Red Hat Security Advisory 2023-3152-01 - Mozilla Thunderbird is a standalone mail and newsgroup client. This update upgrades Thunderbird to version 102.11.0. Issues addressed include a bypass vulnerability.

-----BEGIN PGP SIGNED MESSAGE-----  
Hash: SHA256

====================================================================                     
Red Hat Security Advisory

Synopsis:          Important: thunderbird security update  
Advisory ID:       RHSA-2023:3152-01  
Product:           Red Hat Enterprise Linux  
Advisory URL:      https://access.redhat.com/errata/RHSA-2023:3152  
Issue date:        2023-05-16  
CVE Names:         CVE-2023-32205 CVE-2023-32206 CVE-2023-32207  
                   CVE-2023-32211 CVE-2023-32212 CVE-2023-32213  
                   CVE-2023-32215  
====================================================================  
1. Summary:

An update for thunderbird is now available for Red Hat Enterprise Linux 8.1  
Update Services for SAP Solutions.

Red Hat Product Security has rated this update as having a security impact  
of Important. A Common Vulnerability Scoring System (CVSS) base score,  
which gives a detailed severity rating, is available for each vulnerability  
from the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat Enterprise Linux AppStream E4S (v. 8.1) - ppc64le, x86_64

3. Description:

Mozilla Thunderbird is a standalone mail and newsgroup client.

This update upgrades Thunderbird to version 102.11.0.

Security Fix(es):

* Mozilla: Browser prompts could have been obscured by popups  
(CVE-2023-32205)

* Mozilla: Crash in RLBox Expat driver (CVE-2023-32206)

* Mozilla: Potential permissions request bypass via clickjacking  
(CVE-2023-32207)

* Mozilla: Memory safety bugs fixed in Firefox 113 and Firefox ESR 102.11  
(CVE-2023-32215)

* Mozilla: Content process crash due to invalid wasm code (CVE-2023-32211)

* Mozilla: Potential spoof due to obscured address bar (CVE-2023-32212)

* Mozilla: Potential memory corruption in FileReader::DoReadData()  
(CVE-2023-32213)

For more details about the security issue(s), including the impact, a CVSS  
score, acknowledgments, and other related information, refer to the CVE  
page(s) listed in the References section.

4. Solution:

For details on how to apply this update, which includes the changes  
described in this advisory, refer to:

https://access.redhat.com/articles/11258

All running instances of Thunderbird must be restarted for the update to  
take effect.

5. Bugs fixed (https://bugzilla.redhat.com/):

2196736 - CVE-2023-32205 Mozilla: Browser prompts could have been obscured by popups  
2196737 - CVE-2023-32206 Mozilla: Crash in RLBox Expat driver  
2196738 - CVE-2023-32207 Mozilla: Potential permissions request bypass via clickjacking  
2196740 - CVE-2023-32211 Mozilla: Content process crash due to invalid wasm code  
2196741 - CVE-2023-32212 Mozilla: Potential spoof due to obscured address bar  
2196742 - CVE-2023-32213 Mozilla: Potential memory corruption in FileReader::DoReadData()  
2196753 - CVE-2023-32215 Mozilla: Memory safety bugs fixed in Firefox 113 and Firefox ESR 102.11

6. Package List:

Red Hat Enterprise Linux AppStream E4S (v. 8.1):

Source:  
thunderbird-102.11.0-1.el8_1.src.rpm

ppc64le:  
thunderbird-102.11.0-1.el8_1.ppc64le.rpm  
thunderbird-debuginfo-102.11.0-1.el8_1.ppc64le.rpm  
thunderbird-debugsource-102.11.0-1.el8_1.ppc64le.rpm

x86_64:  
thunderbird-102.11.0-1.el8_1.x86_64.rpm  
thunderbird-debuginfo-102.11.0-1.el8_1.x86_64.rpm  
thunderbird-debugsource-102.11.0-1.el8_1.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and  
details on how to verify the signature are available from  
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2023-32205  
https://access.redhat.com/security/cve/CVE-2023-32206  
https://access.redhat.com/security/cve/CVE-2023-32207  
https://access.redhat.com/security/cve/CVE-2023-32211  
https://access.redhat.com/security/cve/CVE-2023-32212  
https://access.redhat.com/security/cve/CVE-2023-32213  
https://access.redhat.com/security/cve/CVE-2023-32215  
https://access.redhat.com/security/updates/classification/#important

8. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact  
details at https://access.redhat.com/security/team/contact/

Copyright 2023 Red Hat, Inc.  
-----BEGIN PGP SIGNATURE-----  
Version: GnuPG v1

iQIVAwUBZGQXiNzjgjWX9erEAQiHWw//ajvOZcTDGCJ+4O4WOLrInKQl1QUrneko  
4jfE8vi/IOiFFEvdl8oGYj1rROVVBmsR0R1hesHm76AHcCvqXcXQJNRx3k2zFkFU  
VFwkBFq4kkdmdAM08ZVY/oRz6BEqJT+yD4HxkIXwSi32U8i/bIl1W+g8Pw/2a99W  
lbwnoGPbnKMBDtQggpiSFVhDDHnamUkAVYUj6R2v9Q7BwFA9Hm4ir7+6/jbNUzZG  
jM3wllzLPp1Lhi+KzQosL09SKQPJ2rRbc4seBLTRFFdylu1qt6zB/qa+VHbcfByn  
mnVHnN95tj4DPhOxEDC5jfCKOC16+bXSK5x71ClaCjf6DwIqy6zpPredt1HMxB/U  
Q6oxhiMn9+N4/zoslO/5SpbPGibPQ5a+aiHHOlEY9LNlckKFFjxC1LnKxwV0pomV  
JPVtS1sLZuHpUI34hHDid9auwoeqzKEFEcJAkqtESXOHN8BhvSZfP5yiDbm5mKu7  
jHphcOvxt935M8pEc5zYHOumcKCiDD8Wug2TlGL9WNZglqKw03NRxDFIaFy0GMLX  
h2Zg4tts+2zgOe2ESYb44S0m9v4273eSgyMflbY89eFYnzTGdswiAr30cVRDnyvR  
L2Sn7eyNIeK73/OcH4btiuAEC0EXw/o+YKDk5GnDPNvRHp9nqvL6PhT36CX3wO4R  
0NGifNvNLUM=Noqz  
-----END PGP SIGNATURE-----  
--  
RHSA-announce mailing list  
RHSA-announce@redhat.com  
https://listman.redhat.com/mailman/listinfo/rhsa-announce

Red Hat Security Advisory 2023-3152-01

Red Hat Security Advisory 2023-3138-01 - Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. This update upgrades Firefox to version 102.11.0 ESR. Issues addressed include a bypass vulnerability.

-----BEGIN PGP SIGNED MESSAGE-----  
Hash: SHA256

====================================================================                     
Red Hat Security Advisory

Synopsis:          Important: firefox security update  
Advisory ID:       RHSA-2023:3138-01  
Product:           Red Hat Enterprise Linux  
Advisory URL:      https://access.redhat.com/errata/RHSA-2023:3138  
Issue date:        2023-05-16  
CVE Names:         CVE-2023-32205 CVE-2023-32206 CVE-2023-32207  
                   CVE-2023-32211 CVE-2023-32212 CVE-2023-32213  
                   CVE-2023-32215  
====================================================================  
1. Summary:

An update for firefox is now available for Red Hat Enterprise Linux 8.1  
Update Services for SAP Solutions.

Red Hat Product Security has rated this update as having a security impact  
of Important. A Common Vulnerability Scoring System (CVSS) base score,  
which gives a detailed severity rating, is available for each vulnerability  
from the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat Enterprise Linux AppStream E4S (v. 8.1) - ppc64le, x86_64

3. Description:

Mozilla Firefox is an open-source web browser, designed for standards  
compliance, performance, and portability.

This update upgrades Firefox to version 102.11.0 ESR.

