Bug 5597

Summary: Update candidate: mozilla-thunderbird & -l10n - security update to 10.0.4ESR
Product: Mageia Reporter: Florian Hubold <doktor5000>
Component: SecurityAssignee: QA Team <qa-bugs>
Status: RESOLVED FIXED QA Contact:
Severity: normal    
Priority: Normal CC: bert.ram.aerts, davidwhodgins, doktor5000, luigiwalser, sysadmin-bugs, tmb
Version: 1Keywords: validated_update
Target Milestone: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Source RPM: mozilla-thunderbird CVE:
Status comment:
Attachments: menu bar with lightning and enigmail installed
addons=>extensions with lightning and enigmail installed
Screen shot of my working thunderbird with enigmail/lightning extensions.

Description Florian Hubold 2012-04-24 22:45:30 CEST
There is now mozilla-thunderbird-10.0.4-1.mga1 in core/updates_testing to
validate, together with the language packages
mozilla-thunderbird-XX-10.0.4-1.mga1
-------------------------------------------------------


Suggested advisory:
-------------------
This update addresses the following security issues:

o fixes http://www.mozilla.org/security/announce/2012/mfsa2012-20.html
    (Miscellaneous memory safety hazards [CVE-2012-0468, CVE-2012-0467])
  o fixes http://www.mozilla.org/security/announce/2012/mfsa2012-22.html
    (use-after-free in IDBKeyRange[CVE-2012-0469])
  o fixes http://www.mozilla.org/security/announce/2012/mfsa2012-23.html
    (Invalid frees causes heap corruption in gfxImageSurface [CVE-2012-0470])
  o fixes http://www.mozilla.org/security/announce/2012/mfsa2012-24.html
    (Potential XSS via multibyte content processing errors [CVE-2012-0471])
  o fixes http://www.mozilla.org/security/announce/2012/mfsa2012-25.html
    (Potential memory corruption during font rendering using cairo-dwrite
     [CVE-2012-0472])
  o fixes http://www.mozilla.org/security/announce/2012/mfsa2012-26.html
    (WebGL.drawElements may read illegal video memory due to
     FindMaxUshortElement error [CVE-2012-0473])
  o fixes http://www.mozilla.org/security/announce/2012/mfsa2012-27.html
    (Page load short-circuit can lead to XSS [CVE-2012-0474])
  o fixes http://www.mozilla.org/security/announce/2012/mfsa2012-28.html
    (Ambiguous IPv6 in Origin headers may bypass webserver access restrictions
     [CVE-2012-0475])
  o fixes http://www.mozilla.org/security/announce/2012/mfsa2012-29.html
    (Potential XSS through ISO-2022-KR/ISO-2022-CN decoding issues
     [CVE-2012-0477])
  o fixes http://www.mozilla.org/security/announce/2012/mfsa2012-30.html
    (Crash with WebGL content using textImage2D [CVE-2012-0478])
  o fixes http://www.mozilla.org/security/announce/2012/mfsa2012-31.html
    (Off-by-one error in OpenType Sanitizer [CVE-2011-3062])
  o fixes http://www.mozilla.org/security/announce/2012/mfsa2012-33.html
    (Potential site identity spoofing when loading RSS and Atom feeds
     [CVE-2012-0479])
This update also adresses the following issues:
- switch to Enigmail 1.4, officially supported version for ESR releases
  o fixes a problem with inline PGP decrpytion: https://www.mozdev.org/bugs/show_bug.cgi?id=24762
  o enigmail update also adresses the following bugs: https://www.mozdev.org/bugs/buglist.cgi?target_milestone=v1.4

-------------------------------------------------------
Steps to reproduce:

- install/update to update candidate and according language pack
- make sure inline PGP decryption is now working properly (see https://www.mozdev.org/bugs/show_bug.cgi?id=24762 for the bug with previous versions)
- make sure there are no regressions
- make sure Thunderbird uses the language of the language pack
Comment 1 Florian Hubold 2012-04-24 22:49:45 CEST
Forgot to tell, it would be nice to get some early results from testing so i can tell if we should push this as-is to cauldron so we get it through the freeze for Mageia 2 before it's too late.

