Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
Thunderbird may let attackers run malicious code
published 3 years ago
Summary
The Thunderbird email program is being updated to version 102.9.0 to fix several problems that could let bad actors execute code on your computer, cause crashes, or trick the program into opening unexpected web pages. Install the update as soon as possible to keep your email client safe.
What to do
- Update almalinux thunderbird to version 102.9.0-1.el8_7.alma.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| AlmaLinux:8 | almalinux | thunderbird |
< 102.9.0-1.el8_7.alma Fix: upgrade to 102.9.0-1.el8_7.alma
|
Original advisory text
Important: thunderbird security update
Mozilla Thunderbird is a standalone mail and newsgroup client.
This update upgrades Thunderbird to version 102.9.0.
Security Fix(es):
* Mozilla: Incorrect code generation during JIT compilation (CVE-2023-25751)
* Mozilla: Memory safety bugs fixed in Firefox 111 and Firefox ESR 102.9 (CVE-2023-28176)
* Mozilla: Potential out-of-bounds when accessing throttled streams (CVE-2023-25752)
* Mozilla: Invalid downcast in Worklets (CVE-2023-28162)
* Mozilla: URL being dragged from a removed cross-origin iframe into the same tab triggered navigation (CVE-2023-28164)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
This update upgrades Thunderbird to version 102.9.0.
Security Fix(es):
* Mozilla: Incorrect code generation during JIT compilation (CVE-2023-25751)
* Mozilla: Memory safety bugs fixed in Firefox 111 and Firefox ESR 102.9 (CVE-2023-28176)
* Mozilla: Potential out-of-bounds when accessing throttled streams (CVE-2023-25752)
* Mozilla: Invalid downcast in Worklets (CVE-2023-28162)
* Mozilla: URL being dragged from a removed cross-origin iframe into the same tab triggered navigation (CVE-2023-28164)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
References
- https://access.redhat.com/errata/RHSA-2023:1403 Vendor Advisory
- https://access.redhat.com/security/cve/CVE-2023-25751 Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2023-25752 Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2023-28162 Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2023-28164 Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2023-28176 Third Party Advisory
- https://bugzilla.redhat.com/2178458 Third Party Advisory
- https://bugzilla.redhat.com/2178460 Third Party Advisory
- https://bugzilla.redhat.com/2178466 Third Party Advisory
- https://bugzilla.redhat.com/2178470 Third Party Advisory
- https://bugzilla.redhat.com/2178472 Third Party Advisory
- https://errata.almalinux.org/8/ALSA-2023-1403.html Vendor Advisory
Timeline
Published22 Mar 2023
Updated29 Oct 2026
First seen29 Oct 2026
Sources
ALSA-2023:1403 · OSV
Track software like this
Free during beta