Security Fix(es):

* Mozilla: Browser prompts could have been obscured by popups  
(CVE-2023-32205)

* Mozilla: Crash in RLBox Expat driver (CVE-2023-32206)

* Mozilla: Potential permissions request bypass via clickjacking  
(CVE-2023-32207)

* Mozilla: Memory safety bugs fixed in Firefox 113 and Firefox ESR 102.11  
(CVE-2023-32215)

* Mozilla: Content process crash due to invalid wasm code (CVE-2023-32211)

* Mozilla: Potential spoof due to obscured address bar (CVE-2023-32212)

* Mozilla: Potential memory corruption in FileReader::DoReadData()  
(CVE-2023-32213)

For more details about the security issue(s), including the impact, a CVSS  
score, acknowledgments, and other related information, refer to the CVE  
page(s) listed in the References section.

4. Solution:

For details on how to apply this update, which includes the changes  
described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Firefox must be restarted for the changes to  
take effect.

5. Bugs fixed (https://bugzilla.redhat.com/):

2196736 - CVE-2023-32205 Mozilla: Browser prompts could have been obscured by popups  
2196737 - CVE-2023-32206 Mozilla: Crash in RLBox Expat driver  
2196738 - CVE-2023-32207 Mozilla: Potential permissions request bypass via clickjacking  
2196740 - CVE-2023-32211 Mozilla: Content process crash due to invalid wasm code  
2196741 - CVE-2023-32212 Mozilla: Potential spoof due to obscured address bar  
2196742 - CVE-2023-32213 Mozilla: Potential memory corruption in FileReader::DoReadData()  
2196753 - CVE-2023-32215 Mozilla: Memory safety bugs fixed in Firefox 113 and Firefox ESR 102.11

6. Package List:

Red Hat Enterprise Linux AppStream E4S (v. 8.1):

Source:  
firefox-102.11.0-2.el8_1.src.rpm

ppc64le:  
firefox-102.11.0-2.el8_1.ppc64le.rpm  
firefox-debuginfo-102.11.0-2.el8_1.ppc64le.rpm  
firefox-debugsource-102.11.0-2.el8_1.ppc64le.rpm

x86_64:  
firefox-102.11.0-2.el8_1.x86_64.rpm  
firefox-debuginfo-102.11.0-2.el8_1.x86_64.rpm  
firefox-debugsource-102.11.0-2.el8_1.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and  
details on how to verify the signature are available from  
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2023-32205  
https://access.redhat.com/security/cve/CVE-2023-32206  
https://access.redhat.com/security/cve/CVE-2023-32207  
https://access.redhat.com/security/cve/CVE-2023-32211  
https://access.redhat.com/security/cve/CVE-2023-32212  
https://access.redhat.com/security/cve/CVE-2023-32213  
https://access.redhat.com/security/cve/CVE-2023-32215  
https://access.redhat.com/security/updates/classification/#important

8. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact  
details at https://access.redhat.com/security/team/contact/

Copyright 2023 Red Hat, Inc.  
-----BEGIN PGP SIGNATURE-----  
Version: GnuPG v1

iQIVAwUBZGQXc9zjgjWX9erEAQgQLQ//WDSrnqY65X9Z7UuItp6kvlGnIVeIplBE  
8AnuFdw9Np9RMRD8HfuUotRbFCtqiv4N/hUiNIKsfIh4R9lydALWZDlgIrjzPOLY  
KZXjs1JVJcqNcCKZxpCLxyamqR6MIqetD2HkcxrApGWphPRsYnvSmwKaHggAONw/  
DpRHa6VyYlA3BFT/cG5zwnNz9HVAl26aEIo0CooDdNvAYzv0kcjSO/pgC/Zrw4OG  
hnSfSDmVfWQedc9v1UqiAbQUsMfbN8lDj/c1T89laGyZZIJe5h5dG+lOVDdpAOSF  
XTYY595TouGFrcx7OBXRJHTAxxBaNwbMgfQExfDKKX3GRQ9LLbNcCC4wKhcM10Gj  
j4CFBnBQIK5ktYV+hCofPjLZuluF9tQxK9rmgFbttl0dNghQUOAZZ02ZEzsstdzQ  
cap9ZeJHUEuABrBepJH6jBgXyj0Ih2vKyh+0EsF+uhmoCSe6i48vwxWZs1Ns1HGu  
8Wl2jQ2DV2gsQTagPBtDRRALD6iNuvS1ukEQ9a4/m+f4UnrvqP3FIDvwH7kyA8j/  
xZ+aTatzqvDmyU8ObhyNXAc9SIJ2uU1B2oIP9gEi2w65q+VAG0nT1U3ujtFTZHVp  
2v0eKPKM5Sj0KKMbyZsrp+9Ay9YQ7/b+Pk4QBJsjnNOBBINsFRZc/1ToDGQwsoqB  
M3/zADpjqCc=Y/u0  
-----END PGP SIGNATURE-----  
--  
RHSA-announce mailing list  
RHSA-announce@redhat.com  
https://listman.redhat.com/mailman/listinfo/rhsa-announce

Red Hat Security Advisory 2023-3138-01

Red Hat Security Advisory 2023-3151-01 - Mozilla Thunderbird is a standalone mail and newsgroup client. This update upgrades Thunderbird to version 102.11.0. Issues addressed include a bypass vulnerability.

-----BEGIN PGP SIGNED MESSAGE-----  
Hash: SHA256

====================================================================                     
Red Hat Security Advisory

Synopsis:          Important: thunderbird security update  
Advisory ID:       RHSA-2023:3151-01  
Product:           Red Hat Enterprise Linux  
Advisory URL:      https://access.redhat.com/errata/RHSA-2023:3151  
Issue date:        2023-05-16  
CVE Names:         CVE-2023-32205 CVE-2023-32206 CVE-2023-32207  
                   CVE-2023-32211 CVE-2023-32212 CVE-2023-32213  
                   CVE-2023-32215  
====================================================================  
1. Summary:

An update for thunderbird is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact  
of Important. A Common Vulnerability Scoring System (CVSS) base score,  
which gives a detailed severity rating, is available for each vulnerability  
from the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat Enterprise Linux Client (v. 7) - x86_64  
Red Hat Enterprise Linux Server Optional (v. 7) - ppc64le, x86_64  
Red Hat Enterprise Linux Workstation (v. 7) - x86_64

3. Description:

Mozilla Thunderbird is a standalone mail and newsgroup client.

This update upgrades Thunderbird to version 102.11.0.

Security Fix(es):

* Mozilla: Browser prompts could have been obscured by popups  
(CVE-2023-32205)

* Mozilla: Crash in RLBox Expat driver (CVE-2023-32206)

* Mozilla: Potential permissions request bypass via clickjacking  
(CVE-2023-32207)

* Mozilla: Memory safety bugs fixed in Firefox 113 and Firefox ESR 102.11  
(CVE-2023-32215)

* Mozilla: Content process crash due to invalid wasm code (CVE-2023-32211)

* Mozilla: Potential spoof due to obscured address bar (CVE-2023-32212)

* Mozilla: Potential memory corruption in FileReader::DoReadData()  
(CVE-2023-32213)

For more details about the security issue(s), including the impact, a CVSS  
score, acknowledgments, and other related information, refer to the CVE  
page(s) listed in the References section.

4. Solution:

For details on how to apply this update, which includes the changes  
described in this advisory, refer to:

https://access.redhat.com/articles/11258

All running instances of Thunderbird must be restarted for the update to  
take effect.

