Bug 23706 - Thunderbird 60.3.3
Summary: Thunderbird 60.3.3
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 6
Hardware: All Linux
Priority: Normal critical
Target Milestone: ---
Assignee: QA Team
QA Contact: Sec team
URL:
Whiteboard: MGA6-32-OK MGA6-64-OK
Keywords: advisory, validated_update
Depends on: 23972
Blocks:
  Show dependency treegraph
 
Reported: 2018-10-16 00:53 CEST by David Walser
Modified: 2018-12-15 22:30 CET (History)
13 users (show)

See Also:
Source RPM: thunderbird
CVE:
Status comment:


Attachments

Description David Walser 2018-10-16 00:53:38 CEST
Thunderbird needs to be updated to the newest ESR:
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/PYTS5TYUTOHXUEHAMWAPR733KZZ6L5Q4/
Comment 1 José Jorge 2018-10-16 17:47:27 CEST
Sorry but I just could not manage to build the lightning part. Let's see if other packagers manage?

CC: (none) => lists.jjorge
Assignee: lists.jjorge => bugsquad

Comment 2 Marja Van Waes 2018-10-16 19:54:51 CEST
(In reply to José Jorge from comment #1)
> Sorry but I just could not manage to build the lightning part. Let's see if
> other packagers manage?

Thanks for your effort!

Maybe the registered maintainer can give a hand? Assigning to him, but CC'ing all packagers collectively.

Assignee: bugsquad => doktor5000
CC: (none) => marja11, pkg-bugs

Comment 3 David Walser 2018-10-26 18:48:10 CEST
Debian has issued an advisory for this on October 25:
https://www.debian.org/security/2018/dsa-4327
Comment 4 David Walser 2018-11-02 21:44:25 CET
Thunderbird 60.3.0 has been released on October 31:
https://www.thunderbird.net/en-US/thunderbird/60.3.0/releasenotes/

Summary: Thunderbird 60.2.1 => Thunderbird 60.3.0

Comment 5 David Walser 2018-11-05 16:01:32 CET
RedHat has issued an advisory for 60.2.1 today (November 5):
https://access.redhat.com/errata/RHSA-2018:3458
Comment 6 José Jorge 2018-11-06 20:45:08 CET
I could build 60.3.0 version in cauldron, without calendar and enigmail.
Enigmail can be added through Addons, but Calendar is still available only for 52.x versions in Addons... I will try to investigate further.

Status: NEW => ASSIGNED

Comment 7 David Walser 2018-11-08 18:36:27 CET
openSUSE has issued an advisory for 60.3.0 on November 7:
https://lists.opensuse.org/opensuse-updates/2018-11/msg00009.html
Comment 8 David Walser 2018-11-08 19:47:22 CET
Fedora has issued an advisory for Thunderbird 60.3.0 on November 5:
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/BBYVAVUBLEYSURJAP3UGQMFPDOG2AE3U/
Comment 9 Kristoffer Grundström 2018-11-09 06:39:32 CET
(In reply to David Walser from comment #8)
> Fedora has issued an advisory for Thunderbird 60.3.0 on November 5:
> https://lists.fedoraproject.org/archives/list/package-announce@lists.
> fedoraproject.org/thread/BBYVAVUBLEYSURJAP3UGQMFPDOG2AE3U/

Firefox 60.3.0 is already in Cauldron.

http://ftp.acc.umu.se/mirror/mageia/distrib/cauldron/SRPMS/core/release/firefox-63.0.1-1.mga7.src.rpm

CC: (none) => hamnisdude

Comment 10 David Walser 2018-11-09 18:09:48 CET
RedHat has issued an advisory for Thunderbird 60.3.0 on November 8:
https://access.redhat.com/errata/RHSA-2018:3532

Version: Cauldron => 6

Comment 11 Sébastien Morin 2018-11-14 19:18:26 CET
(In reply to Kristoffer Grundström from comment #9)
> Firefox 60.3.0 is already in Cauldron.
> 
> http://ftp.acc.umu.se/mirror/mageia/distrib/cauldron/SRPMS/core/release/
> firefox-63.0.1-1.mga7.src.rpm

Many French users are reporting (on MLO forums) that Thunderbird is still in English, despite thunderbird-fr-60.3.0-1.mga7.noarch being already installed.

