RHSA-2024:0005HighCVSS 8.8

Red Hat Security Advisory: thunderbird security update

Published
January 2, 2024
Last Modified
November 5, 2026

🔗 CVE IDs covered (11)

CVE-2023-6864 →CVE-2023-50761 →CVE-2023-50762 →CVE-2023-6859 →CVE-2023-6860 →CVE-2023-6862 →CVE-2023-6863 →CVE-2023-6856 →CVE-2023-6857 →CVE-2023-6858 →CVE-2023-6861 →

📋 Description

CVE-2023-6856 — Mozilla: Heap-buffer-overflow affecting WebGL DrawElementsInstanced method with Mesa VM driver CVE-2023-6857 — Mozilla: Symlinks may resolve to smaller than expected buffers CVE-2023-6858 — Mozilla: Heap buffer overflow in nsTextFragment CVE-2023-6859 — Mozilla: Use-after-free in PR_GetIdentitiesLayer CVE-2023-6860 — Mozilla: Potential sandbox escape due to VideoBridge lack of texture validation CVE-2023-6861 — Mozilla: Heap buffer overflow affected nsWindow::PickerOpen(void) in headless mode CVE-2023-6862 — Mozilla: Use-after-free in nsDNSService CVE-2023-6863 — Mozilla: Undefined behavior in ShutdownObserver() CVE-2023-6864 — Mozilla: Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6, and Thunderbird 115.6 CVE-2023-50761 — Mozilla: S/MIME signature accepted despite mismatching message date CVE-2023-50762 — Mozilla: Truncated signed text was shown with a valid OpenPGP signature

🎯 Affected products14

  • Red Hat Enterprise Linux AppStream EUS (v.8.6)
  • thunderbird-0:115.6.0-1.el8_6.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)
  • thunderbird-0:115.6.0-1.el8_6.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)
  • thunderbird-0:115.6.0-1.el8_6.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)
  • thunderbird-0:115.6.0-1.el8_6.src as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)
  • thunderbird-0:115.6.0-1.el8_6.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)
  • thunderbird-debuginfo-0:115.6.0-1.el8_6.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)
  • thunderbird-debuginfo-0:115.6.0-1.el8_6.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)
  • thunderbird-debuginfo-0:115.6.0-1.el8_6.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)
  • thunderbird-debuginfo-0:115.6.0-1.el8_6.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)
  • thunderbird-debugsource-0:115.6.0-1.el8_6.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)
  • thunderbird-debugsource-0:115.6.0-1.el8_6.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)
  • thunderbird-debugsource-0:115.6.0-1.el8_6.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)
  • thunderbird-debugsource-0:115.6.0-1.el8_6.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 All running instances of Thunderbird must be restarted for the update to take effect.

🔗 References (14)