Status: NEW => ASSIGNED
CC: (none) => doktor5000

David Walser 2012-04-25 00:05:56 CEST

CC: (none) => luigiwalser

Comment 2 Manuel Hiebel 2012-04-25 00:20:07 CEST
Works nice under mga1, the french language is selected and ok too, lightning is there. But I don't use enigmail.

Source RPM: (none) => mozilla-thunderbird

Comment 3 Dave Hodgins 2012-04-25 00:37:16 CEST
Testing complete on i586 for the srpms
mozilla-thunderbird-l10n-10.0.4-1.mga1.src.rpm
mozilla-thunderbird-10.0.4-1.mga1.src.rpm

Couldn't recreate the problem with inline encrypted messages, prior to
installing the update.

After installing the update, again sent myself an encrypted message,
using inline encryption.  Works fine.  Also ensured nntp access is
still working.

CC: (none) => davidwhodgins

Comment 4 claire robinson 2012-04-25 11:12:38 CEST
I don't think enigmail is working 10.0.3 x86_64. Never used it but it doesn't currently add anything and is not registered anywhere in the addons/extensions.

Message in the error console reads

Could not read chrome manifest file '/usr/share/mozilla/extensions/{3550f703-e582-4d05-9a08-453d09bdfdc6}/langpack-en-GB@thunderbird.mozilla.org/chrome/en-GB.manifest'.


I'll try with the update candidate.
Comment 5 claire robinson 2012-04-25 11:56:13 CEST
x86_64

I think there is a problem with enigmail. It is not registered as as addon/extension and no extra options appear anywhere.

Installed mozilla-thunderbird-lightning and that is the same :\

# rpm -qa | grep thunderbird
mozilla-thunderbird-enigmail-10.0.4-1.mga1
mozilla-thunderbird-lightning-1.2.1-1.mga1
mozilla-thunderbird-en_GB-10.0.4-1.mga1
mozilla-thunderbird-10.0.4-1.mga1
Comment 6 Manuel Hiebel 2012-04-25 12:09:56 CEST
I was using the xpi (in version 1.2.3) of lightning, but it seems the rpm works too here.
Comment 7 claire robinson 2012-04-25 12:24:28 CEST
Created a new user, cancelled the email account setup, but there is no sign of enigmail or lightning here either.

There is the same message about the en-GB.manifest

Could not read chrome manifest file '/usr/share/mozilla/extensions/{3550f703-e582-4d05-9a08-453d09bdfdc6}/langpack-en-GB@thunderbird.mozilla.org/chrome/en-GB.manifest'.

Also some errors

(Error)
Error: uncaught exception: [Exception... "Component returned failure code: 0x80004005 (NS_ERROR_FAILURE) [nsIMsgSendLater.hasUnsentMessages]"  nsresult: "0x80004005 (NS_ERROR_FAILURE)"  location: "JS frame :: chrome://messenger/content/mail-offline.js :: <TOP_LEVEL> :: line 81"  data: no]

(Message) 
2012-04-25 11:14:06	gloda.ds.qfq	ERROR	Exception: TypeError: Gloda.myContact is null

(Error)
Error: Gloda.myContact is null
Source File: resource:///components/glautocomp.js
Line: 286

The latter may be because there are no contacts set up but that shouldn't really cause an error.

Also lots of messages about 'unknown property' or 'error parsing value for' followed by 'Declaration dropped.' seemingly for graphical elements but these don't appear to be important.
Comment 8 Dave Hodgins 2012-04-25 22:08:09 CEST
Do you have a gpg key setup?

With mozilla-thunderbird-enigmail installed, when I run thunderbird,
there's an added menu item OpenPGP in between the Message and Tools
entry.
Comment 9 claire robinson 2012-04-25 23:58:00 CEST
No extra anything here Dave. Its the same with lightning.

Do you have them listed in tools -> addons? I think they should appear as Extensions.

