| Summary: | Thunderbird 78.5.1 | ||
|---|---|---|---|
| Product: | Mageia | Reporter: | David Walser <luigiwalser> |
| Component: | Security | Assignee: | QA Team <qa-bugs> |
| Status: | RESOLVED FIXED | QA Contact: | Sec team <security> |
| Severity: | critical | ||
| Priority: | Normal | CC: | andrewsfarm, fri, herman.viaene, jim, nicolas.salguero, ouaurelien, sysadmin-bugs |
| Version: | 7 | Keywords: | advisory, validated_update |
| Target Milestone: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | MGA7-64-OK | ||
| Source RPM: | thunderbird-78.5.0-1.mga7.src.rpm | CVE: | |
| Status comment: | |||
|
Description
David Walser
2020-12-02 16:13:26 CET
We can ship the rootcerts-20201201.00 update with this update. So nss needs to be rebuilt, isn't it? rootcerts-20201201.00-1.mga7 rootcerts-java-20201201.00-1.mga7 from rootcerts-20201201.00-1.mga7.src.rpm No nspr or nss updates available at this time, so you can build TB. No, nss does not build libnssckbi.so (which bundled rootcerts) any more. Advisory: ======================== Updated thunderbird packages fix security vulnerability: When reading SMTP server status codes, Thunderbird writes an integer value to a position on the stack that is intended to contain just one byte. Depending on processor architecture and stack layout, this leads to stack corruption that may be exploitable (CVE-2020-26970). References: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-26970 https://www.mozilla.org/en-US/security/advisories/mfsa2020-53/ https://www.thunderbird.net/en-US/thunderbird/78.5.1/releasenotes/ ======================== Updated packages in core/updates_testing: ======================== rootcerts-20201201.00-1.mga7 rootcerts-java-20201201.00-1.mga7 thunderbird-78.5.1-1.mga7 thunderbird-enigmail-78.5.1-1.mga7 thunderbird-ar-78.5.1-1.mga7 thunderbird-ast-78.5.1-1.mga7 thunderbird-be-78.5.1-1.mga7 thunderbird-bg-78.5.1-1.mga7 thunderbird-br-78.5.1-1.mga7 thunderbird-ca-78.5.1-1.mga7 thunderbird-cs-78.5.1-1.mga7 thunderbird-cy-78.5.1-1.mga7 thunderbird-da-78.5.1-1.mga7 thunderbird-de-78.5.1-1.mga7 thunderbird-el-78.5.1-1.mga7 thunderbird-en_GB-78.5.1-1.mga7 thunderbird-en_US-78.5.1-1.mga7 thunderbird-es_AR-78.5.1-1.mga7 thunderbird-es_ES-78.5.1-1.mga7 thunderbird-et-78.5.1-1.mga7 thunderbird-eu-78.5.1-1.mga7 thunderbird-fi-78.5.1-1.mga7 thunderbird-fr-78.5.1-1.mga7 thunderbird-fy_NL-78.5.1-1.mga7 thunderbird-ga_IE-78.5.1-1.mga7 thunderbird-gd-78.5.1-1.mga7 thunderbird-gl-78.5.1-1.mga7 thunderbird-he-78.5.1-1.mga7 thunderbird-hr-78.5.1-1.mga7 thunderbird-hsb-78.5.1-1.mga7 thunderbird-hu-78.5.1-1.mga7 thunderbird-hy_AM-78.5.1-1.mga7 thunderbird-id-78.5.1-1.mga7 thunderbird-is-78.5.1-1.mga7 thunderbird-it-78.5.1-1.mga7 thunderbird-ja-78.5.1-1.mga7 thunderbird-ka-78.5.1-1.mga7 thunderbird-kab-78.5.1-1.mga7 thunderbird-kk-78.5.1-1.mga7 thunderbird-ko-78.5.1-1.mga7 thunderbird-lt-78.5.1-1.mga7 thunderbird-ms-78.5.1-1.mga7 thunderbird-nb_NO-78.5.1-1.mga7 thunderbird-nl-78.5.1-1.mga7 thunderbird-nn_NO-78.5.1-1.mga7 thunderbird-pl-78.5.1-1.mga7 thunderbird-pt_BR-78.5.1-1.mga7 thunderbird-pt_PT-78.5.1-1.mga7 thunderbird-ro-78.5.1-1.mga7 thunderbird-ru-78.5.1-1.mga7 thunderbird-si-78.5.1-1.mga7 thunderbird-sk-78.5.1-1.mga7 thunderbird-sl-78.5.1-1.mga7 thunderbird-sq-78.5.1-1.mga7 thunderbird-sv_SE-78.5.1-1.mga7 thunderbird-tr-78.5.1-1.mga7 thunderbird-uk-78.5.1-1.mga7 thunderbird-uz-78.5.1-1.mga7 thunderbird-vi-78.5.1-1.mga7 thunderbird-zh_CN-78.5.1-1.mga7 thunderbird-zh_TW-78.5.1-1.mga7 from SRPMS: rootcerts-20201201.00-1.mga7.src.rpm thunderbird-78.5.1-1.mga7.src.rpm thunderbird-l10n-78.5.1-1.mga7.src.rpm CC:
(none) =>
nicolas.salguero 64 bit OK here: Plasma, Intel, Nvidia, Swedish. Clean upgrade and I just continue to use it since yesterday. Offline IMAP, SMTP. CC:
(none) =>
fri On mga7-64 kernel-desktop plasma packages installed cleanly: - rootcerts-20201201.00-1.mga7.noarch - rootcerts-java-20201201.00-1.mga7.noarch - thunderbird-78.5.1-1.mga7.x86_64 - thunderbird-en_GB-78.5.1-1.mga7.noarch email (POP, SMTP): OK Calendar: OK Address book: OK Movemail: OK looks OK for mga7-64 CC:
(none) =>
jim MGA7-64 MATE on Peaq C1011 No installation issues. Using pop account, sending to and receiving from other account on my desktop PC without and with appendix (jpg, pdf) all work OK. Addressbook preserved fro previous version OK. CC:
(none) =>
herman.viaene ^4-bit US English version looks good here, too. Giving it an OK and validating. Advisory in Comment 5. Keywords:
(none) =>
validated_update Same for French version. IMAP(/SSL), SMTP(/SSL) and POP3 are OK. Enigmail migration OK. x86_64. Advisory pushed to SVN. Source RPM:
thunderbird =>
thunderbird-78.5.0-1.mga7.src.rpm An update for this issue has been pushed to the Mageia Updates repository. https://advisories.mageia.org/MGASA-2020-0450.html Status:
NEW =>
RESOLVED RedHat has issued an advisory for this today (December 14): https://access.redhat.com/errata/RHSA-2020:5398 |