Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
Thunderbird could let attackers run code via email image
published 3 years ago
Summary
The Thunderbird email program on Almalinux can mishandle specially crafted WebP images, creating a memory error that could let an attacker run code on your computer. Updating Thunderbird to version 102.15.1 fixes this problem. Apply the update as soon as possible to keep your system safe.
What to do
- Update almalinux thunderbird to version 102.15.1-1.el8_8.alma.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| AlmaLinux:8 | almalinux | thunderbird |
< 102.15.1-1.el8_8.alma Fix: upgrade to 102.15.1-1.el8_8.alma
|
Original advisory text
Important: thunderbird security update
Mozilla Thunderbird is a standalone mail and newsgroup client.
This update upgrades Thunderbird to version 102.15.1.
Security Fix(es):
* libwebp: Heap buffer overflow in WebP Codec (CVE-2023-4863)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
This update upgrades Thunderbird to version 102.15.1.
Security Fix(es):
* libwebp: Heap buffer overflow in WebP Codec (CVE-2023-4863)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
References
- https://access.redhat.com/errata/RHSA-2023:5201 Vendor Advisory
- https://access.redhat.com/security/cve/CVE-2023-4863 Third Party Advisory
- https://bugzilla.redhat.com/2238431 Third Party Advisory
- https://errata.almalinux.org/8/ALSA-2023-5201.html Vendor Advisory
Timeline
Published18 Sep 2023
Updated29 Oct 2026
First seen29 Oct 2026
Sources
ALSA-2023:5201 · OSV
Track software like this
Free during beta