For me, it says I don't have any Extensions.

Not sure if the following is helpful.
 
$ ls /usr/share/mozilla/extensions/
{3550f703-e582-4d05-9a08-453d09bdfdc6}/  {ec8030f7-c20a-464f-9b0e-13a3a9e97384}/

$ ls /usr/share/mozilla/extensions/{ec8030f7-c20a-464f-9b0e-13a3a9e97384}/
belgiumeid@eid.belgium.be/  langpack-en-GB@firefox.mozilla.org.xpi

$ ls /usr/share/mozilla/extensions/{3550f703-e582-4d05-9a08-453d09bdfdc6}/langpack-en-GB@thunderbird.mozilla.org
chrome/  chrome.manifest  install.rdf

$ ls /usr/share/mozilla/extensions/\{3550f703-e582-4d05-9a08-453d09bdfdc6\}/langpack-en-GB@thunderbird.mozilla.org/chrome/en-GB/locale/en-GB/
alerts/        cookie/    global-platform/  messenger-newsblog/  mozldap/      pippki/
autoconfig/    editor/    global-region/    messenger-region/    necko/        places/
branding/      feedback/  messenger/        messenger-smime/     passwordmgr/
communicator/  global/    messenger-mapi/   mozapps/             pipnss/


$ find /usr/share/mozilla/extensions -name *.manifest
/usr/share/mozilla/extensions/{3550f703-e582-4d05-9a08-453d09bdfdc6}/langpack-en-GB@thunderbird.mozilla.org/chrome.manifest
/usr/share/mozilla/extensions/{ec8030f7-c20a-464f-9b0e-13a3a9e97384}/belgiumeid@eid.belgium.be/chrome.manifest

$ rpm -qa | grep thunderbird
mozilla-thunderbird-enigmail-10.0.4-1.mga1
mozilla-thunderbird-lightning-1.2.1-1.mga1
mozilla-thunderbird-en_GB-10.0.4-1.mga1
mozilla-thunderbird-10.0.4-1.mga1
Comment 10 Florian Hubold 2012-04-26 19:55:12 CEST
@claire: Please leave the messages from error console out of the reports, i think i've already told you before that most developers at mozilla don't care if the error console is empty, and most messages aren't even that meaningful, many are also only related to rendering the thunderbird start-page. It's nice that you're so into details and paying attention, but for thunderbird it's not really helpful, sorry :/

Also the output is not that much helpful, it's only related to the language packs, as enigmail (and other addons) are located below /usr/lib/mozilla/extensions/ (or /usr/lib64/mozilla/extensions/ for an x86_64 system) ;)

And FWIW, yes, lightning, enigmail and enigmail language pack (although the latter is disabled, but nevertheless working, but that's an upstream problem) and other user-installed addons should all be listed in Addon Manager under Extensions.

Can you please give me the output of "rpm -qa | grep gnupg" and also the output from thunderbird when started from a terminal? Currently i can't reproduce, when creating a new profile for thunderbird i still get the dedicated menus for "OpenGPG" (enigmail) and "Events and Tasks" (lightning) and can also see lightning getting displayed.
Comment 11 claire robinson 2012-04-26 20:05:53 CEST
Regarding the error console, I looked because I encountered a major error (lack of installed extensions) and found two Errors there so thought them worth mentioning ;)
Comment 12 claire robinson 2012-04-26 20:12:37 CEST
$ mozilla-thunderbird

No errors or any other output.

