{"affected":[],"aliases":[],"details":"This update for MozillaThunderbird to version 60.5.1 fixes the following issues:\n\nSecurity vulnerabilities addressed (MSFA 2019-03 MSFA 2018-31 MFSA 2019-06  bsc#1122983 bsc#1119105 bsc#1125330):\n\n- CVE-2018-18356: Fixed a Use-after-free in Skia.\n- CVE-2019-5785: Fixed an Integer overflow in Skia.\n- CVE-2018-18335: Fixed a Buffer overflow in Skia by default deactivating Canvas 2D.\n  This issue does not affect Linuc distributions.\n- CVE-2018-18509: Fixed a flaw which during verification of certain S/MIME signatures\n  showing mistekenly that emails bring a valid sugnature. \n- CVE-2018-18500: Use-after-free parsing HTML5 stream\n- CVE-2018-18505: Privilege escalation through IPC channel messages\n- CVE-2016-5824 DoS (use-after-free) via a crafted ics file\n- CVE-2018-18501: Memory safety bugs fixed in Firefox 65 and Firefox ESR 60.5\n- CVE-2018-17466: Buffer overflow and out-of-bounds read in ANGLE library with\n  TextureStorage11\n- CVE-2018-18492: Use-after-free with select element\n- CVE-2018-18493: Buffer overflow in accelerated 2D canvas with Skia\n- CVE-2018-18494: Same-origin policy violation using location attribute and\n  performance.getEntries to steal cross-origin URLs\n- CVE-2018-18498: Integer overflow when calculating buffer sizes for images\n- CVE-2018-12405: Memory safety bugs fixed in Firefox 64, 60.4, and\n  Thunderbird 60.4\n\nOther bug fixes and changes:\n\n- FileLink provider WeTransfer to upload large attachments\n- Thunderbird now allows the addition of OpenSearch search engines\n  from a local XML file using a minimal user interface: [+] button\n  to select a file an add, [-] to remove.\n- More search engines: Google and DuckDuckGo available by default\n  in some locales\n- During account creation, Thunderbird will now detect servers using the\n  Microsoft Exchange protocol. It will offer the installation of a 3rd party\n  add-on (Owl) which supports that protocol.\n- Thunderbird now compatible with other WebExtension-based FileLink add-ons\n  like the Dropbox add-on\n- New WebExtensions FileLink API to facilitate add-ons\n- Fix decoding problems for messages with less common charsets (cp932, cp936)\n- New messages in the drafts folder (and other special or virtual folders)\n  will no longer be included in the new messages notification\n- Thunderbird 60 will migrate security databases (key3.db, cert8.db to key4.db,\n  cert9.db).\n- Address book search and auto-complete slowness\n- Plain text markup with * for bold, / for italics, _ for underline and | for\n  code did not work when the enclosed text contained non-ASCII characters\n- While composing a message, a link not removed when link location was removed\n  in the link properties panel\n- Encoding problems when exporting address books or messages using the system\n  charset. Messages are now always exported using the UTF-8 encoding\n- If the 'Date' header of a message was invalid, Jan 1970 or Dec 1969\n  was displayed. Now using date from 'Received' header instead.\n- Body search/filtering didn't reliably ignore content of tags\n- Inappropriate warning 'Thunderbird prevented the site\n  (addons.thunderbird.net) from asking you to install software on your\n  computer' when installing add-ons\n- Incorrect display of correspondents column since own email address was not\n  always detected\n- Spurious 
 (encoded newline) inserted into drafts and sent email\n- Double-clicking on a word in the Write window sometimes launched the\n  Advanced Property Editor or Link Properties dialog\n- Fixed Cookie removal\n- 'Download rest of message' was not working if global inbox was used\n- Fix Encoding problems for users (especially in Poland) when a file was sent\n  via a folder using 'Sent to > Mail recipient'\n  due to a problem in the Thunderbird MAPI interface\n- According to RFC 4616 and RFC 5721, passwords containing non-ASCII characters\n  are encoded using UTF-8 which can lead to problems with non-compliant\n  providers, for example office365.com. The SMTP LOGIN and POP3 USER/PASS\n  authentication methods are now using a Latin-1 encoding again\n  to work around this issue\n- Fix shutdown crash/hang after entering an empty IMAP password\n\nThis update was imported from the SUSE:SLE-15:Update update project.","id":"openSUSE-SU-2019:0251-1","modified":"2019-03-23T11:03:55Z","published":"2019-03-23T11:03:55Z","references":[{"type":"ADVISORY","url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/YTL5HAWTQVZCKKAVSVP4LCGEQTWZR73J/#YTL5HAWTQVZCKKAVSVP4LCGEQTWZR73J"},{"type":"REPORT","url":"https://bugzilla.suse.com/1119105"},{"type":"REPORT","url":"https://bugzilla.suse.com/1122983"},{"type":"REPORT","url":"https://bugzilla.suse.com/1125330"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2016-5824"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2018-12405"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2018-17466"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2018-18335"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2018-18356"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2018-18492"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2018-18493"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2018-18494"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2018-18498"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2018-18500"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2018-18501"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2018-18505"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2018-18509"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2019-5785"}],"related":["CVE-2016-5824","CVE-2018-12405","CVE-2018-17466","CVE-2018-18335","CVE-2018-18356","CVE-2018-18492","CVE-2018-18493","CVE-2018-18494","CVE-2018-18498","CVE-2018-18500","CVE-2018-18501","CVE-2018-18505","CVE-2018-18509","CVE-2019-5785"],"summary":"Security update for MozillaThunderbird","upstream":["CVE-2016-5824","CVE-2018-12405","CVE-2018-17466","CVE-2018-18335","CVE-2018-18356","CVE-2018-18492","CVE-2018-18493","CVE-2018-18494","CVE-2018-18498","CVE-2018-18500","CVE-2018-18501","CVE-2018-18505","CVE-2018-18509","CVE-2019-5785"]}