Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

Thunderbird may let malicious emails execute code

published 2 years ago

Summary

The email program Thunderbird has a weakness that could let specially crafted messages run unwanted software on a computer. This could let attackers steal data or take control of the system. Install the latest Thunderbird update as soon as possible to protect your users.

What to do

Update redhat thunderbird to version 0:102.10.0-2.el8_2.
Update redhat thunderbird-debuginfo to version 0:102.10.0-2.el8_2.
Update redhat thunderbird-debugsource to version 0:102.10.0-2.el8_2.

Affected software

Ecosystem	Vendor	Product	Affected versions
Red Hat:rhel_aus:8.2::appstream	redhat	thunderbird	< 0:102.10.0-2.el8_2 Fix: upgrade to 0:102.10.0-2.el8_2
Red Hat:rhel_aus:8.2::appstream	redhat	thunderbird-debuginfo	< 0:102.10.0-2.el8_2 Fix: upgrade to 0:102.10.0-2.el8_2
Red Hat:rhel_aus:8.2::appstream	redhat	thunderbird-debugsource	< 0:102.10.0-2.el8_2 Fix: upgrade to 0:102.10.0-2.el8_2
Red Hat:rhel_e4s:8.2::appstream	redhat	thunderbird	< 0:102.10.0-2.el8_2 Fix: upgrade to 0:102.10.0-2.el8_2
Red Hat:rhel_e4s:8.2::appstream	redhat	thunderbird-debuginfo	< 0:102.10.0-2.el8_2 Fix: upgrade to 0:102.10.0-2.el8_2
Red Hat:rhel_e4s:8.2::appstream	redhat	thunderbird-debugsource	< 0:102.10.0-2.el8_2 Fix: upgrade to 0:102.10.0-2.el8_2
Red Hat:rhel_tus:8.2::appstream	redhat	thunderbird	< 0:102.10.0-2.el8_2 Fix: upgrade to 0:102.10.0-2.el8_2
Red Hat:rhel_tus:8.2::appstream	redhat	thunderbird-debuginfo	< 0:102.10.0-2.el8_2 Fix: upgrade to 0:102.10.0-2.el8_2
Red Hat:rhel_tus:8.2::appstream	redhat	thunderbird-debugsource	< 0:102.10.0-2.el8_2 Fix: upgrade to 0:102.10.0-2.el8_2

Original advisory text

Red Hat Security Advisory: thunderbird security update

References

https://access.redhat.com/errata/RHSA-2023:1805 Vendor Advisory
https://access.redhat.com/security/updates/classification/#important Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2183278 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2186101 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2186102 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2186103 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2186104 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2186105 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2186106 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2186109 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2186110 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2186111 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2186734 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2186735 Third Party Advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_1805.j... Vendor Advisory
https://access.redhat.com/security/cve/CVE-2023-0547 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2023-0547 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2023-0547 Vendor Advisory
https://www.mozilla.org/en-US/security/advisories/mfsa2023-15/#CVE-2023-0547 Third Party Advisory
https://access.redhat.com/security/cve/CVE-2023-1945 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2023-1945 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2023-1945 Vendor Advisory
https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-1945 Third Party Advisory
https://access.redhat.com/security/cve/CVE-2023-1999 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2023-1999 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2023-1999 Vendor Advisory
https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-1999 Third Party Advisory
https://www.mozilla.org/en-US/security/advisories/mfsa2023-15/#CVE-2023-1999 Third Party Advisory
https://access.redhat.com/security/cve/CVE-2023-28427 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2023-28427 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2023-28427 Vendor Advisory
https://github.com/matrix-org/matrix-js-sdk/security/advisories/GHSA-mwq8-fjpf-c... Third Party Advisory
https://matrix.org/blog/2023/03/28/security-releases-matrix-js-sdk-24-0-0-and-ma... Third Party Advisory
https://www.mozilla.org/en-US/security/advisories/mfsa2023-12/#CVE-2023-28427 Third Party Advisory
https://access.redhat.com/security/cve/CVE-2023-29479 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2023-29479 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2023-29479 Vendor Advisory
https://www.mozilla.org/en-US/security/advisories/mfsa2023-15/#CVE-2023-29479 Third Party Advisory
https://access.redhat.com/security/cve/CVE-2023-29533 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2023-29533 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2023-29533 Vendor Advisory
https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29533 Third Party Advisory
https://access.redhat.com/security/cve/CVE-2023-29535 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2023-29535 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2023-29535 Vendor Advisory
https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29535 Third Party Advisory
https://access.redhat.com/security/cve/CVE-2023-29536 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2023-29536 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2023-29536 Vendor Advisory
https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29536 Third Party Advisory
https://access.redhat.com/security/cve/CVE-2023-29539 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2023-29539 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2023-29539 Vendor Advisory
https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29539 Third Party Advisory
https://access.redhat.com/security/cve/CVE-2023-29541 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2023-29541 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2023-29541 Vendor Advisory
https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29541 Third Party Advisory
https://access.redhat.com/security/cve/CVE-2023-29548 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2023-29548 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2023-29548 Vendor Advisory
https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29548 Third Party Advisory
https://access.redhat.com/security/cve/CVE-2023-29550 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2023-29550 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2023-29550 Vendor Advisory
https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29550 Third Party Advisory

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker full control (estimated)

Severity

8.8 High

Timeline

Published22 Sep 2024

Updated21 Aug 2026

First seen21 Aug 2026

Sources

RHSA-2023:1805 · OSV

Track software like this

Free during beta