5. Bugs fixed (https://bugzilla.redhat.com/):

2196736 - CVE-2023-32205 Mozilla: Browser prompts could have been obscured by popups  
2196737 - CVE-2023-32206 Mozilla: Crash in RLBox Expat driver  
2196738 - CVE-2023-32207 Mozilla: Potential permissions request bypass via clickjacking  
2196740 - CVE-2023-32211 Mozilla: Content process crash due to invalid wasm code  
2196741 - CVE-2023-32212 Mozilla: Potential spoof due to obscured address bar  
2196742 - CVE-2023-32213 Mozilla: Potential memory corruption in FileReader::DoReadData()  
2196753 - CVE-2023-32215 Mozilla: Memory safety bugs fixed in Firefox 113 and Firefox ESR 102.11

6. Package List:

Red Hat Enterprise Linux Client (v. 7):

Source:  
thunderbird-102.11.0-1.el7_9.src.rpm

x86_64:  
thunderbird-102.11.0-1.el7_9.x86_64.rpm  
thunderbird-debuginfo-102.11.0-1.el7_9.x86_64.rpm

Red Hat Enterprise Linux Server Optional (v. 7):

Source:  
thunderbird-102.11.0-1.el7_9.src.rpm

ppc64le:  
thunderbird-102.11.0-1.el7_9.ppc64le.rpm  
thunderbird-debuginfo-102.11.0-1.el7_9.ppc64le.rpm

x86_64:  
thunderbird-102.11.0-1.el7_9.x86_64.rpm  
thunderbird-debuginfo-102.11.0-1.el7_9.x86_64.rpm

Red Hat Enterprise Linux Workstation (v. 7):

Source:  
thunderbird-102.11.0-1.el7_9.src.rpm

x86_64:  
thunderbird-102.11.0-1.el7_9.x86_64.rpm  
thunderbird-debuginfo-102.11.0-1.el7_9.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and  
details on how to verify the signature are available from  
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2023-32205  
https://access.redhat.com/security/cve/CVE-2023-32206  
https://access.redhat.com/security/cve/CVE-2023-32207  
https://access.redhat.com/security/cve/CVE-2023-32211  
https://access.redhat.com/security/cve/CVE-2023-32212  
https://access.redhat.com/security/cve/CVE-2023-32213  
https://access.redhat.com/security/cve/CVE-2023-32215  
https://access.redhat.com/security/updates/classification/#important

8. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact  
details at https://access.redhat.com/security/team/contact/

Copyright 2023 Red Hat, Inc.  
-----BEGIN PGP SIGNATURE-----  
Version: GnuPG v1

iQIVAwUBZGQXstzjgjWX9erEAQh50A//QFlGYqgaEPQsSggYbY2ENj1xRZc5kyVM  
iuNxOCUKQksfBnbz8dFKlZCsBT1+xXnhtvUEov/gViXEt19j32aOUcBsAm1Kd0W+  
Sc5kELdH+zDNuxsMctfFiqrKB3WWwlqec2fll3I9q0YOcrQP8Tr1PkL7GnZK8FUn  
JsyGGijvorIgQ+bAsQDai4xD5EbZRqDyVq8l7rNGz04q1ojYdTaBTCWZtJHUJx+k  
31t0CpGJXE0lbAcPnoApLqFvkU6yW07xckSohXg8u0GHInaz6N7Dz9Um5WAazaIk  
4GLsZZq3pIjW3lvIbQ1FKW5M/+wBINGfDdpC+g+Xeca+fFe8zQwD4KoKQ8bph2OY  
uq3Y9AtHGP/Ngqc3DFJ8hE/bvBvXEvnlTJAb1UhZs2vz33ZU6v9f3HnFvt+Ie4Ja  
xSkstW/AY7YtVnPwALo3SeAgZl4TWeOPbYl8f3/BRPjlvp+kF88C6OeqUWDFyRNH  
CyS9UZlrFSz0ua4fyb3cziZxrXW/eXttlX1Scm07gDoJ7uSB5pggAjgjHMz1dQJN  
87/InHqFfk35zpsdJR6H1/taLc7fEGzasdKIYOrV36HTebRLvx77z/6rkCGMSmeP  
vdbWVwH6bpIGa0yKVWGjBg+lwv1xoiCxgoCRqlJXJ9Qm2bgweJ55HVdS3e5w8Q9+  
q73Lq1N0xjwNq  
-----END PGP SIGNATURE-----  
--  
RHSA-announce mailing list  
RHSA-announce@redhat.com  
https://listman.redhat.com/mailman/listinfo/rhsa-announce

Red Hat Security Advisory 2023-3151-01

Red Hat Security Advisory 2023-3143-01 - Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. This update upgrades Firefox to version 102.11.0 ESR. Issues addressed include a bypass vulnerability.

-----BEGIN PGP SIGNED MESSAGE-----  
Hash: SHA256

====================================================================                     
Red Hat Security Advisory

Synopsis:          Important: firefox security update  
Advisory ID:       RHSA-2023:3143-01  
Product:           Red Hat Enterprise Linux  
Advisory URL:      https://access.redhat.com/errata/RHSA-2023:3143  
Issue date:        2023-05-16  
CVE Names:         CVE-2023-32205 CVE-2023-32206 CVE-2023-32207  
                   CVE-2023-32211 CVE-2023-32212 CVE-2023-32213  
                   CVE-2023-32215  
====================================================================  
1. Summary:

An update for firefox is now available for Red Hat Enterprise Linux 9.

Red Hat Product Security has rated this update as having a security impact  
of Important. A Common Vulnerability Scoring System (CVSS) base score,  
which gives a detailed severity rating, is available for each vulnerability  
from the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat Enterprise Linux AppStream (v. 9) - aarch64, ppc64le, s390x, x86_64

3. Description:

Mozilla Firefox is an open-source web browser, designed for standards  
compliance, performance, and portability.

This update upgrades Firefox to version 102.11.0 ESR.

Security Fix(es):

* Mozilla: Browser prompts could have been obscured by popups  
(CVE-2023-32205)

* Mozilla: Crash in RLBox Expat driver (CVE-2023-32206)

* Mozilla: Potential permissions request bypass via clickjacking  
(CVE-2023-32207)

* Mozilla: Memory safety bugs fixed in Firefox 113 and Firefox ESR 102.11  
(CVE-2023-32215)

* Mozilla: Content process crash due to invalid wasm code (CVE-2023-32211)

* Mozilla: Potential spoof due to obscured address bar (CVE-2023-32212)

* Mozilla: Potential memory corruption in FileReader::DoReadData()  
(CVE-2023-32213)

For more details about the security issue(s), including the impact, a CVSS  
score, acknowledgments, and other related information, refer to the CVE  
page(s) listed in the References section.

4. Solution:

For details on how to apply this update, which includes the changes  
described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Firefox must be restarted for the changes to  
take effect.

5. Bugs fixed (https://bugzilla.redhat.com/):

2196736 - CVE-2023-32205 Mozilla: Browser prompts could have been obscured by popups  
2196737 - CVE-2023-32206 Mozilla: Crash in RLBox Expat driver  
2196738 - CVE-2023-32207 Mozilla: Potential permissions request bypass via clickjacking  
2196740 - CVE-2023-32211 Mozilla: Content process crash due to invalid wasm code  
2196741 - CVE-2023-32212 Mozilla: Potential spoof due to obscured address bar  
2196742 - CVE-2023-32213 Mozilla: Potential memory corruption in FileReader::DoReadData()  
2196753 - CVE-2023-32215 Mozilla: Memory safety bugs fixed in Firefox 113 and Firefox ESR 102.11

6. Package List:

Red Hat Enterprise Linux AppStream (v. 9):

Source:  
firefox-102.11.0-2.el9_2.src.rpm

aarch64:  
firefox-102.11.0-2.el9_2.aarch64.rpm  
firefox-debuginfo-102.11.0-2.el9_2.aarch64.rpm  
firefox-debugsource-102.11.0-2.el9_2.aarch64.rpm  
firefox-x11-102.11.0-2.el9_2.aarch64.rpm

ppc64le:  
firefox-102.11.0-2.el9_2.ppc64le.rpm  
firefox-debuginfo-102.11.0-2.el9_2.ppc64le.rpm  
firefox-debugsource-102.11.0-2.el9_2.ppc64le.rpm  
firefox-x11-102.11.0-2.el9_2.ppc64le.rpm

s390x:  
firefox-102.11.0-2.el9_2.s390x.rpm  
firefox-debuginfo-102.11.0-2.el9_2.s390x.rpm  
firefox-debugsource-102.11.0-2.el9_2.s390x.rpm  
firefox-x11-102.11.0-2.el9_2.s390x.rpm

x86_64:  
firefox-102.11.0-2.el9_2.x86_64.rpm  
firefox-debuginfo-102.11.0-2.el9_2.x86_64.rpm  
firefox-debugsource-102.11.0-2.el9_2.x86_64.rpm  
firefox-x11-102.11.0-2.el9_2.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and  
details on how to verify the signature are available from  
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2023-32205  
https://access.redhat.com/security/cve/CVE-2023-32206  
https://access.redhat.com/security/cve/CVE-2023-32207  
https://access.redhat.com/security/cve/CVE-2023-32211  
https://access.redhat.com/security/cve/CVE-2023-32212  
https://access.redhat.com/security/cve/CVE-2023-32213  
https://access.redhat.com/security/cve/CVE-2023-32215  
https://access.redhat.com/security/updates/classification/#important

8. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact  
details at https://access.redhat.com/security/team/contact/

Copyright 2023 Red Hat, Inc.  
-----BEGIN PGP SIGNATURE-----  
Version: GnuPG v1

iQIVAwUBZGQXetzjgjWX9erEAQjeqhAAh/K0SyWl8IbZowaQrIVmgTZFH9DhymF7  
A/HdvrslYLvbJIODOobhYcx42BHv1lViEW5FwoHgP+Gozs3sJml01Dngs0RHxmzj  
oZNkDwzynlwvBX0Anp0lY4OvioAetRRM6h1rgNrhBYTcIHAEUHK5sGaON+biuy5T  
IpTDSESMV136ZkF8BkHX4rEqongYb35UvAb9hdy2fCuS1sYpi8qCYomCjsDuHI4P  
5bsGeWuxwz5Q6gpt+IwN4ObXYWEaqpFlT4FTGPVDKmcZeOKwFdpxkmSBO3/G5dqD  
iS3uu11y27QyKDL5vZ0atHRO+cc5TM5TY2VCmjXlyuXmnoVKZFT+Y+ZoWbgcIpYL  
TDgm0zbM7VdYAAtF46TEQvaysKdPJGBBxdi/NTlexZa1YUiLfSLWZwrPngNZaNB8  
/x8ZP7LNcO8iPTpBj98KFc/ttPwEeMHbNur97prZwprWHCGyNJVlhspf7YrSn5HB  
5mSlx2eZDC407s28EmueGY9hmYWWNOa6DQzCW2iZBJ6BpZqpY9BKdkQORUH1gbD0  
ggoFCMVeE9jSMm6evF7JORryp7gBBuoW9b7PZBHxzRJuIyMVwLBZnjy1z6XeMCoP  
KtvigAw6KP+/ZgSFVUgb9mfc7zyj04WDVeWwuJjTomnVjWDlaSUgnLrDGMx61Wsx  
25e+FwcsilY=oUqA  
-----END PGP SIGNATURE-----  
--  
RHSA-announce mailing list  
RHSA-announce@redhat.com  
https://listman.redhat.com/mailman/listinfo/rhsa-announce

Red Hat Security Advisory 2023-3143-01

Red Hat Security Advisory 2023-3153-01 - Mozilla Thunderbird is a standalone mail and newsgroup client. This update upgrades Thunderbird to version 102.11.0. Issues addressed include a bypass vulnerability.

-----BEGIN PGP SIGNED MESSAGE-----  
Hash: SHA256

====================================================================                     
Red Hat Security Advisory

Synopsis:          Important: thunderbird security update  
Advisory ID:       RHSA-2023:3153-01  
Product:           Red Hat Enterprise Linux  
Advisory URL:      https://access.redhat.com/errata/RHSA-2023:3153  
Issue date:        2023-05-16  
CVE Names:         CVE-2023-32205 CVE-2023-32206 CVE-2023-32207  
                   CVE-2023-32211 CVE-2023-32212 CVE-2023-32213  
                   CVE-2023-32215  
====================================================================  
1. Summary:

An update for thunderbird is now available for Red Hat Enterprise Linux 8.2  
Advanced Update Support, Red Hat Enterprise Linux 8.2 Telecommunications  
Update Service, and Red Hat Enterprise Linux 8.2 Update Services for SAP  
Solutions.

Red Hat Product Security has rated this update as having a security impact  
of Important. A Common Vulnerability Scoring System (CVSS) base score,  
which gives a detailed severity rating, is available for each vulnerability  
from the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat Enterprise Linux AppStream AUS (v. 8.2) - aarch64, ppc64le, x86_64  
Red Hat Enterprise Linux AppStream E4S (v. 8.2) - aarch64, ppc64le, x86_64  
Red Hat Enterprise Linux AppStream TUS (v. 8.2) - aarch64, ppc64le, x86_64

3. Description:

Mozilla Thunderbird is a standalone mail and newsgroup client.

This update upgrades Thunderbird to version 102.11.0.

Security Fix(es):

* Mozilla: Browser prompts could have been obscured by popups  
(CVE-2023-32205)

* Mozilla: Crash in RLBox Expat driver (CVE-2023-32206)

* Mozilla: Potential permissions request bypass via clickjacking  
(CVE-2023-32207)

* Mozilla: Memory safety bugs fixed in Firefox 113 and Firefox ESR 102.11  
(CVE-2023-32215)

* Mozilla: Content process crash due to invalid wasm code (CVE-2023-32211)

* Mozilla: Potential spoof due to obscured address bar (CVE-2023-32212)

* Mozilla: Potential memory corruption in FileReader::DoReadData()  
(CVE-2023-32213)

For more details about the security issue(s), including the impact, a CVSS  
score, acknowledgments, and other related information, refer to the CVE  
page(s) listed in the References section.

4. Solution:

For details on how to apply this update, which includes the changes  
described in this advisory, refer to:

https://access.redhat.com/articles/11258

All running instances of Thunderbird must be restarted for the update to  
take effect.

5. Bugs fixed (https://bugzilla.redhat.com/):

2196736 - CVE-2023-32205 Mozilla: Browser prompts could have been obscured by popups  
2196737 - CVE-2023-32206 Mozilla: Crash in RLBox Expat driver  
2196738 - CVE-2023-32207 Mozilla: Potential permissions request bypass via clickjacking  
2196740 - CVE-2023-32211 Mozilla: Content process crash due to invalid wasm code  
2196741 - CVE-2023-32212 Mozilla: Potential spoof due to obscured address bar  
2196742 - CVE-2023-32213 Mozilla: Potential memory corruption in FileReader::DoReadData()  
2196753 - CVE-2023-32215 Mozilla: Memory safety bugs fixed in Firefox 113 and Firefox ESR 102.11

6. Package List:

Red Hat Enterprise Linux AppStream AUS (v. 8.2):

Source:  
thunderbird-102.11.0-1.el8_2.src.rpm

aarch64:  
thunderbird-102.11.0-1.el8_2.aarch64.rpm  
thunderbird-debuginfo-102.11.0-1.el8_2.aarch64.rpm  
thunderbird-debugsource-102.11.0-1.el8_2.aarch64.rpm

ppc64le:  
thunderbird-102.11.0-1.el8_2.ppc64le.rpm  
thunderbird-debuginfo-102.11.0-1.el8_2.ppc64le.rpm  
thunderbird-debugsource-102.11.0-1.el8_2.ppc64le.rpm

x86_64:  
thunderbird-102.11.0-1.el8_2.x86_64.rpm  
thunderbird-debuginfo-102.11.0-1.el8_2.x86_64.rpm  
thunderbird-debugsource-102.11.0-1.el8_2.x86_64.rpm

Red Hat Enterprise Linux AppStream E4S (v. 8.2):

Source:  
thunderbird-102.11.0-1.el8_2.src.rpm

aarch64:  
thunderbird-102.11.0-1.el8_2.aarch64.rpm  
thunderbird-debuginfo-102.11.0-1.el8_2.aarch64.rpm  
thunderbird-debugsource-102.11.0-1.el8_2.aarch64.rpm

ppc64le:  
thunderbird-102.11.0-1.el8_2.ppc64le.rpm  
thunderbird-debuginfo-102.11.0-1.el8_2.ppc64le.rpm  
thunderbird-debugsource-102.11.0-1.el8_2.ppc64le.rpm

x86_64:  
thunderbird-102.11.0-1.el8_2.x86_64.rpm  
thunderbird-debuginfo-102.11.0-1.el8_2.x86_64.rpm  
thunderbird-debugsource-102.11.0-1.el8_2.x86_64.rpm

Red Hat Enterprise Linux AppStream TUS (v. 8.2):

