ALT-BU-2021-4110-2
Branch c9f2 update bulletin.
Package thunderbird updated to version 78.13.0-alt0.c9.1 for branch c9f2 in task 282405.
Closed vulnerabilities
Modified: 2024-09-13
BDU:2021-04068
Уязвимость браузера Mozilla Firefox, позволяющая нарушителю выполнить произвольный код в целевой системе
Modified: 2024-09-13
BDU:2021-04069
Уязвимость веб-браузеров Firefox, Firefox ESR, почтового клиента Thunderbird, связанная с возникновением конфликта интерпретаций, позволяющая нарушителю получить доступ к конфиденциальным данным, нарушить их целостность, а также вызвать отказ в обслуживании
Modified: 2024-09-13
BDU:2021-04070
Уязвимость браузера Mozilla Firefox, позволяющая нарушителю выполнить произвольный код в целевой системе
Modified: 2024-09-13
BDU:2021-04071
Уязвимость браузера Mozilla Firefox, позволяющая нарушителю выполнить произвольный код в целевой системе
Modified: 2024-09-13
BDU:2021-04072
Уязвимость метода MediaCacheStream::NotifyDataReceived почтового клиента Thunderbird, браузеров Firefox и Firefox ESR, позволяющая нарушителю выполнить произвольный код в целевой системе
Modified: 2024-04-03
BDU:2021-04073
Уязвимость браузера Mozilla Firefox, позволяющая нарушителю выполнить произвольный код в целевой системе
Modified: 2024-11-21
CVE-2021-29980
Uninitialized memory in a canvas object could have caused an incorrect free() leading to memory corruption and a potentially exploitable crash. This vulnerability affects Thunderbird < 78.13, Thunderbird < 91, Firefox ESR < 78.13, and Firefox < 91.
- https://bugzilla.mozilla.org/show_bug.cgi?id=1722204
- https://security.gentoo.org/glsa/202202-03
- https://security.gentoo.org/glsa/202208-14
- https://www.mozilla.org/security/advisories/mfsa2021-33/
- https://www.mozilla.org/security/advisories/mfsa2021-34/
- https://www.mozilla.org/security/advisories/mfsa2021-35/
- https://www.mozilla.org/security/advisories/mfsa2021-36/
- https://bugzilla.mozilla.org/show_bug.cgi?id=1722204
- https://security.gentoo.org/glsa/202202-03
- https://security.gentoo.org/glsa/202208-14
- https://www.mozilla.org/security/advisories/mfsa2021-33/
- https://www.mozilla.org/security/advisories/mfsa2021-34/
- https://www.mozilla.org/security/advisories/mfsa2021-35/
- https://www.mozilla.org/security/advisories/mfsa2021-36/
Modified: 2024-11-21
CVE-2021-29984
Instruction reordering resulted in a sequence of instructions that would cause an object to be incorrectly considered during garbage collection. This led to memory corruption and a potentially exploitable crash. This vulnerability affects Thunderbird < 78.13, Thunderbird < 91, Firefox ESR < 78.13, and Firefox < 91.
- https://bugzilla.mozilla.org/show_bug.cgi?id=1720031
- https://security.gentoo.org/glsa/202202-03
- https://security.gentoo.org/glsa/202208-14
- https://www.mozilla.org/security/advisories/mfsa2021-33/
- https://www.mozilla.org/security/advisories/mfsa2021-34/
- https://www.mozilla.org/security/advisories/mfsa2021-35/
- https://www.mozilla.org/security/advisories/mfsa2021-36/
- https://bugzilla.mozilla.org/show_bug.cgi?id=1720031
- https://security.gentoo.org/glsa/202202-03
- https://security.gentoo.org/glsa/202208-14
- https://www.mozilla.org/security/advisories/mfsa2021-33/
- https://www.mozilla.org/security/advisories/mfsa2021-34/
- https://www.mozilla.org/security/advisories/mfsa2021-35/
- https://www.mozilla.org/security/advisories/mfsa2021-36/
Modified: 2024-11-21
CVE-2021-29985
A use-after-free vulnerability in media channels could have led to memory corruption and a potentially exploitable crash. This vulnerability affects Thunderbird < 78.13, Thunderbird < 91, Firefox ESR < 78.13, and Firefox < 91.
