Opened 3 years ago

Closed 3 years ago

#17105 closed enhancement (fixed)

thunderbird-102.3.0

Reported by: Bruce Dubbs Owned by: pierre
Priority: elevated Milestone: 11.3
Component: BOOK Version: git
Severity: normal Keywords:
Cc:

Description

New minor version.

Change History (5)

comment:1 by rsholl, 3 years ago

CHANGES

  • Thunderbird will no longer attempt to import account passwords when importing from another Thunderbird profile in order to prevent profile corruption and permanent data loss.
  • Devtools performance profile will use Thunderbird presets instead of Web Developer presets

FIXES

  • Thunderbird startup performance improvements
  • Saving email source and images failed
  • Error message was shown repeatedly when temporary disk space was full
  • Attaching OpenPGP keys without a set size to non-encrypted messages briefly displayed a size of zero bytes
  • Global Search entry box initially contained "undefined"
  • Delete from POP Server mail filter rule intermittently failed to trigger
  • Connections to POP3 servers without UIDL support failed
  • Pop accounts with "Fetch headers only" set downloaded complete messages if server did not advertise TOP capability
  • "File -> New -> Address Book Contact" from Compose window did not work
  • Attach "My vCard" option in compose window was not available
  • Improved performance of matching a contact to an email address
  • Address book only recognized a contact's first two email addresses
  • Address book search and autocomplete failed if a contact vCard could not be parsed
  • Downloading NNTP messages for offline use failed
  • NNTP client became stuck when connecting to Public-Inbox servers
  • Various visual and UX improvements
  • Various security fixes

KNOWN ISSUES

  • No dedicated "Department" field in address book

comment:2 by rsholl, 3 years ago

Priority: normal → elevated

status changed to elevated.

Last edited 3 years ago by rsholl (previous) (diff)

comment:3 by pierre, 3 years ago

Owner: changed from blfs-book to pierre
Status: new → assigned

Security Vulnerabilities fixed in Thunderbird 102.3

Announced

September 20, 2022

Impact

high

Products

Thunderbird

Fixed in

Thunderbird 102.3

In general, these flaws cannot be exploited through email in the Thunderbird product because scripting is disabled when reading mail, but are potentially risks in browser or browser-like contexts.

#CVE-2022-3266: Out of bounds read when decoding H264

Reporter

Willy R. Vasquez at UT Austin

Impact

high

Description

An out-of-bounds read can occur when decoding H264 video. This results in a potentially exploitable crash. References

Bug 1767360

#CVE-2022-40959: Bypassing FeaturePolicy restrictions on transient pages

Reporter

Armin Ebert

Impact

high

Description

During iframe navigation, certain pages did not have their FeaturePolicy fully initialized leading to a bypass that leaked device permissions into untrusted subdocuments. References

Bug 1782211

#CVE-2022-40960: Data-race when parsing non-UTF-8 URLs in threads

Reporter

Armin Ebert

Impact

high

Description

Concurrent use of the URL parser with non-UTF-8 data was not thread-safe. This could lead to a use-after-free causing a potentially exploitable crash. References

Bug 1787633

#CVE-2022-40958: Bypassing Secure Context restriction for cookies with Host and Secure prefix

Reporter

Axel Chong (@Haxatron)

Impact

moderate

Description

By injecting a cookie with certain special characters, an attacker on a shared subdomain which is not a secure context could set and thus overwrite cookies from a secure context, leading to session fixation and other attacks. References

Bug 1779993

#CVE-2022-40956: Content-Security-Policy base-uri bypass

Reporter

Satoki Tsuji

Impact

low

Description

When injecting an HTML base element, some requests would ignore the CSP's base-uri settings and accept the injected element's base instead. References

Bug 1770094

#CVE-2022-40957: Incoherent instruction cache when building WASM on ARM64

Reporter

Gary Kwong

Impact

low

Description

Inconsistent data in instruction and data cache when creating wasm code could lead to a potentially exploitable crash. This bug only affects Thunderbird on ARM64 platforms. References

Bug 1777604

#CVE-2022-3155: Attachment files saved to disk on macOS could be executed without warning

Reporter

Koh M. Nakagawa

Impact

low

Description

When saving or opening an email attachment on macOS, Thunderbird did not set attribute com.apple.quarantine on the received file. If the received file was an application and the user attempted to open it, then the application was started immediately without asking the user to confirm. References

Bug 1789061

#CVE-2022-40962: Memory safety bugs fixed in Thunderbird 102.3

Reporter

Mozilla developers and community

Impact

high

Description

Mozilla developers Nika Layzell, Timothy Nikkel, Sebastian Hengst, Andreas Pehrson, and the Mozilla Fuzzing Team reported memory safety bugs present in Thunderbird 102.2. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. References

Memory safety bugs fixed in Thunderbird 102.3

comment:4 by pierre, 3 years ago

Updated at commit c3a493c30d. SA coming.

comment:5 by pierre, 3 years ago

Resolution: → fixed
Status: assigned → closed

SA at commit e8354cb on www.git

Note: See TracTickets for help on using tickets.