[USN-6405-1] Thunderbird vulnerabilities

-----BEGIN PGP PUBLIC KEY BLOCK-----

xsDNBGK5OrIBDADeLgnKbZAczyFmpnG91E7lU8HAU3oGg8kZ58ji/SoKFoSMyca4
SUOzw0O1ex3N2J2dA1pWEW0ZL/YXI6LRUeg+qkGnoEDRnY/VUqGB6//N/rLgOlNL
RlhZ3V7Ywr1Hycho5Ai5XdBLxeGza+4uzL3BVEIKzIDZtDpdoHH8z5/OZakvWqDD
xhCU+YtjPsxsY76kHioTMx0hi6ZOrp9pl9/PgHMFNgA77d681XrNEiMWIveplYyc
9bcXc/iRX/WKA4IJGQ9oPqMzC4yzOoinrVHpWCs9mic5DaVx1HI4tusORCo8vcE7
6f4WmBJQPjoOqIq7MRGPuN2tRt1Xyltl3KcaSFB3tBywTKVTA++BumyJoTMyPh6g
rFkUIq3nYS76C7834IaQ05MgOWSobt44QP0Z/hT2/gXx3ko6ORpsjMLo1kwiSXrj
KmZM+UPbHmTxssZk+9z8iqv0xPpYb70LmvsIMy7B7v/q6hMJrA/1gX8CPmIlfXwi
9brhCqRWKgdBqxkAEQEAAc0vTmlzaGl0IE1haml0aGlhIDxuaXNoaXQubWFqaXRo
aWFAY2Fub25pY2FsLmNvbT7CwQ4EEwEKADgWIQSzXrzTXGcXvAresIrshzrO1Ghy
PAUCYrk6sgIbAwULCQgHAgYVCgkICwIEFgIDAQIeAQIXgAAKCRDshzrO1GhyPN0T
DACKYNAdtnps1/kJZnpggDQqmrmMWqURZ7zzv1qGESUibKnt6u6MMFjK2ifdN6q+
U7bElcrdAil8Jaxs2rdMV7q/UJ+9hjb+J5C8ypHYSLLiJLxO1BPxAeZNWpstzgOG
oeA+FTg9840DbaVHdaXlHizfRpqV0EZOiVf8KblQT0aMF8DB/Uocy47XNXW/Xlb5
GO+NjC3nwmwzweBCdkF19Vt9sdeeIevv52e9RyMizYJ06VW0u5Q+3rksuTx4zt2g
lGFkckNJ9PQoH92ldZFxQ610PiMivKXiGh3j+kCYtjwSfa0kmSAw++gi15+KdRgL
7sG1IbRrbPvJ1VB/yapXtbutW2U+ruOT0+PxgO1P1yfaTn/UoTBu6BTpooV4+txI
6amTmtcyvZ5p3dfoACwlDAFJuc9qzFe4E9hMlpBIVII29JtprsP012QCKYnMKStJ
aL6kzwpYP5lOrFDJBVSc2491OXNmzBZ2RBuZQaJ2fnzWaWgGmk0eABuuoj8KBWOp
Z1DOwM0EYrk6sgEMAMuVroyE5zf5KIPVZ3QqbbuznAg3hTIk8/Gcn1YjgEWTz5gK
407lxZ4rzZTJK1Pd1+kMlXa9c9mKdFg1C82hAOJKQAh6YDm41COX7W+0C7Vcu9CW
uenyu7K42PHw/MvgYDM+Ub7uth77tip30RVxYGJvoKe7qtoNWSVMgcepfq9ootaE
mLJPruhAW6fF+07QxH2muAp7c/yqm2/UQ207r6Culh1gvXwdmrejjhCwQHYhtQpG
D2Z6a4Gtzr+Ae9MV6D4e7SrDWBMYVe90qgmJWBJ2sWo/qA/Ysqpy0hOHfqktonLJ
ucUgkpI0+pb0BmxiJB5ywLSiiHYEnmJu1CqVT+FtL0FxgRlL1MbardKZ7dOV6yhk
HEk6JHv0KSYKnbA3G8LQtgib35TD+QtXTWqV9ceYpLbSOzf2MdVi1Dl484iwXkQQ
dGZvg+cYRsRjQaLchw30oPyz4f4eiEJ+sl94hVbenPpC4WcU9Otdm5/beqRP6poR
Z36V+WsGiTBsjc1bQQARAQABwsD2BBgBCgAgFiEEs16801xnF7wK3rCK7Ic6ztRo
cjwFAmK5OrICGwwACgkQ7Ic6ztRocjztzgwAq35GuEokox7sAWD6ICPFjqdQbPGU
vzskbN1qQDg4roM1NsBsFU96jQng1qAy3CvZYla+cjmxgiFQPNR2uZNmrXVYm7G8
RjX1p+MDT6Z3OMIcJFLBkmpxEbEqM2B1QQsO5WmBbnFnrcv2dIGe/NDgKhULGGVN
SOB3EMjxpeuQDOqrvCoY8RLEPwMh19sXvQqio0iSmRFyyOsRjdpEoyIyKjwrPpU2
0s5HwCWpsVNIZt1FUIOnOgf6GHox1R827o0zzLDpOVuOVFaOxk+iyjG7ufA0bT0/
h8NTN4SXZrwwxtjciJVCu44ekSy3NOuBiYceaTCKlfPyBUf82B6ui6/uoSS2lBkg
PrjdOkbvZDBU+/V7y3DeJNdvSm3hFKBiSouAt1u888HixXKErJ7tbDkUk+7xo1jK
h1IRafaoptIi8pe6cX+EhjpU9WnJXTQUf94pFFSmibtbGArbaZvzV4r0GSMFDrGK
if2Y7MHUqRJzk/D7DIi4ClSBOwKXYbnh5m4b
=rCMH
-----END PGP PUBLIC KEY BLOCK-----
==========================================================================