$ rpm -qa |grep gnupg
gnupg2-2.0.16-6.mga1
gnupg-1.4.11-1.mga1
Comment 13 claire robinson 2012-04-26 20:16:11 CEST
Created attachment 2116 [details]
menu bar with lightning and enigmail installed
Comment 14 claire robinson 2012-04-26 20:17:13 CEST
Created attachment 2117 [details]
addons=>extensions with lightning and enigmail installed
Comment 15 claire robinson 2012-04-26 20:22:07 CEST
# ls /usr/lib64/mozilla/extensions/
{3550f703-e582-4d05-9a08-453d09bdfdc6}/  {ec8030f7-c20a-464f-9b0e-13a3a9e97384}/

# ls /usr/lib64/mozilla/extensions/\{ec8030f7-c20a-464f-9b0e-13a3a9e97384\}/
#

# ls /usr/lib64/mozilla/extensions/\{3550f703-e582-4d05-9a08-453d09bdfdc6\}/
{847b3a00-7ab1-11d4-8f02-006008948af5}/     {e2fda1a4-762b-4020-b5ad-a41df1933103}/
{a62ef8ec-5fdc-40c2-873c-223b8a6925cc}.xpi

# ls /usr/lib64/mozilla/extensions/\{3550f703-e582-4d05-9a08-453d09bdfdc6\}/\{847b3a00-7ab1-11d4-8f02-006008948af5\}/
chrome/          components/  install.rdf  platform/
chrome.manifest  defaults/    modules/     wrappers/

# ls /usr/lib64/mozilla/extensions/\{3550f703-e582-4d05-9a08-453d09bdfdc6\}/\{e2fda1a4-762b-4020-b5ad-a41df1933103\}/
application.ini  chrome/          components/  install.rdf    modules/
calendar-js/     chrome.manifest  defaults/    lightning.xpi  timezones.sqlite
Comment 16 Florian Hubold 2012-04-26 20:38:26 CEST
FWIW, could you please do the following as user, after quitting thunderbird:

mv ~/.thunderbird/ ~/.thunderbird-old/ && thunderbird

I'm quite confused, as it seems to work for me and Dave on x86_64 and i586, and this is the first time i hear of such a problem, also this wasn't mentioned in any earlier thunderbird test AFAIR ...

@Dave: Did you also test to start thunderbird with a fresh profile, i.e. doing what i suggested to claire above?
Comment 17 claire robinson 2012-04-26 23:13:29 CEST
You're right about 10.0.3 enigmail and lightning were probably neglected. It does seem to affect 10.0.3 as well though, sorry for not noticing last time around.

I'll try tomorrow to downgrade thunderbird to an earlier version and try to find when it began to fail. It seems likely to have been introduced with the upgrade from 3.xx to 10.0.3 though.

I can try with a new .thunderbird tomorrow but I've already tried creating a completely new user and the issue is the same there.

I'll try with enigmail and lightning from mozilla and I'll also test on i586 tomorrow and post results.
Comment 18 Dave Hodgins 2012-04-26 23:41:58 CEST
It does show up in addons/extensions on my i586 system.

Works both for my regular account, and a new user.
Comment 19 Dave Hodgins 2012-04-27 00:57:47 CEST
Created attachment 2118 [details]
Screen shot of my working thunderbird with enigmail/lightning extensions.
Comment 20 claire robinson 2012-04-27 10:53:00 CEST
I've tried this on a clean mga1 x86_64 installation with lxde in virtualbox and there are no problems with either enigmail or lightning so whatever it is must be my system rather than thunderbird itself.

I'm having trouble getting it to sign an email, it gives 'Error - bad passphrase' all the time. I used the setup wizard to create the key.

Send operation aborted.

Error - bad passphrase

gpg command line and output:
/usr/bin/gpg
gpg: cancelled by user
gpg: skipped "0xF604775B": bad passphrase
gpg: [stdin]: clearsign failed: bad passphrase


I've no idea if this is just me doing it wrong or whether it means there is a problem.
Comment 21 Florian Hubold 2012-04-27 19:28:44 CEST
I must admit that i don't use PGP that much/at all, but i was able to inline-decrypt some attachment (can be easily created by encrypting some file via "gpg -c somefile" and then give a password, and thunderbird should ask you for the password if you want to open such an encrypted file, if it's attached to a mail. But you need to have some kind of pinentry-program installed)

So please give the output of "rpm -qa | grep pinentry"


And could you try to sign (gpg -s) and verify (gpg --verify) some random file via command line first?
Comment 22 claire robinson 2012-04-27 19:35:29 CEST
I'll check tomorrow Florian. I'm booted into a prerelease rc at the moment and then knocking off for the day :)
Comment 23 claire robinson 2012-04-28 11:25:02 CEST
$ gpg -s file.pdf

You need a passphrase to unlock the secret key for
user: "claire <eeeemail@gmail.com>"
2048-bit RSA key, ID F604775B, created 2012-04-27

Once I remembered the pass phrase I'd set it worked fine.

