Interesting...the upstream advisories do note that Thunderbird 24.1 (also out now) is the next version, but it's not indicated as an ESR release.  17.0.10 is the current ESR release.  I wonder if we need to revert back to that.

CC: (none) => oe

(In reply to David Walser from comment #1)
> Interesting...the upstream advisories do note that Thunderbird 24.1 (also
> out now) is the next version, but it's not indicated as an ESR release. 
> 17.0.10 is the current ESR release.  I wonder if we need to revert back to
> that.

Since Thunderbird 24, mainstream and ESR releases are merged.
https://ml.mageia.org/l/arc/dev/2013-09/msg00422.html
https://mail.mozilla.org/pipermail/tb-enterprise/2013-September/000842.html

CC: (none) => lmenut
Hardware: i586 => All

Thanks Luc!  That's very helpful.  I was confused since I didn't see 24.1 listed here:
http://www.mozilla.org/security/known-vulnerabilities/thunderbirdESR.html

We should be able to push an update for 24.1 then if the lightning issues get worked out.

(In reply to Oden Eriksson from comment #21)
> tb 24.1.0 has also been submitted.

Thanks Oden!  Hopefully things will get cleared up with lightning soon.

BTW, are FF/TB updated in SVN ready to push for Cauldron?

Updated packages in updates_testing:
thunderbird-24.1.0-1.mga2
thunderbird-enigmail-24.1.0-1.mga2
nsinstall-24.1.0-1.mga2
thunderbird-ar-24.1.0-1.mga2
thunderbird-ast-24.1.0-1.mga2
thunderbird-be-24.1.0-1.mga2
thunderbird-bg-24.1.0-1.mga2
thunderbird-bn_BD-24.1.0-1.mga2
thunderbird-br-24.1.0-1.mga2
thunderbird-ca-24.1.0-1.mga2
thunderbird-cs-24.1.0-1.mga2
thunderbird-da-24.1.0-1.mga2
thunderbird-de-24.1.0-1.mga2
thunderbird-el-24.1.0-1.mga2
thunderbird-en_GB-24.1.0-1.mga2
thunderbird-es_AR-24.1.0-1.mga2
thunderbird-es_ES-24.1.0-1.mga2
thunderbird-et-24.1.0-1.mga2
thunderbird-eu-24.1.0-1.mga2
thunderbird-fi-24.1.0-1.mga2
thunderbird-fr-24.1.0-1.mga2
thunderbird-fy-24.1.0-1.mga2
thunderbird-ga-24.1.0-1.mga2
thunderbird-gd-24.1.0-1.mga2
thunderbird-gl-24.1.0-1.mga2
thunderbird-he-24.1.0-1.mga2
thunderbird-hr-24.1.0-1.mga2
thunderbird-hu-24.1.0-1.mga2
thunderbird-hy-24.1.0-1.mga2
thunderbird-id-24.1.0-1.mga2
thunderbird-is-24.1.0-1.mga2
thunderbird-it-24.1.0-1.mga2
thunderbird-ja-24.1.0-1.mga2
thunderbird-ko-24.1.0-1.mga2
thunderbird-lt-24.1.0-1.mga2
thunderbird-nb_NO-24.1.0-1.mga2
thunderbird-nl-24.1.0-1.mga2
thunderbird-nn_NO-24.1.0-1.mga2
thunderbird-pl-24.1.0-1.mga2
thunderbird-pa_IN-24.1.0-1.mga2
thunderbird-pt_BR-24.1.0-1.mga2
thunderbird-pt_PT-24.1.0-1.mga2
thunderbird-ro-24.1.0-1.mga2
thunderbird-ru-24.1.0-1.mga2
thunderbird-si-24.1.0-1.mga2
thunderbird-sk-24.1.0-1.mga2
thunderbird-sl-24.1.0-1.mga2
thunderbird-sq-24.1.0-1.mga2
thunderbird-sv_SE-24.1.0-1.mga2
thunderbird-ta_LK-24.1.0-1.mga2
thunderbird-tr-24.1.0-1.mga2
thunderbird-uk-24.1.0-1.mga2
thunderbird-vi-24.1.0-1.mga2
thunderbird-zh_CN-24.1.0-1.mga2
thunderbird-zh_TW-24.1.0-1.mga2
thunderbird-24.1.0-1.mga3
thunderbird-enigmail-24.1.0-1.mga3
nsinstall-24.1.0-1.mga3
thunderbird-ar-24.1.0-1.mga3
thunderbird-ast-24.1.0-1.mga3
thunderbird-be-24.1.0-1.mga3
thunderbird-bg-24.1.0-1.mga3
thunderbird-bn_BD-24.1.0-1.mga3
thunderbird-br-24.1.0-1.mga3
thunderbird-ca-24.1.0-1.mga3
thunderbird-cs-24.1.0-1.mga3
thunderbird-da-24.1.0-1.mga3
thunderbird-de-24.1.0-1.mga3
thunderbird-el-24.1.0-1.mga3
thunderbird-en_GB-24.1.0-1.mga3
thunderbird-es_AR-24.1.0-1.mga3
thunderbird-es_ES-24.1.0-1.mga3
thunderbird-et-24.1.0-1.mga3
thunderbird-eu-24.1.0-1.mga3
thunderbird-fi-24.1.0-1.mga3
thunderbird-fr-24.1.0-1.mga3
thunderbird-fy-24.1.0-1.mga3
thunderbird-ga-24.1.0-1.mga3
thunderbird-gd-24.1.0-1.mga3
thunderbird-gl-24.1.0-1.mga3
thunderbird-he-24.1.0-1.mga3
thunderbird-hr-24.1.0-1.mga3
thunderbird-hu-24.1.0-1.mga3
thunderbird-hy-24.1.0-1.mga3
thunderbird-id-24.1.0-1.mga3
thunderbird-is-24.1.0-1.mga3
thunderbird-it-24.1.0-1.mga3
thunderbird-ja-24.1.0-1.mga3
thunderbird-ko-24.1.0-1.mga3
thunderbird-lt-24.1.0-1.mga3
thunderbird-nb_NO-24.1.0-1.mga3
thunderbird-nl-24.1.0-1.mga3
thunderbird-nn_NO-24.1.0-1.mga3
thunderbird-pl-24.1.0-1.mga3
thunderbird-pa_IN-24.1.0-1.mga3
thunderbird-pt_BR-24.1.0-1.mga3
thunderbird-pt_PT-24.1.0-1.mga3
thunderbird-ro-24.1.0-1.mga3
thunderbird-ru-24.1.0-1.mga3
thunderbird-si-24.1.0-1.mga3
thunderbird-sk-24.1.0-1.mga3
thunderbird-sl-24.1.0-1.mga3
thunderbird-sq-24.1.0-1.mga3
thunderbird-sv_SE-24.1.0-1.mga3
thunderbird-ta_LK-24.1.0-1.mga3
thunderbird-tr-24.1.0-1.mga3
thunderbird-uk-24.1.0-1.mga3
thunderbird-vi-24.1.0-1.mga3
thunderbird-zh_CN-24.1.0-1.mga3
thunderbird-zh_TW-24.1.0-1.mga3