Ubuntu Security Notice USN-6405-1
October 03, 2023

thunderbird vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 23.04
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS

Summary:

Several security issues were fixed in Thunderbird.

Software Description:
- thunderbird: Mozilla Open Source mail and newsgroup client

Details:

Multiple security issues were discovered in Thunderbird. If a user were
tricked into opening a specially crafted website in a browsing context, an
attacker could potentially exploit these to cause a denial of service,
obtain sensitive information, bypass security restrictions, cross-site
tracing, or execute arbitrary code. (CVE-2023-4057, CVE-2023-4577,
CVE-2023-4578, CVE-2023-4583, CVE-2023-4585, CVE-2023-5169, CVE-2023-5171,
CVE-2023-5176)

Andrew McCreight discovered that Thunderbird did not properly manage during
the worker lifecycle. An attacker could potentially exploit this issue to
cause a denial of service. (CVE-2023-3600)

Harveer Singh discovered that Thunderbird did not store push notifications
in private browsing mode in encrypted form. An attacker could potentially
exploit this issue to obtain sensitive information. (CVE-2023-4580)

Clément Lecigne discovered that Thunderbird did not properly manage memory
when handling VP8 media stream. An attacker-controlled VP8 media stream
could lead to a heap buffer overflow in the content process, resulting in a
denial of service, or possibly execute arbitrary code. (CVE-2023-5217)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 23.04:
thunderbird 1:115.3.1+build1-0ubuntu0.23.04.1

Ubuntu 22.04 LTS:
thunderbird 1:115.3.1+build1-0ubuntu0.22.04.2

Ubuntu 20.04 LTS:
thunderbird 1:115.3.1+build1-0ubuntu0.20.04.1

In general, a standard system update will make all the necessary changes.

References:
https://ubuntu.com/security/notices/USN-6405-1
CVE-2023-3600, CVE-2023-4057, CVE-2023-4577, CVE-2023-4578,
CVE-2023-4580, CVE-2023-4583, CVE-2023-4585, CVE-2023-5169,
CVE-2023-5171, CVE-2023-5176, CVE-2023-5217

Package Information:
https://launchpad.net/ubuntu/+source/thunderbird/1:115.3.1+build1-0ubuntu0.23.04.1
https://launchpad.net/ubuntu/+source/thunderbird/1:115.3.1+build1-0ubuntu0.22.04.2
https://launchpad.net/ubuntu/+source/thunderbird/1:115.3.1+build1-0ubuntu0.20.04.1