CC: (none) => sebsweb

Comment 12 David Walser 2018-11-15 00:01:19 CET
Debian has issued an advisory for this on November 10:
https://www.debian.org/security/2018/dsa-4337
Comment 13 katnatek 2018-11-15 19:10:28 CET
Adding bug#23818 to see also due comment #11

See Also: (none) => https://bugs.mageia.org/show_bug.cgi?id=23818

Comment 14 David Walser 2018-11-16 21:39:17 CET
Thunderbird 60.3.1 has been released on November 15:
https://www.thunderbird.net/en-US/thunderbird/60.3.1/releasenotes/

Summary: Thunderbird 60.3.0 => Thunderbird 60.3.1

Comment 15 José Jorge 2018-11-18 09:49:59 CET
Pushed to cauldron. 60.3.1-1 package disables system sqlite and allows global search again.
Comment 16 David Walser 2018-11-30 15:04:10 CET
Thunderbird 60.3.2 has been released today (November 30):
https://www.thunderbird.net/en-US/thunderbird/60.3.2/releasenotes/

Summary: Thunderbird 60.3.1 => Thunderbird 60.3.2

Comment 17 David Walser 2018-12-06 12:45:20 CET
Thunderbird 60.3.3 has been released on December 5:
https://www.thunderbird.net/en-US/thunderbird/60.3.3/releasenotes/

Summary: Thunderbird 60.3.2 => Thunderbird 60.3.3

Nicolas Salguero 2018-12-09 10:18:17 CET

Depends on: (none) => 23956

Comment 18 David Walser 2018-12-10 21:31:52 CET
Looks like it's built:
thunderbird-60.3.3-2.mga6
thunderbird-enigmail-60.3.3-2.mga6
thunderbird-ar-60.3.3-1.mga6
thunderbird-ast-60.3.3-1.mga6
thunderbird-be-60.3.3-1.mga6
thunderbird-bg-60.3.3-1.mga6
thunderbird-br-60.3.3-1.mga6
thunderbird-ca-60.3.3-1.mga6
thunderbird-cs-60.3.3-1.mga6
thunderbird-cy-60.3.3-1.mga6
thunderbird-da-60.3.3-1.mga6
thunderbird-de-60.3.3-1.mga6
thunderbird-el-60.3.3-1.mga6
thunderbird-en_GB-60.3.3-1.mga6
thunderbird-en_US-60.3.3-1.mga6
thunderbird-es_AR-60.3.3-1.mga6
thunderbird-es_ES-60.3.3-1.mga6
thunderbird-et-60.3.3-1.mga6
thunderbird-eu-60.3.3-1.mga6
thunderbird-fi-60.3.3-1.mga6
thunderbird-fr-60.3.3-1.mga6
thunderbird-fy_NL-60.3.3-1.mga6
thunderbird-ga_IE-60.3.3-1.mga6
thunderbird-gd-60.3.3-1.mga6
thunderbird-gl-60.3.3-1.mga6
thunderbird-he-60.3.3-1.mga6
thunderbird-hr-60.3.3-1.mga6
thunderbird-hsb-60.3.3-1.mga6
thunderbird-hu-60.3.3-1.mga6
thunderbird-hy_AM-60.3.3-1.mga6
thunderbird-id-60.3.3-1.mga6
thunderbird-is-60.3.3-1.mga6
thunderbird-it-60.3.3-1.mga6
thunderbird-ja-60.3.3-1.mga6
thunderbird-ko-60.3.3-1.mga6
thunderbird-lt-60.3.3-1.mga6
thunderbird-nb_NO-60.3.3-1.mga6
thunderbird-nl-60.3.3-1.mga6
thunderbird-nn_NO-60.3.3-1.mga6
thunderbird-pl-60.3.3-1.mga6
thunderbird-pt_BR-60.3.3-1.mga6
thunderbird-pt_PT-60.3.3-1.mga6
thunderbird-ro-60.3.3-1.mga6
thunderbird-ru-60.3.3-1.mga6
thunderbird-si-60.3.3-1.mga6
thunderbird-sk-60.3.3-1.mga6
thunderbird-sl-60.3.3-1.mga6
thunderbird-sq-60.3.3-1.mga6
thunderbird-sv_SE-60.3.3-1.mga6
thunderbird-tr-60.3.3-1.mga6
thunderbird-uk-60.3.3-1.mga6
thunderbird-vi-60.3.3-1.mga6
thunderbird-zh_CN-60.3.3-1.mga6