from SRPMS:
thunderbird-24.1.0-1.mga2.src.rpm
thunderbird-l10n-24.1.0-1.mga2.src.rpm
thunderbird-24.1.0-1.mga3.src.rpm
thunderbird-l10n-24.1.0-1.mga3.src.rpm

Summary: thunderbird 24esr update for stable => thunderbird update to 24esr (24.1.0) for stable

RedHat has issued an advisory on October 30:
https://rhn.redhat.com/errata/RHSA-2013-1480.html

Preliminary advisory for the Thunderbird update is below, but lightning probably has to be updated too.

Advisory:
========================

Updated thunderbird packages fix security vulnerabilities:

Several flaws were found in the processing of malformed content. Malicious
content could cause Thunderbird to crash or, potentially, execute arbitrary
code with the privileges of the user running Thunderbird (CVE-2013-5590,
CVE-2013-5597, CVE-2013-5599, CVE-2013-5600, CVE-2013-5601, CVE-2013-5602).

It was found that the Thunderbird JavaScript engine incorrectly allocated
memory for certain functions. An attacker could combine this flaw with
other vulnerabilities to execute arbitrary code with the privileges of the
user running Thunderbird (CVE-2013-5595).

A flaw was found in the way Thunderbird handled certain Extensible
Stylesheet Language Transformations (XSLT) files. An attacker could combine
this flaw with other vulnerabilities to execute arbitrary code with the
privileges of the user running Thunderbird (CVE-2013-5604).

