Synopsis:          Important: thunderbird security update
Advisory ID:       SLSA-2023:0817-1
Issue Date:        2023-02-20
CVE Numbers:       CVE-2023-25728
                   CVE-2023-25730
                   CVE-2023-25743
                   CVE-2023-0767
                   CVE-2023-25735
                   CVE-2023-25737
                   CVE-2023-25739
                   CVE-2023-25729
                   CVE-2023-25732
                   CVE-2023-25742
                   CVE-2023-25744
                   CVE-2023-25746
                   CVE-2023-0616
--

This update upgrades Thunderbird to version 102.8.0.

Security Fix(es):

* Mozilla: Arbitrary memory write via PKCS 12 in NSS (CVE-2023-0767)

* Mozilla: Content security policy leak in violation reports using iframes
(CVE-2023-25728)

* Mozilla: Screen hijack via browser fullscreen mode (CVE-2023-25730)

* Mozilla: Potential use-after-free from compartment mismatch in
SpiderMonkey (CVE-2023-25735)

* Mozilla: Invalid downcast in SVGUtils::SetupStrokeGeometry
(CVE-2023-25737)

* Mozilla: Use-after-free in
mozilla::dom::ScriptLoadContext::~ScriptLoadContext (CVE-2023-25739)

* Mozilla: Fullscreen notification not shown in Firefox Focus
(CVE-2023-25743)

* Mozilla: Memory safety bugs fixed in Firefox 110 and Firefox ESR 102.8
(CVE-2023-25744)

* Mozilla: Memory safety bugs fixed in Firefox ESR 102.8 (CVE-2023-25746)

* Mozilla: Extensions could have opened external schemes without user
knowledge (CVE-2023-25729)

* Mozilla: Out of bounds memory write from EncodeInputStream
(CVE-2023-25732)

* Mozilla: User Interface lockup with messages combining S/MIME and
OpenPGP  (CVE-2023-0616)

* Mozilla: Web Crypto ImportKey crashes tab (CVE-2023-25742)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
--

SL7
  x86_64
    thunderbird-102.8.0-2.el7_9.x86_64.rpm
    thunderbird-debuginfo-102.8.0-2.el7_9.x86_64.rpm

- Scientific Linux Development Team