from SRPMS:
thunderbird-60.3.3-2.mga6.src.rpm
thunderbird-l10n-60.3.3-1.mga6.src.rpm
Comment 19 Nicolas Salguero 2018-12-11 09:44:17 CET
Hi,

I found that thunderbird-60.3.3-2.mga6 (and thunderbird-60.3.3-3.mga7 too) does not use system dictionaries so here is an updated list of packages:

thunderbird-60.3.3-3.mga6
thunderbird-enigmail-60.3.3-3.mga6
thunderbird-ar-60.3.3-1.mga6
thunderbird-ast-60.3.3-1.mga6
thunderbird-be-60.3.3-1.mga6
thunderbird-bg-60.3.3-1.mga6
thunderbird-br-60.3.3-1.mga6
thunderbird-ca-60.3.3-1.mga6
thunderbird-cs-60.3.3-1.mga6
thunderbird-cy-60.3.3-1.mga6
thunderbird-da-60.3.3-1.mga6
thunderbird-de-60.3.3-1.mga6
thunderbird-el-60.3.3-1.mga6
thunderbird-en_GB-60.3.3-1.mga6
thunderbird-en_US-60.3.3-1.mga6
thunderbird-es_AR-60.3.3-1.mga6
thunderbird-es_ES-60.3.3-1.mga6
thunderbird-et-60.3.3-1.mga6
thunderbird-eu-60.3.3-1.mga6
thunderbird-fi-60.3.3-1.mga6
thunderbird-fr-60.3.3-1.mga6
thunderbird-fy_NL-60.3.3-1.mga6
thunderbird-ga_IE-60.3.3-1.mga6
thunderbird-gd-60.3.3-1.mga6
thunderbird-gl-60.3.3-1.mga6
thunderbird-he-60.3.3-1.mga6
thunderbird-hr-60.3.3-1.mga6
thunderbird-hsb-60.3.3-1.mga6
thunderbird-hu-60.3.3-1.mga6
thunderbird-hy_AM-60.3.3-1.mga6
thunderbird-id-60.3.3-1.mga6
thunderbird-is-60.3.3-1.mga6
thunderbird-it-60.3.3-1.mga6
thunderbird-ja-60.3.3-1.mga6
thunderbird-ko-60.3.3-1.mga6
thunderbird-lt-60.3.3-1.mga6
thunderbird-nb_NO-60.3.3-1.mga6
thunderbird-nl-60.3.3-1.mga6
thunderbird-nn_NO-60.3.3-1.mga6
thunderbird-pl-60.3.3-1.mga6
thunderbird-pt_BR-60.3.3-1.mga6
thunderbird-pt_PT-60.3.3-1.mga6
thunderbird-ro-60.3.3-1.mga6
thunderbird-ru-60.3.3-1.mga6
thunderbird-si-60.3.3-1.mga6
thunderbird-sk-60.3.3-1.mga6
thunderbird-sl-60.3.3-1.mga6
thunderbird-sq-60.3.3-1.mga6
thunderbird-sv_SE-60.3.3-1.mga6
thunderbird-tr-60.3.3-1.mga6
thunderbird-uk-60.3.3-1.mga6
thunderbird-vi-60.3.3-1.mga6
thunderbird-zh_CN-60.3.3-1.mga6

from SRPMS:
thunderbird-60.3.3-3.mga6.src.rpm
thunderbird-l10n-60.3.3-1.mga6.src.rpm

Given the difficulties to build thunderbird 60 (for instance, the fact that i586 is built with clang in place of gcc to avoid bug 23956, the changes in enigmail packaging...), I think thunderbird 60, enigmail and spell checking should be carefully tested under both i586 and x86_64.