Source:  
thunderbird-102.11.0-1.el8_2.src.rpm

aarch64:  
thunderbird-102.11.0-1.el8_2.aarch64.rpm  
thunderbird-debuginfo-102.11.0-1.el8_2.aarch64.rpm  
thunderbird-debugsource-102.11.0-1.el8_2.aarch64.rpm

ppc64le:  
thunderbird-102.11.0-1.el8_2.ppc64le.rpm  
thunderbird-debuginfo-102.11.0-1.el8_2.ppc64le.rpm  
thunderbird-debugsource-102.11.0-1.el8_2.ppc64le.rpm

x86_64:  
thunderbird-102.11.0-1.el8_2.x86_64.rpm  
thunderbird-debuginfo-102.11.0-1.el8_2.x86_64.rpm  
thunderbird-debugsource-102.11.0-1.el8_2.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and  
details on how to verify the signature are available from  
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2023-32205  
https://access.redhat.com/security/cve/CVE-2023-32206  
https://access.redhat.com/security/cve/CVE-2023-32207  
https://access.redhat.com/security/cve/CVE-2023-32211  
https://access.redhat.com/security/cve/CVE-2023-32212  
https://access.redhat.com/security/cve/CVE-2023-32213  
https://access.redhat.com/security/cve/CVE-2023-32215  
https://access.redhat.com/security/updates/classification/#important

8. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact  
details at https://access.redhat.com/security/team/contact/

Copyright 2023 Red Hat, Inc.  
-----BEGIN PGP SIGNATURE-----  
Version: GnuPG v1

iQIVAwUBZGQXjdzjgjWX9erEAQhLnRAAiBYKNQ2zJhN1Vj4Vei/iFiM4NyLq8mvl  
PxtWqaE/F8b5Zu1EumNlOu1mwq+iBHlYyzl1OS58n6xQidglrWNpmOsvXlgNCSVt  
f/qeRE86h4ZsLahdc3h31hsc4BrskcqsjnkeP5JoA085bYvBkTfH6CI1qXzi85eU  
eNTnu1Owyp1stCOrDh0vPW+p59ozGY9wa4A4pMSEy8l1R567VLokAP4FZ/wkLugs  
MNvdO6J6gkdHAnLXDmGFz0wmaftkdOPX/Lkl+ATnCN0tfq17S4d8S8gyN8T2RPBt  
BLBB66sTzmvaV3keBM5wex/1mJaruSsphP/22sWJ5TKv9SPjIrC5OjOxaspeVHPz  
3YHrfDzpXat3vOb0TLdXwQfZsAndAfznTB+XvxEARkBX3sECY8SWaCb8nEUsqmbz  
5bMjRA8owrv3bCmUb8nwPL2Y2WnlvQOzUKu5I5jZvtSfGOb6imLhpu2ep2WD8qkS  
mLTomXCcsUF7qyYO/aED4bYHciU2P6L1T8RaHsNOZHN7j1OE3sVqk10+tFW9SUXg  
21TYuU4y7kDWBRxfAw0zUW4IUghe097uc6hnnTDU+4G80mtNJeBcDylZ6LGnZfCO  
StjY35/A94TAOid38kNXL62eSM6ptheoG6KHlx9iy2YWWXpE5LhMgcDx6CF0wyQ3  
M3gw0UbjrEA=2g/y  
-----END PGP SIGNATURE-----  
--  
RHSA-announce mailing list  
RHSA-announce@redhat.com  
https://listman.redhat.com/mailman/listinfo/rhsa-announce

Red Hat Security Advisory 2023-3153-01

Red Hat Security Advisory 2023-3139-01 - Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. This update upgrades Firefox to version 102.11.0 ESR. Issues addressed include a bypass vulnerability.

-----BEGIN PGP SIGNED MESSAGE-----  
Hash: SHA256

====================================================================                     
Red Hat Security Advisory

Synopsis:          Important: firefox security update  
Advisory ID:       RHSA-2023:3139-01  
Product:           Red Hat Enterprise Linux  
Advisory URL:      https://access.redhat.com/errata/RHSA-2023:3139  
Issue date:        2023-05-16  
CVE Names:         CVE-2023-32205 CVE-2023-32206 CVE-2023-32207  
                   CVE-2023-32211 CVE-2023-32212 CVE-2023-32213  
                   CVE-2023-32215  
====================================================================  
1. Summary:

An update for firefox is now available for Red Hat Enterprise Linux 8.2  
Advanced Update Support, Red Hat Enterprise Linux 8.2 Telecommunications  
Update Service, and Red Hat Enterprise Linux 8.2 Update Services for SAP  
Solutions.

Red Hat Product Security has rated this update as having a security impact  
of Important. A Common Vulnerability Scoring System (CVSS) base score,  
which gives a detailed severity rating, is available for each vulnerability  
from the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat Enterprise Linux AppStream AUS (v. 8.2) - aarch64, ppc64le, s390x, x86_64  
Red Hat Enterprise Linux AppStream E4S (v. 8.2) - aarch64, ppc64le, s390x, x86_64  
Red Hat Enterprise Linux AppStream TUS (v. 8.2) - aarch64, ppc64le, s390x, x86_64

3. Description:

Mozilla Firefox is an open-source web browser, designed for standards  
compliance, performance, and portability.

This update upgrades Firefox to version 102.11.0 ESR.

Security Fix(es):

* Mozilla: Browser prompts could have been obscured by popups  
(CVE-2023-32205)

* Mozilla: Crash in RLBox Expat driver (CVE-2023-32206)

* Mozilla: Potential permissions request bypass via clickjacking  
(CVE-2023-32207)

* Mozilla: Memory safety bugs fixed in Firefox 113 and Firefox ESR 102.11  
(CVE-2023-32215)

* Mozilla: Content process crash due to invalid wasm code (CVE-2023-32211)

* Mozilla: Potential spoof due to obscured address bar (CVE-2023-32212)

* Mozilla: Potential memory corruption in FileReader::DoReadData()  
(CVE-2023-32213)

For more details about the security issue(s), including the impact, a CVSS  
score, acknowledgments, and other related information, refer to the CVE  
page(s) listed in the References section.

4. Solution:

For details on how to apply this update, which includes the changes  
described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Firefox must be restarted for the changes to  
take effect.

5. Bugs fixed (https://bugzilla.redhat.com/):

2196736 - CVE-2023-32205 Mozilla: Browser prompts could have been obscured by popups  
2196737 - CVE-2023-32206 Mozilla: Crash in RLBox Expat driver  
2196738 - CVE-2023-32207 Mozilla: Potential permissions request bypass via clickjacking  
2196740 - CVE-2023-32211 Mozilla: Content process crash due to invalid wasm code  
2196741 - CVE-2023-32212 Mozilla: Potential spoof due to obscured address bar  
2196742 - CVE-2023-32213 Mozilla: Potential memory corruption in FileReader::DoReadData()  
2196753 - CVE-2023-32215 Mozilla: Memory safety bugs fixed in Firefox 113 and Firefox ESR 102.11

6. Package List:

Red Hat Enterprise Linux AppStream AUS (v. 8.2):

Source:  
firefox-102.11.0-2.el8_2.src.rpm

aarch64:  
firefox-102.11.0-2.el8_2.aarch64.rpm  
firefox-debuginfo-102.11.0-2.el8_2.aarch64.rpm  
firefox-debugsource-102.11.0-2.el8_2.aarch64.rpm

ppc64le:  
firefox-102.11.0-2.el8_2.ppc64le.rpm  
firefox-debuginfo-102.11.0-2.el8_2.ppc64le.rpm  
firefox-debugsource-102.11.0-2.el8_2.ppc64le.rpm

s390x:  
firefox-102.11.0-2.el8_2.s390x.rpm  
firefox-debuginfo-102.11.0-2.el8_2.s390x.rpm  
firefox-debugsource-102.11.0-2.el8_2.s390x.rpm

x86_64:  
firefox-102.11.0-2.el8_2.x86_64.rpm  
firefox-debuginfo-102.11.0-2.el8_2.x86_64.rpm  
firefox-debugsource-102.11.0-2.el8_2.x86_64.rpm

Red Hat Enterprise Linux AppStream E4S (v. 8.2):