References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5590
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5595
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5597
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5599
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5600
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5601
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5602
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5604
http://www.mozilla.org/security/announce/2013/mfsa2013-93.html
http://www.mozilla.org/security/announce/2013/mfsa2013-95.html
http://www.mozilla.org/security/announce/2013/mfsa2013-96.html
http://www.mozilla.org/security/announce/2013/mfsa2013-98.html
http://www.mozilla.org/security/announce/2013/mfsa2013-100.html
http://www.mozilla.org/security/announce/2013/mfsa2013-101.html
http://www.mozilla.org/security/known-vulnerabilities/thunderbird.html
https://rhn.redhat.com/errata/RHSA-2013-1480.html

CC'ing QA.  Feel free to test this now.  I was waiting to assign to QA until there was some clarity on the status of the lightning extension issues reported in Cauldron.  It may also need to be updated.

Preliminary advisory is in Comment 5, package list is in Comment 4.

CC: (none) => qa-bugs

(In reply to David Walser from comment #6)
> CC'ing QA.  Feel free to test this now.  I was waiting to assign to QA until
> there was some clarity on the status of the lightning extension issues
> reported in Cauldron.  It may also need to be updated.

Yes, we probably need to update Lightning to 2.6.2 for Thunderbird 24.1.0.
http://blog.mozilla.org/calendar/2013/10/dont-upgrade-to-thunderbird-24-0-1-yet
https://bugzilla.mozilla.org/show_bug.cgi?id=925823
https://addons.mozilla.org/thunderbird/addon/lightning/versions

(In reply to Luc Menut from comment #7)
> (In reply to David Walser from comment #6)
> > CC'ing QA.  Feel free to test this now.  I was waiting to assign to QA until
> > there was some clarity on the status of the lightning extension issues
> > reported in Cauldron.  It may also need to be updated.
> 
> Yes, we probably need to update Lightning to 2.6.2 for Thunderbird 24.1.0.
> http://blog.mozilla.org/calendar/2013/10/dont-upgrade-to-thunderbird-24-0-1-
> yet
> https://bugzilla.mozilla.org/show_bug.cgi?id=925823
> https://addons.mozilla.org/thunderbird/addon/lightning/versions

Thanks again Luc!

SVN logs show Funda has primarily been updating thunderbird-lightning, so I'm CC'ing Funda to ask for it to be updated to version 2.6.2 for Mageia 2 and Mageia 3.

CC: (none) => fundawang

(In reply to David Walser from comment #4)
> (In reply to Oden Eriksson from comment #21)
> > tb 24.1.0 has also been submitted.
> 
> Thanks Oden!  Hopefully things will get cleared up with lightning soon.
> 
> BTW, are FF/TB updated in SVN ready to push for Cauldron?

Yes.

Thanks again Oden.  I just sent a freeze push request to the dev ml for FF/TB.

I had actually a lightning update prepared for thunderbird 24.0.1
Once thunderbird 24.1.0 is available, I can prepare a new lightning update.

CC: (none) => mageia

Thunderbird 24.1.0 is now uploaded in Cauldron.  Lightning still needs to be updated to 1.6.2.

Whiteboard: (none) => MGA2TOO

Hi!

I encounter some problems with that update of thunderbird:

* a graphical bug:
when browsing a folder with the keyboard, if the selected line is a rolled thread (reps. single message) and I switch to a line that is a single message (resp. a rolled thread) all the lines bellow the newly selected one turned empty. I have to pass the cursor over them to make them reappear. It's a very annoying behaviour. (if it has any impact: I'm using xfce on a currently up-to-date mga2)


* Broken lightning:
this point is more about the update process of thunderbird in mga: lightning is rarely rebuild with new thunderbird (even on cauldron). Pushing it with thunderbird would have make appear the version problem. I had to uninstall the rpm and install manually the add-on to have my agenda back (it's my work computer, can't do with broken lightning)


Regards,
Claire

CC: (none) => grenoya

Olivier Blin has updated thunderbird-lightning to 2.6.2 in SVN and it is building for Mageia 2 and Mageia 3 right now.  Stay tuned.

Assigning to QA.

Advisory:
========================

Updated thunderbird packages fix security vulnerabilities:

Several flaws were found in the processing of malformed content. Malicious
content could cause Thunderbird to crash or, potentially, execute arbitrary
code with the privileges of the user running Thunderbird (CVE-2013-5590,
CVE-2013-5597, CVE-2013-5599, CVE-2013-5600, CVE-2013-5601, CVE-2013-5602).

It was found that the Thunderbird JavaScript engine incorrectly allocated
memory for certain functions. An attacker could combine this flaw with
other vulnerabilities to execute arbitrary code with the privileges of the
user running Thunderbird (CVE-2013-5595).