CC: (none) => nicolas.salguero

Nicolas Salguero 2018-12-11 09:47:50 CET

Depends on: (none) => 23972

Comment 20 Nicolas Salguero 2018-12-11 10:25:44 CET
Suggested advisory:
========================

The updated packages fix several bugs and some security issues:

- Buffer overflow using computed size of canvas element. (CVE-2018-12359)

- Use-after-free when using focus(). (CVE-2018-12360)

- Integer overflow in SwizzleData. (CVE-2018-12361)

- Integer overflow in SSSE3 scaler. (CVE-2018-12362)

- Media recorder segmentation fault when track type is changed during capture. (CVE-2018-5156)

- Use-after-free when appending DOM nodes. (CVE-2018-12363)

- CSRF attacks through 307 redirects and NPAPI plugins. (CVE-2018-12364)

- Compromised IPC child process can list local filenames. (CVE-2018-12365)

- Integer overflow in Skia library during edge builder allocation. (CVE-2018-12371)

- Invalid data handling during QCMS transformations. (CVE-2018-12366)

- Timing attack mitigation of PerformanceNavigationTiming. (CVE-2018-12367)

- No warning when opening executable SettingContent-ms files. (CVE-2018-12368)

- Memory safety bugs fixed in Firefox 61, Firefox ESR 60.1, and Thunderbird 60. (CVE-2018-5187)

- Memory safety bugs fixed in Firefox 61, Firefox ESR 60.1, Firefox ESR 52.9, and Thunderbird 60. (CVE-2018-5188)

- Use-after-free in refresh driver timers. (CVE-2018-12377)

- Use-after-free in IndexedDB. (CVE-2018-12378)

- Out-of-bounds write with malicious MAR file. (CVE-2018-12379)

- Proxy bypass using automount and autofs. (CVE-2017-16541)

- Crash in TransportSecurityInfo due to cached data. (CVE-2018-12385)

- Setting a master password post-Firefox 58 does not delete unencrypted previously stored passwords. (CVE-2018-12383)

- Memory safety bugs fixed in Firefox 62, Firefox ESR 60.2, and Thunderbird 60.2.1. (CVE-2018-12376)

- HTTP Live Stream audio data is accessible cross-origin. (CVE-2018-12391)

- Crash with nested event loops. (CVE-2018-12392)

- Integer overflow during Unicode conversion while loading JavaScript. (CVE-2018-12393)

- Memory safety bugs fixed in Firefox ESR 60.3 and Thunderbird 60.3. (CVE-2018-12389)

- Memory safety bugs fixed in Firefox 63, Firefox ESR 60.3, and Thunderbird 60.3. (CVE-2018-12390)

References:
========================
https://www.thunderbird.net/en-US/thunderbird/60.3.0/releasenotes/
https://www.thunderbird.net/en-US/thunderbird/60.3.1/releasenotes/
https://www.thunderbird.net/en-US/thunderbird/60.3.2/releasenotes/
https://www.thunderbird.net/en-US/thunderbird/60.3.3/releasenotes/
https://www.mozilla.org/en-US/security/advisories/mfsa2018-19/
https://www.mozilla.org/en-US/security/advisories/mfsa2018-25/
https://www.mozilla.org/en-US/security/advisories/mfsa2018-28/
https://www.debian.org/security/2018/dsa-4327
https://access.redhat.com/errata/RHSA-2018:3458
https://lists.opensuse.org/opensuse-updates/2018-11/msg00009.html
https://access.redhat.com/errata/RHSA-2018:3532
https://www.debian.org/security/2018/dsa-4337
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-12359
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-12360
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-12361
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-12362
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5156
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-12363
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-12364
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-12365
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-12371
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-12366
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-12367
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-12368
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5187
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5188
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-12377
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-12378
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-12379
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-16541
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-12385
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-12383
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-12376
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-12391
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-12392
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-12393
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-12389
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-12390

