Gentoo Archives: gentoo-announce

From: Sam James <sam@g.o>
To: gentoo-announce@l.g.o
Subject: [gentoo-announce] [ GLSA 202007-09 ] Mozilla Thunderbird: Multiple vulnerabilities
Date: Sun, 26 Jul 2020 23:43:00
Message-Id: E970F6E4-E95E-4F1A-9683-0C5FBBE29DCE@gentoo.org
1 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
2 Gentoo Linux Security Advisory GLSA 202007-09
3 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
4 https://security.gentoo.org/
5 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
6
7 Severity: Normal
8 Title: Mozilla Thunderbird: Multiple vulnerabilities
9 Date: July 26, 2020
10 Bugs: #730628
11 ID: 202007-09
12
13 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
14
15 Synopsis
16 ========
17
18 Multiple vulnerabilities have been found in Mozilla Thunderbird, the
19 worst of which could result in the arbitrary execution of code.
20
21 Background
22 ==========
23
24 Mozilla Thunderbird is a popular open-source email client from the
25 Mozilla project.
26
27 Affected packages
28 =================
29
30 -------------------------------------------------------------------
31 Package / Vulnerable / Unaffected
32 -------------------------------------------------------------------
33 1 mail-client/thunderbird < 68.10.0 >= 68.10.0
34 2 mail-client/thunderbird-bin
35 < 68.10.0 >= 68.10.0
36 -------------------------------------------------------------------
37 2 affected packages
38
39 Description
40 ===========
41
42 Multiple vulnerabilities have been discovered in Mozilla Thunderbird.
43 Please review the CVE identifiers referenced below for details.
44
45 Impact
46 ======
47
48 Please review the referenced CVE identifiers for details.
49
50 Workaround
51 ==========
52
53 There is no known workaround at this time.
54
55 Resolution
56 ==========
57
58 All Mozilla Thunderbird users should upgrade to the latest version:
59
60 # emerge --sync
61 # emerge --ask --oneshot -v ">=mail-client/thunderbird-68.10.0"
62
63 All Mozilla Thunderbird binary users should upgrade to the latest
64 version:
65
66 # emerge --sync
67 # emerge --ask --oneshot -v ">=mail-client/thunderbird-bin-68.10.0"
68
69 References
70 ==========
71
72 [ 1 ] CVE-2020-12417
73 https://nvd.nist.gov/vuln/detail/CVE-2020-12417
74 [ 2 ] CVE-2020-12418
75 https://nvd.nist.gov/vuln/detail/CVE-2020-12418
76 [ 3 ] CVE-2020-12419
77 https://nvd.nist.gov/vuln/detail/CVE-2020-12419
78 [ 4 ] CVE-2020-12420
79 https://nvd.nist.gov/vuln/detail/CVE-2020-12420
80 [ 5 ] CVE-2020-12421
81 https://nvd.nist.gov/vuln/detail/CVE-2020-12421
82
83 Availability
84 ============
85
86 This GLSA and any updates to it are available for viewing at
87 the Gentoo Security Website:
88
89 https://security.gentoo.org/glsa/202007-09
90
91 Concerns?
92 =========
93
94 Security is a primary focus of Gentoo Linux and ensuring the
95 confidentiality and security of our users' machines is of utmost
96 importance to us. Any security concerns should be addressed to
97 security@g.o or alternatively, you may file a bug at
98 https://bugs.gentoo.org.
99
100 License
101 =======
102
103 Copyright 2020 Gentoo Foundation, Inc; referenced text
104 belongs to its owner(s).
105
106 The contents of this document are licensed under the
107 Creative Commons - Attribution / Share Alike license.
108
109 https://creativecommons.org/licenses/by-sa/2.5

Attachments

File name MIME type
signature.asc application/pgp-signature