A flaw was found in the way Thunderbird handled certain Extensible
Stylesheet Language Transformations (XSLT) files. An attacker could combine
this flaw with other vulnerabilities to execute arbitrary code with the
privileges of the user running Thunderbird (CVE-2013-5604).

Also, the thunderbird-lightning extension has been updated to a version that
is compatible with the updated Thunderbird.

References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5590
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5595
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5597
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5599
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5600
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5601
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5602
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5604
http://www.mozilla.org/security/announce/2013/mfsa2013-93.html
http://www.mozilla.org/security/announce/2013/mfsa2013-95.html
http://www.mozilla.org/security/announce/2013/mfsa2013-96.html
http://www.mozilla.org/security/announce/2013/mfsa2013-98.html
http://www.mozilla.org/security/announce/2013/mfsa2013-100.html
http://www.mozilla.org/security/announce/2013/mfsa2013-101.html
http://www.mozilla.org/security/known-vulnerabilities/thunderbird.html
http://blog.mozilla.org/calendar/2013/10/dont-upgrade-to-thunderbird-24-0-1-yet
https://rhn.redhat.com/errata/RHSA-2013-1480.html
========================

Updated packages in core/updates_testing:
========================
thunderbird-24.1.0-1.mga2
thunderbird-enigmail-24.1.0-1.mga2
nsinstall-24.1.0-1.mga2
thunderbird-ar-24.1.0-1.mga2
thunderbird-ast-24.1.0-1.mga2
thunderbird-be-24.1.0-1.mga2
thunderbird-bg-24.1.0-1.mga2
thunderbird-bn_BD-24.1.0-1.mga2
thunderbird-br-24.1.0-1.mga2
thunderbird-ca-24.1.0-1.mga2
thunderbird-cs-24.1.0-1.mga2
thunderbird-da-24.1.0-1.mga2
thunderbird-de-24.1.0-1.mga2
thunderbird-el-24.1.0-1.mga2
thunderbird-en_GB-24.1.0-1.mga2
thunderbird-es_AR-24.1.0-1.mga2
thunderbird-es_ES-24.1.0-1.mga2
thunderbird-et-24.1.0-1.mga2
thunderbird-eu-24.1.0-1.mga2
thunderbird-fi-24.1.0-1.mga2
thunderbird-fr-24.1.0-1.mga2
thunderbird-fy-24.1.0-1.mga2
thunderbird-ga-24.1.0-1.mga2
thunderbird-gd-24.1.0-1.mga2
thunderbird-gl-24.1.0-1.mga2
thunderbird-he-24.1.0-1.mga2
thunderbird-hr-24.1.0-1.mga2
thunderbird-hu-24.1.0-1.mga2
thunderbird-hy-24.1.0-1.mga2
thunderbird-id-24.1.0-1.mga2
thunderbird-is-24.1.0-1.mga2
thunderbird-it-24.1.0-1.mga2
thunderbird-ja-24.1.0-1.mga2
thunderbird-ko-24.1.0-1.mga2
thunderbird-lt-24.1.0-1.mga2
thunderbird-nb_NO-24.1.0-1.mga2
thunderbird-nl-24.1.0-1.mga2
thunderbird-nn_NO-24.1.0-1.mga2
thunderbird-pl-24.1.0-1.mga2
thunderbird-pa_IN-24.1.0-1.mga2
thunderbird-pt_BR-24.1.0-1.mga2
thunderbird-pt_PT-24.1.0-1.mga2
thunderbird-ro-24.1.0-1.mga2
thunderbird-ru-24.1.0-1.mga2
thunderbird-si-24.1.0-1.mga2
thunderbird-sk-24.1.0-1.mga2
thunderbird-sl-24.1.0-1.mga2
thunderbird-sq-24.1.0-1.mga2
thunderbird-sv_SE-24.1.0-1.mga2
thunderbird-ta_LK-24.1.0-1.mga2
thunderbird-tr-24.1.0-1.mga2
thunderbird-uk-24.1.0-1.mga2
thunderbird-vi-24.1.0-1.mga2
thunderbird-zh_CN-24.1.0-1.mga2
thunderbird-zh_TW-24.1.0-1.mga2
thunderbird-lightning-2.6.2-1.mga2
thunderbird-24.1.0-1.mga3
thunderbird-enigmail-24.1.0-1.mga3
nsinstall-24.1.0-1.mga3
thunderbird-ar-24.1.0-1.mga3
thunderbird-ast-24.1.0-1.mga3
thunderbird-be-24.1.0-1.mga3
thunderbird-bg-24.1.0-1.mga3
thunderbird-bn_BD-24.1.0-1.mga3
thunderbird-br-24.1.0-1.mga3
thunderbird-ca-24.1.0-1.mga3
thunderbird-cs-24.1.0-1.mga3
thunderbird-da-24.1.0-1.mga3
thunderbird-de-24.1.0-1.mga3
thunderbird-el-24.1.0-1.mga3
thunderbird-en_GB-24.1.0-1.mga3
thunderbird-es_AR-24.1.0-1.mga3
thunderbird-es_ES-24.1.0-1.mga3
thunderbird-et-24.1.0-1.mga3
thunderbird-eu-24.1.0-1.mga3
thunderbird-fi-24.1.0-1.mga3
thunderbird-fr-24.1.0-1.mga3
thunderbird-fy-24.1.0-1.mga3
thunderbird-ga-24.1.0-1.mga3
thunderbird-gd-24.1.0-1.mga3
thunderbird-gl-24.1.0-1.mga3
thunderbird-he-24.1.0-1.mga3
thunderbird-hr-24.1.0-1.mga3
thunderbird-hu-24.1.0-1.mga3
thunderbird-hy-24.1.0-1.mga3
thunderbird-id-24.1.0-1.mga3
thunderbird-is-24.1.0-1.mga3
thunderbird-it-24.1.0-1.mga3
thunderbird-ja-24.1.0-1.mga3
thunderbird-ko-24.1.0-1.mga3
thunderbird-lt-24.1.0-1.mga3
thunderbird-nb_NO-24.1.0-1.mga3
thunderbird-nl-24.1.0-1.mga3
thunderbird-nn_NO-24.1.0-1.mga3
thunderbird-pl-24.1.0-1.mga3
thunderbird-pa_IN-24.1.0-1.mga3
thunderbird-pt_BR-24.1.0-1.mga3
thunderbird-pt_PT-24.1.0-1.mga3
thunderbird-ro-24.1.0-1.mga3
thunderbird-ru-24.1.0-1.mga3
thunderbird-si-24.1.0-1.mga3
thunderbird-sk-24.1.0-1.mga3
thunderbird-sl-24.1.0-1.mga3
thunderbird-sq-24.1.0-1.mga3
thunderbird-sv_SE-24.1.0-1.mga3
thunderbird-ta_LK-24.1.0-1.mga3
thunderbird-tr-24.1.0-1.mga3
thunderbird-uk-24.1.0-1.mga3
thunderbird-vi-24.1.0-1.mga3
thunderbird-zh_CN-24.1.0-1.mga3
thunderbird-zh_TW-24.1.0-1.mga3
thunderbird-lightning-2.6.2-1.mga3