Updated packages in core/updates_testing:
========================
thunderbird-60.3.3-3.mga6
thunderbird-enigmail-60.3.3-3.mga6
thunderbird-ar-60.3.3-1.mga6
thunderbird-ast-60.3.3-1.mga6
thunderbird-be-60.3.3-1.mga6
thunderbird-bg-60.3.3-1.mga6
thunderbird-br-60.3.3-1.mga6
thunderbird-ca-60.3.3-1.mga6
thunderbird-cs-60.3.3-1.mga6
thunderbird-cy-60.3.3-1.mga6
thunderbird-da-60.3.3-1.mga6
thunderbird-de-60.3.3-1.mga6
thunderbird-el-60.3.3-1.mga6
thunderbird-en_GB-60.3.3-1.mga6
thunderbird-en_US-60.3.3-1.mga6
thunderbird-es_AR-60.3.3-1.mga6
thunderbird-es_ES-60.3.3-1.mga6
thunderbird-et-60.3.3-1.mga6
thunderbird-eu-60.3.3-1.mga6
thunderbird-fi-60.3.3-1.mga6
thunderbird-fr-60.3.3-1.mga6
thunderbird-fy_NL-60.3.3-1.mga6
thunderbird-ga_IE-60.3.3-1.mga6
thunderbird-gd-60.3.3-1.mga6
thunderbird-gl-60.3.3-1.mga6
thunderbird-he-60.3.3-1.mga6
thunderbird-hr-60.3.3-1.mga6
thunderbird-hsb-60.3.3-1.mga6
thunderbird-hu-60.3.3-1.mga6
thunderbird-hy_AM-60.3.3-1.mga6
thunderbird-id-60.3.3-1.mga6
thunderbird-is-60.3.3-1.mga6
thunderbird-it-60.3.3-1.mga6
thunderbird-ja-60.3.3-1.mga6
thunderbird-ko-60.3.3-1.mga6
thunderbird-lt-60.3.3-1.mga6
thunderbird-nb_NO-60.3.3-1.mga6
thunderbird-nl-60.3.3-1.mga6
thunderbird-nn_NO-60.3.3-1.mga6
thunderbird-pl-60.3.3-1.mga6
thunderbird-pt_BR-60.3.3-1.mga6
thunderbird-pt_PT-60.3.3-1.mga6
thunderbird-ro-60.3.3-1.mga6
thunderbird-ru-60.3.3-1.mga6
thunderbird-si-60.3.3-1.mga6
thunderbird-sk-60.3.3-1.mga6
thunderbird-sl-60.3.3-1.mga6
thunderbird-sq-60.3.3-1.mga6
thunderbird-sv_SE-60.3.3-1.mga6
thunderbird-tr-60.3.3-1.mga6
thunderbird-uk-60.3.3-1.mga6
thunderbird-vi-60.3.3-1.mga6
thunderbird-zh_CN-60.3.3-1.mga6

from SRPMS:
thunderbird-60.3.3-3.mga6.src.rpm
thunderbird-l10n-60.3.3-1.mga6.src.rpm
Nicolas Salguero 2018-12-11 10:26:14 CET

Assignee: doktor5000 => qa-bugs

Comment 21 Morgan Leijström 2018-12-11 10:36:24 CET
OK here with possible quirk: needed logout-login?

Testing on 64 bit, plasma, swedish

I closed old thunderbird, let it upgrade, and launched it again from konsole and  it put out some warnings:

(thunderbird:7582): Gtk-WARNING **: Theme parsing error: <data>:1:34: Expected ')' in color definition

(thunderbird:7582): Gtk-WARNING **: Theme parsing error: <data>:1:77: Expected ')' in color definition

But no window nor password dialog showed up!

I closed it in konsole by Ctrl-C, no problem.

Rebooted system and 60.3.3-1 launch normally: main window appear, and a popup asking for main password, i enter it and all is OK. 
It also works normally with local, IMAP and offline IMAP, SMTP, total many thousands of mails.  Search and filter works incl swedish characters.

I will keep using it in production and report any issue.