- https://bugzilla.mozilla.org/show_bug.cgi?id=1722083
- https://security.gentoo.org/glsa/202202-03
- https://security.gentoo.org/glsa/202208-14
- https://www.mozilla.org/security/advisories/mfsa2021-33/
- https://www.mozilla.org/security/advisories/mfsa2021-34/
- https://www.mozilla.org/security/advisories/mfsa2021-35/
- https://www.mozilla.org/security/advisories/mfsa2021-36/
- https://bugzilla.mozilla.org/show_bug.cgi?id=1722083
- https://security.gentoo.org/glsa/202202-03
- https://security.gentoo.org/glsa/202208-14
- https://www.mozilla.org/security/advisories/mfsa2021-33/
- https://www.mozilla.org/security/advisories/mfsa2021-34/
- https://www.mozilla.org/security/advisories/mfsa2021-35/
- https://www.mozilla.org/security/advisories/mfsa2021-36/
Modified: 2024-11-21
CVE-2021-29986
A suspected race condition when calling getaddrinfo led to memory corruption and a potentially exploitable crash. *Note: This issue only affected Linux operating systems. Other operating systems are unaffected.* This vulnerability affects Thunderbird < 78.13, Thunderbird < 91, Firefox ESR < 78.13, and Firefox < 91.
- https://bugzilla.mozilla.org/show_bug.cgi?id=1696138
- https://security.gentoo.org/glsa/202202-03
- https://security.gentoo.org/glsa/202208-14
- https://www.mozilla.org/security/advisories/mfsa2021-33/
- https://www.mozilla.org/security/advisories/mfsa2021-34/
- https://www.mozilla.org/security/advisories/mfsa2021-35/
- https://www.mozilla.org/security/advisories/mfsa2021-36/
- https://bugzilla.mozilla.org/show_bug.cgi?id=1696138
- https://security.gentoo.org/glsa/202202-03
- https://security.gentoo.org/glsa/202208-14
- https://www.mozilla.org/security/advisories/mfsa2021-33/
- https://www.mozilla.org/security/advisories/mfsa2021-34/
- https://www.mozilla.org/security/advisories/mfsa2021-35/
- https://www.mozilla.org/security/advisories/mfsa2021-36/
Modified: 2024-11-21
CVE-2021-29988
Firefox incorrectly treated an inline list-item element as a block element, resulting in an out of bounds read or memory corruption, and a potentially exploitable crash. This vulnerability affects Thunderbird < 78.13, Thunderbird < 91, Firefox ESR < 78.13, and Firefox < 91.
- https://bugzilla.mozilla.org/show_bug.cgi?id=1717922
- https://security.gentoo.org/glsa/202202-03
- https://security.gentoo.org/glsa/202208-14
- https://www.mozilla.org/security/advisories/mfsa2021-33/
- https://www.mozilla.org/security/advisories/mfsa2021-34/
- https://www.mozilla.org/security/advisories/mfsa2021-35/
- https://www.mozilla.org/security/advisories/mfsa2021-36/
- https://bugzilla.mozilla.org/show_bug.cgi?id=1717922
- https://security.gentoo.org/glsa/202202-03
- https://security.gentoo.org/glsa/202208-14
- https://www.mozilla.org/security/advisories/mfsa2021-33/
- https://www.mozilla.org/security/advisories/mfsa2021-34/
- https://www.mozilla.org/security/advisories/mfsa2021-35/
- https://www.mozilla.org/security/advisories/mfsa2021-36/
Modified: 2024-11-21
CVE-2021-29989
Mozilla developers reported memory safety bugs present in Firefox 90 and Firefox ESR 78.12. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Thunderbird < 78.13, Firefox ESR < 78.13, and Firefox < 91.