Source:  
firefox-102.11.0-2.el8_2.src.rpm

aarch64:  
firefox-102.11.0-2.el8_2.aarch64.rpm  
firefox-debuginfo-102.11.0-2.el8_2.aarch64.rpm  
firefox-debugsource-102.11.0-2.el8_2.aarch64.rpm

ppc64le:  
firefox-102.11.0-2.el8_2.ppc64le.rpm  
firefox-debuginfo-102.11.0-2.el8_2.ppc64le.rpm  
firefox-debugsource-102.11.0-2.el8_2.ppc64le.rpm

s390x:  
firefox-102.11.0-2.el8_2.s390x.rpm  
firefox-debuginfo-102.11.0-2.el8_2.s390x.rpm  
firefox-debugsource-102.11.0-2.el8_2.s390x.rpm

x86_64:  
firefox-102.11.0-2.el8_2.x86_64.rpm  
firefox-debuginfo-102.11.0-2.el8_2.x86_64.rpm  
firefox-debugsource-102.11.0-2.el8_2.x86_64.rpm

Red Hat Enterprise Linux AppStream TUS (v. 8.2):

Source:  
firefox-102.11.0-2.el8_2.src.rpm

aarch64:  
firefox-102.11.0-2.el8_2.aarch64.rpm  
firefox-debuginfo-102.11.0-2.el8_2.aarch64.rpm  
firefox-debugsource-102.11.0-2.el8_2.aarch64.rpm

ppc64le:  
firefox-102.11.0-2.el8_2.ppc64le.rpm  
firefox-debuginfo-102.11.0-2.el8_2.ppc64le.rpm  
firefox-debugsource-102.11.0-2.el8_2.ppc64le.rpm

s390x:  
firefox-102.11.0-2.el8_2.s390x.rpm  
firefox-debuginfo-102.11.0-2.el8_2.s390x.rpm  
firefox-debugsource-102.11.0-2.el8_2.s390x.rpm

x86_64:  
firefox-102.11.0-2.el8_2.x86_64.rpm  
firefox-debuginfo-102.11.0-2.el8_2.x86_64.rpm  
firefox-debugsource-102.11.0-2.el8_2.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and  
details on how to verify the signature are available from  
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2023-32205  
https://access.redhat.com/security/cve/CVE-2023-32206  
https://access.redhat.com/security/cve/CVE-2023-32207  
https://access.redhat.com/security/cve/CVE-2023-32211  
https://access.redhat.com/security/cve/CVE-2023-32212  
https://access.redhat.com/security/cve/CVE-2023-32213  
https://access.redhat.com/security/cve/CVE-2023-32215  
https://access.redhat.com/security/updates/classification/#important

8. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact  
details at https://access.redhat.com/security/team/contact/

Copyright 2023 Red Hat, Inc.  
-----BEGIN PGP SIGNATURE-----  
Version: GnuPG v1

iQIVAwUBZGQXddzjgjWX9erEAQgi7Q/+PVwmtEibU58JYicPijXz3FpH6+IK90d1  
nzAkHuI4LgUVQZjBaljPJsNPg8PVJWKvEQqPvprD3F4vVxS9SL5l+O0XOqd9h89U  
WNmGEPLHluLJi1otcrABcbRGS4MSpyFGOydS7dTXW+j8N79zhJS0WMfXQYo8aLct  
f/fBjg3fD69mql/nL3/YHtPN0C9cQT8mZj6kr9FNwyUTCAvhUyOLr8irEjNGkiIR  
eNpvOIgLyEzHCBq7GAhoXLrd919iV21PQvRh5cGxS3EuT+yIUjcgea0DL0N2ASlz  
PoAOmime84Ic2wS+BvEkYASE5XdhbMGe+Sqcv1Ndliwnyqy7XH/k73tOS9TcHK9z  
MeOQC7ZlaXx30t4I17QT/K2cpDpo5any+fv6LEnxek0hNbbb1s+kdzE2OpvsFxbl  
wPYNmo0w18Ll6LDzu9E31XeTJvBsrbhGnxbWmBBhJ4TttAIsqr6GAVi5VjE1DO4X  
YNz4pnfqv20ItFEj9UsvgmHTDKkK97fQZ/rBHNQXtIbMwTghzWDaCKGHH1dO6KOE  
460ncBF1w2CBmVVUL9EUUyHFKi3Bfv0MVCGAlzmEKs0ajRzMR/vbaQNuBtM2Bt5K  
lLoFvGRT/j3L1SnKyPONrQRDwFKCLaVeQAGio0RSLrQdk1R6+oTX1NtrVXfr9IWP  
lwKtxJmAXDU=0wtv  
-----END PGP SIGNATURE-----  
--  
RHSA-announce mailing list  
RHSA-announce@redhat.com  
https://listman.redhat.com/mailman/listinfo/rhsa-announce

Red Hat Security Advisory 2023-3139-01

Red Hat Security Advisory 2023-3149-01 - Mozilla Thunderbird is a standalone mail and newsgroup client. This update upgrades Thunderbird to version 102.11.0. Issues addressed include a bypass vulnerability.

-----BEGIN PGP SIGNED MESSAGE-----  
Hash: SHA256

====================================================================                     
Red Hat Security Advisory

Synopsis:          Important: thunderbird security update  
Advisory ID:       RHSA-2023:3149-01  
Product:           Red Hat Enterprise Linux  
Advisory URL:      https://access.redhat.com/errata/RHSA-2023:3149  
Issue date:        2023-05-16  
CVE Names:         CVE-2023-32205 CVE-2023-32206 CVE-2023-32207  
                   CVE-2023-32211 CVE-2023-32212 CVE-2023-32213  
                   CVE-2023-32215  
====================================================================  
1. Summary:

An update for thunderbird is now available for Red Hat Enterprise Linux 9.0  
Extended Update Support.

Red Hat Product Security has rated this update as having a security impact  
of Important. A Common Vulnerability Scoring System (CVSS) base score,  
which gives a detailed severity rating, is available for each vulnerability  
from the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat Enterprise Linux AppStream EUS (v.9.0) - aarch64, ppc64le, s390x, x86_64

3. Description:

Mozilla Thunderbird is a standalone mail and newsgroup client.

This update upgrades Thunderbird to version 102.11.0.

Security Fix(es):

* Mozilla: Browser prompts could have been obscured by popups  
(CVE-2023-32205)

* Mozilla: Crash in RLBox Expat driver (CVE-2023-32206)

* Mozilla: Potential permissions request bypass via clickjacking  
(CVE-2023-32207)

* Mozilla: Memory safety bugs fixed in Firefox 113 and Firefox ESR 102.11  
(CVE-2023-32215)

* Mozilla: Content process crash due to invalid wasm code (CVE-2023-32211)

* Mozilla: Potential spoof due to obscured address bar (CVE-2023-32212)

* Mozilla: Potential memory corruption in FileReader::DoReadData()  
(CVE-2023-32213)

For more details about the security issue(s), including the impact, a CVSS  
score, acknowledgments, and other related information, refer to the CVE  
page(s) listed in the References section.

4. Solution:

For details on how to apply this update, which includes the changes  
described in this advisory, refer to:

https://access.redhat.com/articles/11258

All running instances of Thunderbird must be restarted for the update to  
take effect.

5. Bugs fixed (https://bugzilla.redhat.com/):

2196736 - CVE-2023-32205 Mozilla: Browser prompts could have been obscured by popups  
2196737 - CVE-2023-32206 Mozilla: Crash in RLBox Expat driver  
2196738 - CVE-2023-32207 Mozilla: Potential permissions request bypass via clickjacking  
2196740 - CVE-2023-32211 Mozilla: Content process crash due to invalid wasm code  
2196741 - CVE-2023-32212 Mozilla: Potential spoof due to obscured address bar  
2196742 - CVE-2023-32213 Mozilla: Potential memory corruption in FileReader::DoReadData()  
2196753 - CVE-2023-32215 Mozilla: Memory safety bugs fixed in Firefox 113 and Firefox ESR 102.11

6. Package List:

Red Hat Enterprise Linux AppStream EUS (v.9.0):