Why did it need reboot after update? (More specifically i guess it needed a DE (plasma) logout/login)
Could be some DE issue, the system is a continuous update from mga4 with periods of cauldron before mga6 release and is since a while running all updates in testing and do have some quirk sometimes but never failed me completely :)

CC: (none) => fri

Comment 22 Morgan Leijström 2018-12-11 10:43:58 CET
Tested version thunderbird 60.3.3-2.mga6
Will update whenever newer is available.
Comment 23 Morgan Leijström 2018-12-11 13:46:19 CET
64 bit version 60.3.3-3

I see no regressions in operation from 60.3.3-2, see comment 21

However:

1) Interface language
Now the interface is in english despite thunderbird-sv_SE 60.3.3-1 being installed.  Weirdly the menu "Events and Tasks" (guessing the english name) which appear to be new in 60.x *is* in swedish - even when i do *not* have thunderbird-sv_SE installed ?!


2) update quirk:

Using mgaapplet, on updating from 60.3.3-2 : file /usr/lib64/thunderbird/dictionaries from thunderbird-0:60.3.3-3.mga6.x86_64 conflicts the file from thunderbird-0:60.3.3-2.mga6.x86_64

Would a user experince this conflict on updating when released?

Then using rpmdrake i uninstalled 60.3.3-2 (which also uninstalled thunderbird-servicemenu and later reinstalled) and then i installed thunderbird 60.3.3-3 and thunderbird-sv_SE 60.3.3-1, cleanly.
Comment 24 Herman Viaene 2018-12-11 15:55:11 CET
MGA6-32 MATE on IBM Thinkpad R50e
No installation issues, updating an existing previous version. Language Dutch is OK.
Launched Thunderbird from CLI and got same messages as per Comment 21, but Thunderbird came up OK.
gmail asks for password OK. I cound send mail with attachment to other account on my desktop PC and receive answer back.
Good for me.

CC: (none) => herman.viaene
Whiteboard: (none) => MGA6-32-OK

Comment 25 Thomas Andrews 2018-12-11 17:02:30 CET
Updated the US English version 52.9.1-1.1 of this, nss (bug 23972), and Firefox (bug 23991) all at the same time, as I believe them to be related even if dependencies aren't stated. 52.9.1-1.1 is the version that is "current" for users that haven't been involved in testing Thunderbird, which should be the vast majority of them. I used QA Repo for the task, and there were no conflicts reported. All packages installed cleanly.

When I started Thunderbird from the Plasma desktop icon, a popup appeared asking me about makiing Thunderbird the default application for email, newsgroups, and "feeds." Email was selected, but not the others. I selected "newsgroups" as well, and closed it. Thunderbird went on to check my email accounts and automatically download all unread messages, as usual. Sent and received an email to myself using two different accounts. Closed and reopened it, and this time it did not ask about defaults.

I don't use the calendar, never have, so I can't really check on it. Same thing for enigmail. giving this atentative 64-bit OK for now, but someone really ought to check the calendar and enigmail.

Considering all the bugs that this version addresses, and because it is listed as a critical security update, I have decided to validate even with the relatively minor Swedish language issue (Comment 23) and without the calendar and enigmail tests. However, if others believe that is premature, please advise.

Suggested advisory in Comment 20.

Keywords: (none) => validated_update
Whiteboard: MGA6-32-OK => MGA6-32-OK MGA6-64-OK
CC: (none) => andrewsfarm, sysadmin-bugs

Comment 26 James Kerr 2018-12-11 17:55:21 CET
After installing this update:
thunderbird-en_GB-60.3.3-1.mga6.noarch 
thunderbird-60.3.3-3.mga6.x86_64        


My calendar is available and seems to be fully functional

I don't use enigmail

CC: (none) => jim

Comment 27 José Jorge 2018-12-11 19:29:39 CET
(In reply to James Kerr from comment #26)
> My calendar is available and seems to be fully functional

I use 2 profiles in thunderbird. In one, calendar worked directly. In the second, the extension was not listed. 

Following this information :
https://support.mozilla.org/fr/questions/1211583#answer-1127851

I could fix it installing for the modules menu the file
/usr/lib64/thunderbird/distribution/extensions/{e2fda1a4-762b-4020-b5ad-a41df1933103}.xpi

So this information should go to the advisory to help end users.

Ok to validate, a big thanks to Nicolas who could fix my mess!
Comment 28 Morgan Leijström 2018-12-11 19:58:51 CET
For security reasons i think it is time to ship now.

