mozilla: Opportunistic Encryption in HTTP2 could be used to bypass the Same-Origin-Policy on services hosted on other ports (CVE-2021-38507) * Mozilla: Permission Prompt could be overlaid, resulting in user confusion and potential spoofing (CVE-2021-38508) * Mozilla: Javascript alert box could have been spoofed onto an arbitrary domain (CVE-2021-38509) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 All running instances of Thunderbird must be restarted for the update to take effect. 5. Bugs fixed (https://bugzilla.redhat.com/): 2019621 - CVE-2021-38503 Mozilla: iframe sandbox rules did not apply to XSLT stylesheets 2019622 - CVE-2021-38504 Mozilla: Use-after-free in file picker dialog 2019624 - CVE-2021-38506 Mozilla: Firefox could be coaxed into going into fullscreen mode without notification or warning 2019625 - CVE-2021-38507 Mozilla: Opportunistic Encryption in HTTP2 could be used to bypass the Same-Origin-Policy on services hosted on other ports 2019626 - Mozilla: Use-after-free in HTTP2 Session object 2019627 - CVE-2021-38508 Mozilla: Permission Prompt could be overlaid, resulting in user confusion and potential spoofing 2019628 - CVE-2021-38509 Mozilla: Javascript alert box could have been spoofed onto an arbitrary domain 2019630 - Mozilla: Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3 6. Package List: Red Hat Enterprise Linux Client (v. 7): Source: thunderbird-91.3.0-2.el7_9.src.rpm x86_64: thunderbird-91.3.0-2.el7_9.x86_64.rpm thunderbird-debuginfo-91.3.0-2.el7_9.x86_64.rpm Red Hat Enterprise Linux Server Optional (v. 7): Source: thunderbird-91.3.0-2.el7_9.src.rpm ppc64le: thunderbird-91.3.0-2.el7_9.ppc64le.rpm thunderbird-debuginfo-91.3.0-2.el7_9.ppc64le.rpm x86_64: thunderbird-91.3.0-2.el7_9.x86_64.rpm thunderbird-debuginfo-91.3.0-2.el7_9.x86_64.rpm Red Hat Enterprise Linux Workstation (v. 7): Source: thunderbird-91.3.0-2.el7_9.src.rpm x86_64: thunderbird-91.3.0-2.el7_9.x86_64.rpm thunderbird-debuginfo-91.3.0-2.el7_9.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2021-38503 https://access.redhat.com/security/cve/CVE-2021-38504 https://access.redhat.com/security/cve/CVE-2021-38506 https://access.redhat.com/security/cve/CVE-2021-38507 https://access.redhat.com/security/cve/CVE-2021-38508 https://access.redhat.com/security/cve/CVE-2021-38509 https://access.redhat.com/security/updates/classification/#important 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2021 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBYYQYI9zjgjWX9erEAQgcLRAAqRQDeuMoSDZY56h4RATHsuai3IaNljDX RW+53gxz1yuvkWibiKe3UZW34DHkDuy6de+tXrvGW707/2KoEANmdloVAzFSW6xJ NYtu3IWUPbBDDwFDy3Y+At2ZcjrbBBsWMfmI+4CMqvTLEViIl9inEJ/nGk9nvJ37 t9EqIs2fCMCQGfDbGFyPliWVaE/b9Ce25jfbjj5vPGS91Go58Q65csuN9Wz08QwH dgZLaj1AlZNNaDvIEkvoS8/gA2og2ms8X+TMVpwNtJ5x77yhjhKwlQA1h+IyFBEA 2mS0CEi6tyu0ItTrZVC5b/UXbNwmbL/PKtI+yMkNSEk1vCRGCn44J+viXlfcb9vj v3eOtxGft2IfqyEGZV230/gPVwLTLzYV9YSeOYxjF9tz2WPqvHW5AFXRZcJCXhSB M6IGGA+CIOXaInm3si8Z0ayhX/4g4l0zdHE99jpRyiyRnKTq0TlVTmwgQOLp4hai cDnpgks3Yd2hMGlJm3Zji36T/nYCYt+06JDnfIt1pUhn35fMS3I9X50/J6qa8c0c S4Gh4geSIDA7gggci7gkS7RCaOYqNfE9GIW6/jIqA99M2kUiOvGojZUEySjhjJV4 4q2tw99qWYp/uj9s0f6Q3IADinj+JdhjR2RQrvlff0GpNRDxMxGb6j7laEtL+VsC 7cFBV9jCctI= =6uI1 -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://listman.redhat.com/mailman/listinfo/rhsa-announce