$ gpg --verify file.pdf.gpg
gpg: Signature made Sat 28 Apr 2012 10:01:49 BST using RSA key ID F604775B
gpg: Good signature from "claire <eeeemail@gmail.com>"

$ rpm -qa | grep pinentry
pinentry-0.8.1-2.1.mga1
pinentry-qt4-0.8.1-2.1.mga1


What enigmail isn't doing is asking for any pass phrase. When I use the Test button in the OpenPGP Preferences dialogue of enigmail with my email address in it the test succeeds.

EnigTest: START ********************************
EnigTest: To: eeeemail@gmail.com
TEST MESSAGE 123
TEST MESSAGE 345


When I use the line I found it is using in the enigmail console in a terminal..

/usr/bin/gpg --charset utf-8 --display-charset utf-8 --batch --no-tty --status-fd 2 -t --clearsign -u <eeeemail@gmail.com> --use-agent

After removing the <> from the email address, it asks for a pass phrase and then accepts input from stdin.


I'm don't think it is relevant but if I remove enigmail and reinstall, there is an error during installation..

installing mozilla-thunderbird-enigmail-10.0.4-1.mga1.x86_64.rpm from /var/cache/urpmi/rpms
Preparing...                     ############################################
      1/1: mozilla-thunderbird-enigmail
                                 ############################################
OpenGL Warning: glXChooseFBConfig returning NULL, due to attrib=0x8010, next=0x2


As the test succeeds, the problems are likely to be a configuration issue. WDYT?
Should it ask for a pass phrase?
Comment 24 Dave Hodgins 2012-04-28 20:21:11 CEST
It's configured to use gpg-agent to get the password, which is
in the gnupg2 package.  Is that installed?

$ rpm -q -requires mozilla-thunderbird-enigmail|grep gnu
gnupg

Looks like gnupg2 should be added as a requires.
Comment 25 Dave Hodgins 2012-04-28 20:21:49 CEST
Forgot.  I think you have to logout/in after installing gnupg2, to
get the agent running.
Comment 26 Bert Aerts 2012-04-29 09:03:41 CEST
Mageia cauldron x86_64 (i.e. almost Mageia 2)

Since the update for Thunderbird:
thunderbird-enigmail-10.0.4-1.mga2
thunderbird-10.0.4-1.mga2
GnuPG no longer works in Thunderbird.

When entering gpg-agent in terminal, I get
gpg-agent: no gpg-agent running in this session

So it is not only Mageia 1 issue...

CC: (none) => bert.ram.aerts

Comment 27 Bert Aerts 2012-04-29 10:09:07 CEST
(In reply to comment #26)
> Mageia cauldron x86_64 (i.e. almost Mageia 2)
> 
> Since the update for Thunderbird:
> thunderbird-enigmail-10.0.4-1.mga2
> thunderbird-10.0.4-1.mga2
> GnuPG no longer works in Thunderbird.
> 
> When entering gpg-agent in terminal, I get
> gpg-agent: no gpg-agent running in this session
> 
> So it is not only Mageia 1 issue...

In Mageia 1 there is no problem with gpg-agent like in Cauldron.
I updated from
mozilla-thunderbird-enigmail-10.0.3-1.mga1
mozilla-thunderbird-10.0.3-1.mga1
to
mozilla-thunderbird-enigmail-10.0.4-1.mga1
mozilla-thunderbird-10.0.4-1.mga1

GnuPG still works as expected in Mageia 1 x86_64.