from SRPMS:
thunderbird-24.1.0-1.mga2.src.rpm
thunderbird-l10n-24.1.0-1.mga2.src.rpm
thunderbird-lightning-2.6.2-1.mga2.src.rpm
thunderbird-24.1.0-1.mga3.src.rpm
thunderbird-l10n-24.1.0-1.mga3.src.rpm
thunderbird-lightning-2.6.2-1.mga3.src.rpm

CC: qa-bugs => (none)
Assignee: bugsquad => qa-bugs
Severity: normal => critical

Tested mga3-64

IMAP receive, move folders OK
Thunderbird loads and allows changing a google calendar through google calendar provider.
SMTP send OK

CC: (none) => wrw105
Whiteboard: MGA2TOO => MGA2TOO mga3-64-ok

tested as in comment 16 for mga3-32.

All OK

Whiteboard: MGA2TOO mga3-64-ok advisory => MGA2TOO mga3-64-ok advisory mga3-32-ok

Tested as in comment 16 for mga2-32.

All OK.

I don't have a mga2-64 setup due to lack of disk space, so if someone else can test that one, we'll be ready to go.

Whiteboard: MGA2TOO mga3-64-ok advisory mga3-32-ok => MGA2TOO mga3-64-ok advisory mga3-32-ok mga2-32-ok

Testing complete mga2 64

Validating. Advisory updated with lightning.

Could sysadmin please push from 2&3 core/updates_testing to updates

Thanks!

Keywords: (none) => validated_update
Whiteboard: MGA2TOO mga3-64-ok advisory mga3-32-ok mga2-32-ok => MGA2TOO mga3-64-ok advisory mga2-64-ok mga3-32-ok mga2-32-ok
CC: (none) => sysadmin-bugs

Update pushed:
http://advisories.mageia.org/MGASA-2013-0326.html

Status: NEW => RESOLVED
CC: (none) => tmb
Resolution: (none) => FIXED