But continue to investigate localisation and push update to fix that later.

Anyone else than me tried any other menu language than english?
Comment 29 José Jorge 2018-12-12 07:35:48 CET
(In reply to Morgan Leijström from comment #28)
> For security reasons i think it is time to ship now.
Agreed. But it looks like this update has some more RPMS : testing with a i586 system it also pulled from testing  the following RPMS :

libnss3-3.3.6-1
libatomic1-5.5.0-2

> Anyone else than me tried any other menu language than english?

Yes, I tried french and portuguese. No bug in my tries...
Comment 30 Herman Viaene 2018-12-12 08:41:36 CET
Language: see my Comment 24
And at Jorge's remark: I noticed a dependency of Firefox 60.4 on libnss3-3.36.6, so it is no surprise that Thunderbird would do the same. I didn't notice because I tested Thunderbird after the tests of nss and Firefox.
Comment 31 Nicolas Salguero 2018-12-12 11:01:22 CET
(In reply to José Jorge from comment #29)
> (In reply to Morgan Leijström from comment #28)
> > For security reasons i think it is time to ship now.
> Agreed. But it looks like this update has some more RPMS : testing with a
> i586 system it also pulled from testing  the following RPMS :
> 
> libnss3-3.3.6-1
> libatomic1-5.5.0-2

For libatomic1, in my i586 Mga6 Virtualbox VM, it only needed libatomic1-5.5.0-1, which is already in updates.
Comment 32 Thomas Backlund 2018-12-12 13:39:29 CET
libnss3-3.3.6-1 is part of Bug 23972 that will go out at the same time

CC: (none) => tmb

Comment 33 Thomas Backlund 2018-12-12 13:40:20 CET
That would be libnss3-3.36.6-1.mga6
Comment 34 Thomas Andrews 2018-12-12 15:49:27 CET
(In reply to Nicolas Salguero from comment #31)
> (In reply to José Jorge from comment #29)
> > (In reply to Morgan Leijström from comment #28)
> > > For security reasons i think it is time to ship now.
> > Agreed. But it looks like this update has some more RPMS : testing with a
> > i586 system it also pulled from testing  the following RPMS :
> > 
> > libnss3-3.3.6-1
> > libatomic1-5.5.0-2
> 
> For libatomic1, in my i586 Mga6 Virtualbox VM, it only needed
> libatomic1-5.5.0-1, which is already in updates.

I can explain this one. When Morgan tested, he of course had the various updates_testing repos activated. For libatomic1, libatomic1-5.5.0-2 is in Core Updates_testing, so it was automatically selected over the lower version number in Updates. 

Apparently, if the higher version isn't available in the active repos, as would be the case for most of our users, the lower one will do for purposes of this update.
Comment 35 Thomas Andrews 2018-12-12 16:04:59 CET
(In reply to Herman Viaene from comment #30)
> Language: see my Comment 24
> And at Jorge's remark: I noticed a dependency of Firefox 60.4 on
> libnss3-3.36.6, so it is no surprise that Thunderbird would do the same. I
> didn't notice because I tested Thunderbird after the tests of nss and
> Firefox.

I suspected as much, which is why I updated the packages from three bugs (Firefox, nss, and Thunderbird) at the same time. 

Just a note for future reference: It would be less confusing to QA if such dependencies were noted somewhere in the bug report, as they were for Firefox in bug 23991.
Comment 36 Lewis Smith 2018-12-15 21:19:05 CET
What a lot of testing! Thanks to everybody. Advisory from comment 1.

CC: (none) => lewyssmith
Keywords: (none) => advisory

Thomas Backlund 2018-12-15 21:59:50 CET

Depends on: 23956 => (none)

Comment 37 Morgan Leijström 2018-12-15 22:15:57 CET
OK: I had no problem at all now updating on my wifes Laptop (like i had in comment 23)
Comment 38 Mageia Robot 2018-12-15 22:30:46 CET
An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2018-0480.html

Resolution: (none) => FIXED
Status: ASSIGNED => RESOLVED


Note You need to log in before you can comment on or make changes to this bug.