Read the docs
Red Hat Security Advisory

RHSA-2023:4499

thunderbird security update

Released 2023-08-07 · Red Hat rating Important · View on Red Hat →

Fixed in

Fixes 10 records

TI-2023-03757 CVE-2023-4050 · GHSA-rj59-6cjh-fxcf

Out-of-bounds write in Mozilla Firefox

Priority MEDIUM 53

In some cases, an untrusted input stream was copied to a stack buffer without checking its size.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.12584 Published 2023-08-01 Partial fix · 116, 102.14 +1 CWE-787
TI-2023-03764 CVE-2023-4057 · GHSA-cj4r-xrp8-3mj8

Out-of-bounds write in Mozilla Firefox

Priority MEDIUM 51

Memory safety bugs present in Firefox 115, Firefox ESR 115.0, and Thunderbird 115.0.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00888 Published 2023-08-01 Partial fix · 116, 115.1 CWE-787
TI-2023-03763 CVE-2023-4056 · GHSA-jxmw-fv2p-4289

Out-of-bounds write in Mozilla Firefox

Priority MEDIUM 51

Memory safety bugs present in Firefox 115, Firefox ESR 115.0, Firefox ESR 102.13, Thunderbird 115.0, and Thunderbird 102.13.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00948 Published 2023-08-01 Partial fix · 116, 102.14 +1 CWE-787
TI-2023-03755 CVE-2023-4048 · GHSA-969j-v3p3-p4vv

Out-of-bounds read in Mozilla Firefox

Priority MEDIUM 41

An out-of-bounds read could have led to an exploitable crash when parsing HTML with DOMParser in low memory situations.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00931 Published 2023-08-01 Partial fix · 116, 102.14 +1 CWE-125
TI-2023-03754 CVE-2023-4047 · GHSA-rmgx-g94r-75jg

Cross-site request forgery in Mozilla Firefox

Priority MEDIUM 41

A bug in popup notifications delay calculation could have made it possible for an attacker to trick a user into granting permissions.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00632 Published 2023-08-01 Partial fix · 116, 102.14 +1 CWE-352
TI-2023-03762 CVE-2023-4055 · GHSA-38vw-jr6f-3c23

Buffer overflow in Mozilla Firefox

Priority MEDIUM 40

When the number of cookies per domain was exceeded in `document.cookie`, the actual cookie jar sent to the host was no longer consistent with expected cookie jar state.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00733 Published 2023-08-01 Partial fix · 116, 102.14 +1 CWE-120
TI-2023-03753 CVE-2023-4046 · GHSA-9fw5-r669-cvr3

Resource allocation without limits in Mozilla Firefox

Priority LOW 32

In some circumstances, a stale value could have been used for a global variable in WASM JIT analysis.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.01125 Published 2023-08-01 Partial fix · 116, 102.14 +1 CWE-770
TI-2023-03752 CVE-2023-4045 · GHSA-85vg-hqhq-qvx3

Origin validation error in Mozilla Firefox

Priority LOW 31

Offscreen Canvas did not properly track cross-origin tainting, which could have been used to access image data from another site in violation of same-origin policy.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00589 Published 2023-08-01 Partial fix · 116, 102.14 +1 CWE-346
TI-2023-03756 CVE-2023-4049 · GHSA-6jfh-jrm6-9hm8

Race condition in Mozilla Firefox

Priority LOW 27

Race conditions in reference counting code were found through code inspection.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.00634 Published 2023-08-01 Partial fix · 116, 102.14 +1 CWE-362