MGASA-2020-0034 - Updated thunderbird packages fix security vulnerabilities

Publication date: 11 Jan 2020
URL: https://advisories.mageia.org/MGASA-2020-0034.html
Type: security
Affected Mageia releases: 7
CVE: CVE-2019-17016,
     CVE-2019-17017,
     CVE-2019-17022,
     CVE-2019-17024,
     CVE-2019-17026

Updated thunderbird packages fix security vulnerabilities:

Bypass of @namespace CSS sanitization during pasting (CVE-2019-17016)

Type Confusion in XPCVariant.cpp (CVE-2019-17017)

CSS sanitization does not escape HTML tags (CVE-2019-17022)

Memory safety bugs fixed in Thunderbird 68.4.1 (CVE-2019-17024)

IonMonkey type confusion with StoreElementHole and FallibleStoreElement
(CVE-2019-17026)

Enigmail has been updated to 2.15

References:
- https://bugs.mageia.org/show_bug.cgi?id=26047
- https://www.mozilla.org/en-US/security/advisories/mfsa2020-04/
- https://www.thunderbird.net/en-US/thunderbird/68.4.1/releasenotes/
- https://enigmail.net/index.php/en/download/changelog#enig2.1.5
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17016
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17017
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17022
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17024
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17026

SRPMS:
- 7/core/thunderbird-68.4.1-1.mga7
- 7/core/thunderbird-l10n-68.4.1-1.mga7