Read the docs
Red Hat Security Advisory

RHSA-2023:7570

thunderbird security update

Released 2023-11-29 · Red Hat rating Important · View on Red Hat →

Fixed in

Fixes 7 records

TI-2023-05706 CVE-2023-6212 · GHSA-4cv2-qh42-x2j4

Out-of-bounds write in Mozilla Firefox

Priority MEDIUM 42

Memory safety bugs present in Firefox 119, Firefox ESR 115.4, and Thunderbird 115.4.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00947 Published 2023-11-21 Partial fix · 120, 115.5.0 +1 CWE-787
TI-2023-05701 CVE-2023-6207 · GHSA-qvr4-hgxw-v9xj

Use after free in Mozilla Firefox

Priority MEDIUM 40

Ownership mismanagement led to a use-after-free in ReadableByteStreams This vulnerability affects Firefox < 120, Firefox ESR < 115.5.0, and Thunderbird < 115.5.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00906 Published 2023-11-21 Partial fix · 120, 115.5.0 +1 CWE-416
TI-2023-05703 CVE-2023-6209 · GHSA-c2fx-6qc9-26x9

Path traversal in Mozilla Firefox

Priority LOW 32

Relative URLs starting with three slashes were incorrectly parsed, and a path-traversal "/../" part in the path could be used to override the specified host.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.01418 Published 2023-11-21 Partial fix · 120, 115.5.0 +1 CWE-22
TI-2023-05699 CVE-2023-6205 · GHSA-h4m4-6cfw-5q6g

Use after free in Mozilla Firefox

Priority LOW 30

It was possible to cause the use of a MessagePort after it had already been freed, which could potentially have led to an exploitable crash.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00874 Published 2023-11-21 Partial fix · 120, 115.5.0 +1 CWE-416
TI-2023-05698 CVE-2023-6204 · GHSA-c9gw-j4mh-mj26

Out-of-bounds read in Mozilla Firefox

Priority LOW 30

On some systems—depending on the graphics settings and drivers—it was possible to force an out-of-bounds read and leak memory data into the images created on the canvas element.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00841 Published 2023-11-21 Partial fix · 120, 115.5.0 +1 CWE-125
TI-2023-05700 CVE-2023-6206 · GHSA-68m9-mw54-x3jx

Clickjacking in Mozilla Firefox

Priority LOW 25

The black fade animation when exiting fullscreen is roughly the length of the anti-clickjacking delay on permission prompts.

CVSS 3.1MEDIUM 5.4 Network No auth User interaction EPSS 0.00642 Published 2023-11-21 Partial fix · 120, 115.5.0 +1 CWE-1021