- https://bugzilla.mozilla.org/buglist.cgi?bug_id=1662676%2C1666184%2C1719178%2C1719998%2C1720568
- https://security.gentoo.org/glsa/202202-03
- https://security.gentoo.org/glsa/202208-14
- https://www.mozilla.org/security/advisories/mfsa2021-33/
- https://www.mozilla.org/security/advisories/mfsa2021-34/
- https://www.mozilla.org/security/advisories/mfsa2021-35/
- https://bugzilla.mozilla.org/buglist.cgi?bug_id=1662676%2C1666184%2C1719178%2C1719998%2C1720568
- https://security.gentoo.org/glsa/202202-03
- https://security.gentoo.org/glsa/202208-14
- https://www.mozilla.org/security/advisories/mfsa2021-33/
- https://www.mozilla.org/security/advisories/mfsa2021-34/
- https://www.mozilla.org/security/advisories/mfsa2021-35/
Closed vulnerabilities
Modified: 2024-09-16
BDU:2021-03234
Уязвимость почтового сервера Dovecot, связанная с ошибками экранирования полей kid и azp в токенах JWT, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации
BDU:2021-03235
Уязвимость почтового сервера Dovecot, связанная с ошибками управления ресурсами, позволяющая нарушителю вызвать отказ в обслуживании
Modified: 2024-09-16
BDU:2021-03236
Уязвимость почтового сервера Dovecot, связанная с неверной нейтрализация особых элементов в выходных данных, используемых входящим компонентом, позволяющая нарушителю раскрыть учетные данные пользователей
Modified: 2024-11-21
CVE-2020-28200
The Sieve engine in Dovecot before 2.3.15 allows Uncontrolled Resource Consumption, as demonstrated by a situation with a complex regular expression for the regex extension.
- https://dovecot.org/security
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JB2VTJ3G2ILYWH5Y2FTY2PUHT2MD6VMI/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TK424DWFO2TKJYXZ2H3XL633TYJL4GQN/
- https://www.openwall.com/lists/oss-security/2021/06/28/3
- https://dovecot.org/security
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JB2VTJ3G2ILYWH5Y2FTY2PUHT2MD6VMI/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TK424DWFO2TKJYXZ2H3XL633TYJL4GQN/
- https://www.openwall.com/lists/oss-security/2021/06/28/3
Modified: 2024-11-21
CVE-2021-29157
Dovecot before 2.3.15 allows ../ Path Traversal. An attacker with access to the local filesystem can trick OAuth2 authentication into using an HS256 validation key from an attacker-controlled location. This occurs during use of local JWT validation with the posix fs driver.
- https://dovecot.org/security
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JB2VTJ3G2ILYWH5Y2FTY2PUHT2MD6VMI/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TK424DWFO2TKJYXZ2H3XL633TYJL4GQN/
- https://security.gentoo.org/glsa/202107-41
- https://www.openwall.com/lists/oss-security/2021/06/28/1
- https://dovecot.org/security
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JB2VTJ3G2ILYWH5Y2FTY2PUHT2MD6VMI/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TK424DWFO2TKJYXZ2H3XL633TYJL4GQN/
- https://security.gentoo.org/glsa/202107-41
- https://www.openwall.com/lists/oss-security/2021/06/28/1
Modified: 2024-11-21
CVE-2021-33515
The submission service in Dovecot before 2.3.15 allows STARTTLS command injection in lib-smtp. Sensitive information can be redirected to an attacker-controlled address.
- https://dovecot.org/security
- https://lists.debian.org/debian-lts-announce/2022/09/msg00032.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JB2VTJ3G2ILYWH5Y2FTY2PUHT2MD6VMI/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TK424DWFO2TKJYXZ2H3XL633TYJL4GQN/
- https://security.gentoo.org/glsa/202107-41
- https://www.openwall.com/lists/oss-security/2021/06/28/2
- https://dovecot.org/security
- https://lists.debian.org/debian-lts-announce/2022/09/msg00032.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JB2VTJ3G2ILYWH5Y2FTY2PUHT2MD6VMI/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TK424DWFO2TKJYXZ2H3XL633TYJL4GQN/
- https://security.gentoo.org/glsa/202107-41
- https://www.openwall.com/lists/oss-security/2021/06/28/2
