Bug 23303

Summary: Thunderbird 52.9.1 (mga5)
Product: Mageia Reporter: David Walser <luigiwalser>
Component: SecurityAssignee: QA Team <qa-bugs>
Status: RESOLVED FIXED QA Contact: Sec team <security>
Severity: critical    
Priority: Normal CC: herman.viaene, jim, sysadmin-bugs, tarazed25, tmb
Version: 5Keywords: validated_update
Target Milestone: ---   
Hardware: All   
OS: Linux   
Whiteboard: MGA5-32-OK, advisory
Source RPM: thunderbird CVE:
Status comment:
Bug Depends on: 23277    
Bug Blocks:    

Description David Walser 2018-07-14 23:14:39 CEST
+++ This bug was initially created as a clone of Bug #23277 +++

Mozilla has released Thunderbird 52.9 today (July 3):
https://www.thunderbird.net/en-US/thunderbird/52.9.0/releasenotes/

The security issues fixed are listed here:
https://www.mozilla.org/en-US/security/advisories/mfsa2018-18/

Mageia 5 and Mageia 6 are also affected.

If it builds for Mageia 5, we can push the nspr, rootcerts, and nss packages from Bug 22904 with it.

Additionally, enigmail needs to be updated (see Bug 23140).
Comment 1 David Walser 2018-07-14 23:15:43 CEST
Clearly something is wrong with the mga5 settings on the build system.  We had a 52.9.0 build ready to go and then 52.9.1 and we cancelled the first update to push the second, which didn't build, but Florian said it built for him with iurt on i586 locally.

Can we please fix the build system so we can try and build one last update for Mozilla stuff?
Comment 2 Thomas Backlund 2018-07-15 20:21:55 CEST
there is nothing different between mga5 and mga6 regarding buildsystem setup.

the thing that differs are toolchain and libs and so on...

Florian said he tested on mga6 / i586.

The reason thunderbird failed on mga6 buildsystem is that it did not obey limiting build processes so it tried with full -j24 and failed...

The reason it worked at 52.9.0 earlier was probably it was built when bs was loaded so even if it tried to build with several processes they were slow enough to "work around" parallell build issues...

Anyway, thunderbird is now built for mga5 too...
Comment 3 David Walser 2018-07-15 20:42:45 CEST
Thanks Thomas.

Advisory and package list for Mageia 5:
https://bugs.mageia.org/show_bug.cgi?id=23277#c2

Just s/52.9.0/52.9.1/ on the packages and add to the references:
https://www.thunderbird.net/en-US/thunderbird/52.9.1/releasenotes/

Assignee: sysadmin-bugs => qa-bugs

Comment 4 Herman Viaene 2018-07-17 11:15:05 CEST
Hm, in the repos (BE mirror) I see 52.9.0 as officially supported, no trace of 52.9.1

CC: (none) => herman.viaene

Comment 5 James Kerr 2018-07-17 11:47:55 CEST
on mga5-64 

packages installed cleanly:
- lib64nss3-3.28.6-1.4.mga5.x86_64
- nss-3.28.6-1.4.mga5.x86_64
- rootcerts-20180411.00-1.mga5.noarch
- rootcerts-java-20180411.00-1.mga5.noarch
- thunderbird-52.9.1-1.mga5.x86_64
- thunderbird-en_GB-52.9.1-1.mga5.noarch

email - POP/SMTP - OK
calendar - OK
movemail - OK

not tested IMAP, enigmail

to the extent tested OK for mga5-64
Comment 6 James Kerr 2018-07-17 13:37:18 CEST
on mga5-32

packages installed cleanly:
- libnspr4-4.19-1.mga5.i586
- libnss3-3.28.6-1.4.mga5.i586
- nss-3.28.6-1.4.mga5.i586
- rootcerts-20180411.00-1.mga5.noarch
- rootcerts-java-20180411.00-1.mga5.noarch
- thunderbird-52.9.1-1.mga5.i586
- thunderbird-en_GB-52.9.1-1.mga5.noarch

email - POP/SMTP - OK
movemail - OK
calendar - OK

not tested IMAP and enigmail

to the extent tested OK for mga5-32

CC: (none) => jim

Comment 7 Herman Viaene 2018-07-18 14:03:41 CEST
MGA5-32 Xfce on Dell Latitude D600
No installation issues for version 52.9.1 overwriting 52.9.0
Sending and receiving email with attachment OK, addressbook OK.

Whiteboard: (none) => MGA5-32-OK

Comment 8 Len Lawrence 2018-07-19 22:02:40 CEST
@James & @Herman 
As said at the meeting, you can send this on its way.

CC: (none) => tarazed25

Herman Viaene 2018-07-19 22:04:48 CEST

Keywords: (none) => validated_update
CC: (none) => sysadmin-bugs

Rémi Verschelde 2018-07-23 12:36:00 CEST

Summary: Thunderbird 52.9 => Thunderbird 52.9.1 (mga5)

Comment 9 Rémi Verschelde 2018-07-23 12:51:38 CEST
Advisory uploaded (hopefully all with correct SRPMs).

Whiteboard: MGA5-32-OK => MGA5-32-OK, advisory

Comment 10 Mageia Robot 2018-07-24 00:29:18 CEST
An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2018-0321.html

Resolution: (none) => FIXED
Status: NEW => RESOLVED