Should I open a seperate bugreport ?
Comment 28 claire robinson 2012-04-29 10:46:27 CEST
Yes please Bert, even if it is related it is mga2. This bug will be closed when mga1 version is pushed.

gnupg2 is already installed

$ rpm -qa | grep gnupg
gnupg2-2.0.16-6.mga1
gnupg-1.4.11-1.mga1
Comment 29 Dave Hodgins 2012-04-29 19:34:48 CEST
Is gpg-agent running, for your userid?
Comment 30 Bert Aerts 2012-04-29 20:55:12 CEST
Until one week ago GnuPG in Thunderbird was working fine. I now Thunderbird was updated last week, I don't know for the GnuPG rpm's:

[bert@Dell1720Mageia2 ~]$ rpm -aq | grep gnupg
gnupg-1.4.12-1.mga2
gnupg2-2.0.18-1.mga2

If I type gpg-agent in a terminal, I get:

[bert@Dell1720Mageia2 ~]$ gpg-agent
gpg-agent: no gpg-agent running in this session

So gpg-agent is not running for my userid.
Starting it as root gives:

[root@Dell1720Mageia2 bert]# gpg-agent --daemon
GPG_AGENT_INFO=/tmp/gpg-rC95a4/S.gpg-agent:4965:1; export GPG_AGENT_INFO;
[root@Dell1720Mageia2 bert]# gpg-agent 
gpg-agent: no gpg-agent running in this session

So it seems it can not be started?
Comment 31 Florian Hubold 2012-04-29 21:08:20 CEST
@Bert: Actually your primary problem is with gpg-agent, not with thunderbird, so please open a seperate bug for that. Also replied to your forum thread: https://forums.mageia.org/en/viewtopic.php?f=15&t=2320
Comment 32 Bert Aerts 2012-04-29 21:23:49 CEST
(In reply to comment #31)
> @Bert: Actually your primary problem is with gpg-agent, not with thunderbird,
> so please open a seperate bug for that. Also replied to your forum thread:
> https://forums.mageia.org/en/viewtopic.php?f=15&t=2320

Thanks, I created:
Bug 5684 - gpg-agent: no gpg-agent running in this session
Comment 33 claire robinson 2012-04-30 09:31:15 CEST
$ ps aux | grep gpg
claire    2122  0.0  0.0  16200   428 ?        Ss   08:23   0:00 gpg-agent --keep-display --daemon --write-env-file /home/claire/.gnupg/gpg-agent-info
Comment 34 claire robinson 2012-04-30 10:22:19 CEST
This is having to take a back seat at the moment for pre-release testing the RC.

When I get a chance I will load an early snapshot of the VM and start over.

One possible issue is that pinentry-gtk2 was not installed despite it being lxde, but I did not see any difference when I installed it.
Comment 35 claire robinson 2012-04-30 13:13:16 CEST
Testing again on a newly installed mga1

Created a new key and used it to sign and encrpyt/decrypt email to myself

I read that enigmail struggles when more than one passphrase has been used so this is probably the case with the other installation.

For future updates would it be a good idea not to package addons?
Comment 36 claire robinson 2012-04-30 13:16:35 CEST
Validating

See comment 0 for Advisory and SRPM.

Could sysadmin please push from core/updates_testing to core/updates

Thankyou!

Keywords: (none) => validated_update
CC: (none) => sysadmin-bugs

Comment 37 Florian Hubold 2012-04-30 21:18:06 CEST
(In reply to comment #35)
> 
> For future updates would it be a good idea not to package addons?

Sorry i don't understand? You want us to drop enigmail? And FWIW lightning is already packaged, and does not need to be updated, also enigmail doesn't need to be unless we switch to a new major ESR version, it's just the need to update enigmail because enigmail upstream developer recently announced that enigmail 1.4 is the supported version for ESR releases (and i switched to it because it fixes a bug with inline PGP decryption).
Comment 38 Thomas Backlund 2012-04-30 23:53:08 CEST
Update pushed.

Status: ASSIGNED => RESOLVED
CC: (none) => tmb
Resolution: (none) => FIXED