Source:  
thunderbird-102.11.0-1.el9_0.src.rpm

aarch64:  
thunderbird-102.11.0-1.el9_0.aarch64.rpm  
thunderbird-debuginfo-102.11.0-1.el9_0.aarch64.rpm  
thunderbird-debugsource-102.11.0-1.el9_0.aarch64.rpm

ppc64le:  
thunderbird-102.11.0-1.el9_0.ppc64le.rpm  
thunderbird-debuginfo-102.11.0-1.el9_0.ppc64le.rpm  
thunderbird-debugsource-102.11.0-1.el9_0.ppc64le.rpm

s390x:  
thunderbird-102.11.0-1.el9_0.s390x.rpm  
thunderbird-debuginfo-102.11.0-1.el9_0.s390x.rpm  
thunderbird-debugsource-102.11.0-1.el9_0.s390x.rpm

x86_64:  
thunderbird-102.11.0-1.el9_0.x86_64.rpm  
thunderbird-debuginfo-102.11.0-1.el9_0.x86_64.rpm  
thunderbird-debugsource-102.11.0-1.el9_0.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and  
details on how to verify the signature are available from  
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2023-32205  
https://access.redhat.com/security/cve/CVE-2023-32206  
https://access.redhat.com/security/cve/CVE-2023-32207  
https://access.redhat.com/security/cve/CVE-2023-32211  
https://access.redhat.com/security/cve/CVE-2023-32212  
https://access.redhat.com/security/cve/CVE-2023-32213  
https://access.redhat.com/security/cve/CVE-2023-32215  
https://access.redhat.com/security/updates/classification/#important

8. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact  
details at https://access.redhat.com/security/team/contact/

Copyright 2023 Red Hat, Inc.  
-----BEGIN PGP SIGNATURE-----  
Version: GnuPG v1

iQIVAwUBZGQXftzjgjWX9erEAQjIgQ//SoM6CgYu3k2ObZpjIy3om6EhsmQyUODF  
YQqAtf73dPKtYLMux+lt15kcjMJVRjdJ/RqPYZqNBc7gr88ZqvTfYM/LvQ6Tg2he  
P2KnUoq2iGmkKQmD6mdmG/sJeOKvE0fgXf70+G9d2o4aM3g8rq9FAx3xHhanapqi  
xipf1SSLhv4HOixvdZJp1rbtPvMNVVs7dNLadRSitlZcj1YmyiXKsvWWe5SvWaej  
BIHg6xM8XDdk+pVzcGnWnPGHEC0EgodVS7BFqQKZDQhph+z6DvJDUhiqPcC9q6ie  
fB69TVwntDs048dc4JiqA0++U19Mg8YiYceifkPF4Hap66Chhx+zeHg0Csuhc1sW  
EaZLXDCkRPGO4BNxrXyr1PX+dcBJnb6+eGEIrmhhkkLZV0f2UvQ7q6KmWiaTkDN1  
lH+UdLzplYOUL417YVGXIoRJ2qRC5BNIGAOn81hXbVmMTVjO8R/owQPBKmgWjJmY  
o25Ao9CN5qqRdvxqo54wvuLtV9o22Jthip4zPP1LyaNd0nQUNUeM7qt2rJDx5lWB  
HFxtdOsFoxoxspEfiHp55oNMce6AAxaKxsnTUwO+QsIJMWld4HUQcpUgJE3ux0kK  
K6PEShDGs0V/3rioLbeT7Zg/p3LdN+kteL12q6UTtPx3zurFDSX65lD47yMJz0OU  
U0y9gPiaj7g=Vnif  
-----END PGP SIGNATURE-----  
--  
RHSA-announce mailing list  
RHSA-announce@redhat.com  
https://listman.redhat.com/mailman/listinfo/rhsa-announce

Red Hat Security Advisory 2023-3149-01

Red Hat Security Advisory 2023-3150-01 - Mozilla Thunderbird is a standalone mail and newsgroup client. This update upgrades Thunderbird to version 102.11.0. Issues addressed include a bypass vulnerability.

-----BEGIN PGP SIGNED MESSAGE-----  
Hash: SHA256

====================================================================                     
Red Hat Security Advisory

Synopsis:          Important: thunderbird security update  
Advisory ID:       RHSA-2023:3150-01  
Product:           Red Hat Enterprise Linux  
Advisory URL:      https://access.redhat.com/errata/RHSA-2023:3150  
Issue date:        2023-05-16  
CVE Names:         CVE-2023-32205 CVE-2023-32206 CVE-2023-32207  
                   CVE-2023-32211 CVE-2023-32212 CVE-2023-32213  
                   CVE-2023-32215  
====================================================================  
1. Summary:

An update for thunderbird is now available for Red Hat Enterprise Linux 9.

Red Hat Product Security has rated this update as having a security impact  
of Important. A Common Vulnerability Scoring System (CVSS) base score,  
which gives a detailed severity rating, is available for each vulnerability  
from the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat Enterprise Linux AppStream (v. 9) - aarch64, ppc64le, s390x, x86_64

3. Description:

Mozilla Thunderbird is a standalone mail and newsgroup client.

This update upgrades Thunderbird to version 102.11.0.

Security Fix(es):

* Mozilla: Browser prompts could have been obscured by popups  
(CVE-2023-32205)

* Mozilla: Crash in RLBox Expat driver (CVE-2023-32206)

* Mozilla: Potential permissions request bypass via clickjacking  
(CVE-2023-32207)

* Mozilla: Memory safety bugs fixed in Firefox 113 and Firefox ESR 102.11  
(CVE-2023-32215)

* Mozilla: Content process crash due to invalid wasm code (CVE-2023-32211)

* Mozilla: Potential spoof due to obscured address bar (CVE-2023-32212)

* Mozilla: Potential memory corruption in FileReader::DoReadData()  
(CVE-2023-32213)

For more details about the security issue(s), including the impact, a CVSS  
score, acknowledgments, and other related information, refer to the CVE  
page(s) listed in the References section.

4. Solution:

For details on how to apply this update, which includes the changes  
described in this advisory, refer to:

https://access.redhat.com/articles/11258

All running instances of Thunderbird must be restarted for the update to  
take effect.

5. Bugs fixed (https://bugzilla.redhat.com/):

2196736 - CVE-2023-32205 Mozilla: Browser prompts could have been obscured by popups  
2196737 - CVE-2023-32206 Mozilla: Crash in RLBox Expat driver  
2196738 - CVE-2023-32207 Mozilla: Potential permissions request bypass via clickjacking  
2196740 - CVE-2023-32211 Mozilla: Content process crash due to invalid wasm code  
2196741 - CVE-2023-32212 Mozilla: Potential spoof due to obscured address bar  
2196742 - CVE-2023-32213 Mozilla: Potential memory corruption in FileReader::DoReadData()  
2196753 - CVE-2023-32215 Mozilla: Memory safety bugs fixed in Firefox 113 and Firefox ESR 102.11

6. Package List:

Red Hat Enterprise Linux AppStream (v. 9):

Source:  
thunderbird-102.11.0-1.el9_2.src.rpm

aarch64:  
thunderbird-102.11.0-1.el9_2.aarch64.rpm  
thunderbird-debuginfo-102.11.0-1.el9_2.aarch64.rpm  
thunderbird-debugsource-102.11.0-1.el9_2.aarch64.rpm

ppc64le:  
thunderbird-102.11.0-1.el9_2.ppc64le.rpm  
thunderbird-debuginfo-102.11.0-1.el9_2.ppc64le.rpm  
thunderbird-debugsource-102.11.0-1.el9_2.ppc64le.rpm

s390x:  
thunderbird-102.11.0-1.el9_2.s390x.rpm  
thunderbird-debuginfo-102.11.0-1.el9_2.s390x.rpm  
thunderbird-debugsource-102.11.0-1.el9_2.s390x.rpm

x86_64:  
thunderbird-102.11.0-1.el9_2.x86_64.rpm  
thunderbird-debuginfo-102.11.0-1.el9_2.x86_64.rpm  
thunderbird-debugsource-102.11.0-1.el9_2.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and  
details on how to verify the signature are available from  
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2023-32205  
https://access.redhat.com/security/cve/CVE-2023-32206  
https://access.redhat.com/security/cve/CVE-2023-32207  
https://access.redhat.com/security/cve/CVE-2023-32211  
https://access.redhat.com/security/cve/CVE-2023-32212  
https://access.redhat.com/security/cve/CVE-2023-32213  
https://access.redhat.com/security/cve/CVE-2023-32215  
https://access.redhat.com/security/updates/classification/#important

8. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact  
details at https://access.redhat.com/security/team/contact/

