#17537 closed enhancement (fixed)
thunderbird-102.7.2
| Reported by: | Bruce Dubbs | Owned by: | Douglas R. Reno |
|---|---|---|---|
| Priority: | elevated | Milestone: | 11.3 |
| Component: | BOOK | Version: | git |
| Severity: | normal | Keywords: | |
| Cc: |
Description
New minor version.
Change History (7)
comment:1 by , 17 months ago
| Priority: | normal → elevated |
|---|
comment:2 by , 17 months ago
| Owner: | changed from to |
|---|---|
| Status: | new → assigned |
comment:3 by , 17 months ago
| Summary: | thunderbird-102.7.0 → thunderbird-102.7.1 |
|---|
comment:4 by , 16 months ago
| Summary: | thunderbird-102.7.1 → thunderbird-102.7.2 |
|---|
Now 102.7.2
Should be able to get to this in the next day or so
comment:5 by , 16 months ago
102.7.0
What’s New
Enterprise policies now support Thunderbird-specific preferences
Fixes
Localized builds and langpacks now use "comm-l10n" repository; downstream builds using official langpacks should not need to make changes
Having too many folders open at startup caused loss of MSF files
Copying an email from one local folder to another local folder sometimes caused "Another Operation is using the folder" error on Windows 7
Email address pill allowed for incorrectly formatted email addresses
Creating security exceptions for messages sent using a self-signed certificate failed if hostname contained uppercase letters
S/MIME certificate verification was prohibitively slow
OpenPGP key import failed for key blocks with comments that contain Unicode characters
Chat conversation sidebar was too wide under certain circumstances, making scrollbar unusable
On Mac, deleting events from Today Pane with "Backspace" key deleted selected messages instead
Various security fixes
102.7.1
Fixes
Microsoft Office 365 accounts were unable to authenticate
Switching identities caused remote images in HTML signatures to not be shown
Thunderbird failed to import vCards that contained "\r\r\n" line endings
Contribution button for add-ons opened Contribution page in a Thunderbird tab, instead of the external browser
XMPP did not respond to unrecognized IQ queries, causing some servers to close the connection
Window titlebar buttons (minimize/maximize/close) were not displayed in Windows 10 "Dark" color mode
Various security fixes
102.7.2
Fixes
Various crash fixes
Security Fixes for 102.7.0
Security Vulnerabilities fixed in Thunderbird 102.7
Announced
January 18, 2023
Impact
high
Products
Thunderbird
Fixed in
Thunderbird 102.7
#CVE-2022-46871: libusrsctp library out of date
Impact
high
Description
An out of date library (libusrsctp) contained vulnerabilities that could potentially be exploited.
#CVE-2023-23598: Arbitrary file read from GTK drag and drop on Linux
Impact
high
Description
Due to the Thunderbird GTK wrapper code's use of text/plain for drag data and GTK treating all text/plain MIMEs containing file URLs as being dragged a website could arbitrarily read a file via a call to DataTransfer.setData.
#CVE-2023-23599: Malicious command could be hidden in devtools output on Windows
Impact
moderate
Description
When copying a network request from the developer tools panel as a curl command the output was not being properly sanitized and could allow arbitrary commands to be hidden within.
#CVE-2023-23601: URL being dragged from cross-origin iframe into same tab triggers navigation
Impact
moderate
Description
Navigations were being allowed when dragging a URL from a cross-origin iframe into the same tab which could lead to website spoofing attacks
#CVE-2023-23602: Content Security Policy wasn't being correctly applied to WebSockets in WebWorkers
Impact
moderate
Description
A mishandled security check when creating a WebSocket in a WebWorker caused the Content Security Policy connect-src header to be ignored. This could lead to connections to restricted origins from inside WebWorkers.
#CVE-2022-46877: Fullscreen notification bypass
Impact
low
Description
By confusing the browser, the fullscreen notification could have been delayed or suppressed, resulting in potential user confusion or spoofing attacks.
#CVE-2023-23603: Calls to <code>console.log</code> allowed bypasing Content Security Policy via format directive
Impact
low
Description
Regular expressions used to filter out forbidden properties and values from style directives in calls to console.log weren't accounting for external URLs. Data could then be potentially exfiltrated from the browser.
#CVE-2023-23605: Memory safety bugs fixed in Thunderbird 102.7
Impact
high
Description
Mozilla developers and the Mozilla Fuzzing Team reported memory safety bugs present in Thunderbird 102.6. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.
Security Fixes for 102.7.1
Security Vulnerabilities fixed in Thunderbird 102.7.1
Announced
January 23, 2023
Impact
high
Products
Thunderbird
Fixed in
Thunderbird 102.7.1
#CVE-2023-0430: Revocation status of S/Mime signature certificates was not checked
Impact
high
Description
Certificate OCSP revocation status was not checked when verifying S/Mime signatures. Mail signed with a revoked certificate would be displayed as having a valid signature. Thunderbird versions from 68 to 102.7.0 were affected by this bug.
comment:6 by , 16 months ago
| Resolution: | → fixed |
|---|---|
| Status: | assigned → closed |
Now 102.7.1