Copyright 2023 Red Hat, Inc.  
-----BEGIN PGP SIGNATURE-----  
Version: GnuPG v1

iQIVAwUBZGQXkdzjgjWX9erEAQiSDw//ckE1Gn7RVwptIlPa1q/GXpo5FoAEQ7G/  
VBZho+w/lrwacNJ5Adayi3WYy848XgwGHBcJ2JqwipyZf/BcywxLPeDAWcCQGud1  
ZO22VQWuDxlYMkd+r6TQ6prW8F90AjZwdd+HQ4XtzJe9AgKzLSFuE7HzYKA9thsm  
ip3RCWuO01onoiPf5kmQD79GCn/Yyr8HzAy+3byEi92BmUXpK/HJFaN0+25cBWk3  
CMWqHSWQffH6O3lWDEHY+e4BLYilUdbmiq8VAEdI4fVPp2PEb2XYPjDIsUVGRa3V  
a0i3+wNLtqjBNHCJhaHuvSqSvTMB87JhKb+k8nT5brlmq1AShjqjDngyOst64h5K  
mOvXWh0ZvazHT98wr3HDnSNP1YJKyyiprCcoRCERdqcRSqI/aEO88hn4DGHG6kfU  
AZ+RpOu1OlffvSB84FWhom1aInosaX8eRqgkLKIZPiQq3vL2rCbp0Yk47+zdrIwR  
OK0sfUpXjSYECzxl2wXbDGOA9ou58XMRYg76Y21of+6EwE1heIbMrKPRqnEME0d9  
8H1iX2182yf+QuhRk91FsTYqu2mSgMhwEFmZWxMVY0Gb/ZeTVYagLI/N+nxFUOQI  
AK0sjyRrsPEaDTOMMEUNb2xs+Sfp9r6rOHaKS7WjDG7ZP3tiK5PhbNujFE7Zy4l0  
kChqjsmaHJI=nTF9  
-----END PGP SIGNATURE-----  
--  
RHSA-announce mailing list  
RHSA-announce@redhat.com  
https://listman.redhat.com/mailman/listinfo/rhsa-announce

Red Hat Security Advisory 2023-3150-01

Bludit v3.14.1 is vulnerable to Stored Cross Site Scripting (XSS) via SVG file on site logo.

**Description:**  
I found Stored Cross-site scripting (XSS) vulnerability in your Bludit - Flat-File CMS (v3.14.1) on "General" settings to "Logo" field. When I send malicious code use svg file after then the browser give me result.

**CMS Version:**  
v3.14.1

**Affected URL:**  
http://127.0.0.1/bludit/admin/settings

**Steps to Reproduce:**

1.  First login your admin panel.
2.  then go to General settings and click logo section.

3.  Now open notepad and save this code with xss.svg name with extension

4.  Now upload this xss.svg file on logo section. So your request data will be:

POST /bludit/admin/ajax/logo-upload HTTP/1.1  
Host: 127.0.0.1  
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/112.0  
Content-Type: multipart/form-data; boundary=---------------------------15560729415644048492005010998  
Referer: http://127.0.0.1/bludit/admin/settings  
Cookie: BLUDITREMEMBERUSERNAME=admin; BLUDITREMEMBERTOKEN=139167a80807781336bc7484552bc985; BLUDIT-KEY=tmap19d0m813e8rqfft8rsl74i  
Content-Length: 651

\-----------------------------15560729415644048492005010998  
Content-Disposition: form-data; name="tokenCSRF"

626c201693546f472cdfc11bed0938aab8c6e480  
\-----------------------------15560729415644048492005010998  
Content-Disposition: form-data; name="inputFile"; filename="xss.svg"  
Content-Type: image/svg+xml

\-----------------------------15560729415644048492005010998--

5.  Now open logo image link that you upload. You will see XSS pop up.

**Proof of Concept:**  
You can see the Proof of Concept. Which I've attached screenshots and video to confirm the vulnerability.

poc.mp4

**Impact:**  
Attackers can make use of this to conduct attacks like phishing, steal sessions etc.

Let me know if any further info is required.

Thanks & Regards  
Rahad Chowdhury  
Cyber Security Specialist  
https://www.linkedin.com/in/rahadchowdhury/

CVE-2023-31698: Stored XSS via SVG file Vulnerability on Bludit v3.14.1 · Issue #1509 · bludit/bludit

Algoo Tracim before 4.4.2 allows XSS via HTML file upload.

**usd-2022-0048 | Tracim 4.4.2 - Stored Cross-Site Scripting**

  
**Advisory ID**: usd-2022-0048  
**Affected Product**: Tracim  
**Affected Version**: 4.4.2 (properly others too)  
**Vulnerability Type**: Cross-Site Scripting (CWE-79)  
**Security Risk**: Critical  
**Vendor URL**: https://tracim.fr  
**Vendor Acknoledged Vulnerability**: No  
**Vendor Status**: Not fixed  
**CVE-ID**: CVE-2022-45144  

_The following behavior was reported to Tracim in November 2022. After several contact attempts, the usd AG Responsible Disclosure Team did not receive any response. In order to inform the users of Tracim about the unresolved vulnerability, the advisory was published in accordance with our Responsible Disclosure Policy.  
_

**Description**

Tracim is a collaborative platform software that allows teams to share and work on various types of data and documents. The application allows uploads of HTML files, which leads to a stored Cross-Site-Scripting attack.

Additionally to the stored XSS vulnerability, the impact can be increased by using a HTML injection in the comments feature. This endpoint usually blocks XSS attempts using a CSP, which can be bypassed. The tested version was Tracim 4.4.2.

**Proof of Concept (PoC)**

The application allows to upload HTML files, which can be viewed in "raw" using a link similar to the one below:

http://localhost:8080/api/workspaces/1/files/19/raw/test.html

This upload functionality makes the application vulnerable to a stored XSS, because the uplaoded file is rendered in the context of the application.

Tracim implements the following CSP:

Content-Security-Policy: script-src 'unsafe-eval' 'nonce-67c3972badf9a5c68a68fb5b107ab5f0ce1c8d0b15e6b9342d68b53f56cd4238'; style-src 'unsafe-inline' 'self'; connect-src 'self'; font-src data: blob: \*; img-src data: blob: \*; media-src data: blob: \*; frame-src \* 'self'; object-src 'none'; default-src 'self'

To attack more users from inside the application one needs to bypass the CSP and embed the uploaded file in a commonly visited place. Tracim allows injection of HTML into a comment. The endpoint uses a CSP to block XSS attempts. However, the CSP can be bypassed using our uploaded HTML file as an iframe source.

POST /api/workspaces/1/contents/22/comments HTTP/1.1  
Host: localhost:8080  
User-Agent: Mozilla/5.0 (X11; Linux x86\_64; rv:103.0) Gecko/20100101 Firefox/103.0  
Accept: application/json  
Accept-Language: en-US,en;q=0.5  
Accept-Encoding: gzip, deflate  
Referer: http://localhost:8080/ui/workspaces/1/publications  
X-Tracim-ClientToken: ed6ba1bc-fae7-49cd-9490-8c38dd33ba13  
Content-Type: application/json  
Content-Length: 164  
Origin: http://localhost:8080

\[...\]

{"raw\_content":"<iframe src=\\"http://localhost:8080/api/workspaces/1/files/19/raw/test.html\\"></iframe>","content\_namespace":"publication"}

**Fix**

It is recommended to treat all input on the website as potentially dangerous. Hence, all output that is dynamically generated based on user-controlled data should be encoded according to its context. The majority of programming languages support standard procedures for encoding meta characters. Also it is recommended to restrict the allowed file types in the file upload function.

**References**

*   https://owasp.org/www-community/attacks/xss/
*   https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-45144

**Timeline**

*   **2022-11-10**: This vulnerability was identified by Christian Pöschl.
*   **2022-11-10**: Initial contact to vendor via e-mail.
*   **2022-12-16**: Second attempt to contact vendor.
*   **2023-02-17**: Third attempt to contact vendor.
*   **2023-04-24**: Fourth attempt to contact vendor with notification about upcoming release plans for advisory.
*   **2023-05-15**: Security advisory released by usd AG.

**Credits**

This security vulnerability was found by Christian Pöschl of usd AG.

Tag

#firefox