Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2021.1380
thunderbird security update
23 April 2021
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: thunderbird
Publisher: Debian
Operating System: Debian GNU/Linux
Impact/Access: Execute Arbitrary Code/Commands -- Remote with User Interaction
Increased Privileges -- Remote with User Interaction
Denial of Service -- Remote with User Interaction
Provide Misleading Information -- Remote with User Interaction
Access Confidential Data -- Remote with User Interaction
Reduced Security -- Remote with User Interaction
Resolution: Patch/Upgrade
CVE Names: CVE-2021-29949 CVE-2021-29948 CVE-2021-29946
CVE-2021-29945 CVE-2021-24002 CVE-2021-23999
CVE-2021-23998 CVE-2021-23995 CVE-2021-23994
CVE-2021-23993 CVE-2021-23992 CVE-2021-23991
CVE-2021-23961
Reference: ESB-2021.1313
ESB-2021.1197
Original Bulletin:
https://lists.debian.org/debian-lts-announce/2021/04/msg00019.html
https://lists.debian.org/debian-security-announce/2021/msg00078.html
Comment: This bulletin contains two (2) Debian security advisories.
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
- - -------------------------------------------------------------------------
Debian LTS Advisory DLA-2632-1 debian-lts@lists.debian.org
https://www.debian.org/lts/security/ Emilio Pozuelo Monfort
April 22, 2021 https://wiki.debian.org/LTS
- - -------------------------------------------------------------------------
Package : thunderbird
Version : 1:78.10.0-1~deb9u1
CVE ID : CVE-2021-23961 CVE-2021-23991 CVE-2021-23992 CVE-2021-23993
CVE-2021-23994 CVE-2021-23995 CVE-2021-23998 CVE-2021-23999
CVE-2021-24002 CVE-2021-29945 CVE-2021-29946 CVE-2021-29948
CVE-2021-29949
Multiple security issues were discovered in Thunderbird, which could
result in the execution of arbitrary code or information disclosure.
In adddition a number of security issues were addressed in the OpenPGP
support.
For Debian 9 stretch, these problems have been fixed in version
1:78.10.0-1~deb9u1.
We recommend that you upgrade your thunderbird packages.
For the detailed security status of thunderbird please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/thunderbird
Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
- -----BEGIN PGP SIGNATURE-----
iQIzBAEBCAAdFiEEcJymx+vmJZxd92Q+nUbEiOQ2gwIFAmCBUnEACgkQnUbEiOQ2
gwIR6BAAtS0Df5VWuN0L/XV9zb8O6Rv3G4vsqHyTb1viqV6RxJ1+D41EE20C7mrv
U8N+yNXqX8MWsPoa1N5G7MI05F6+Ne5fFViu3TiGKHa9HnqhoC8lkAu7ENkqG8iM
/FzKePCySQoho0i6mU7aqieupbUku3/sHrSQbVpNWdK2UGkqn/lHKdNaxxlGUozl
MpKisEsB1zh/y0yB4MbT4Ig2D1uLGRdeWlA03qAbRfdTPVmgKqyh+gcjiPHrjmj0
vE+tbxhYgxVnXQl0159VnB88vjjlRGhBZ3VARLUDvwrVAm5AS+8yWNeDRjeF7x6n
waxOa4QYyAnog+B00Jln5i/Dm/TSngzYeETdjuc93/a2kWDrCmjY4xOEXBB7JsIe
06ovwS4eFMk7JLGmotYTc9p43L6YLlDjVuFLUUrqwPpRdtqTi+0XjFbwF4wlaLwP
zN3mGc65CcfEMFmr/aYeoIG9wZbPVfyUf5nZFAE9Tqvtpegbnigf+t0Ef5pbLSNw
UDfSFC3oU4mKSm+n6yK62dHE3U9W0WuyGeMWrgOjGaGrALueItk3IZffH+8aACAp
SlUDoltYFSx5qTSWr7LBKVxS05YSKfC7eQdmnLNsZhlx6q4hxvK9RtTp39LfpDRr
am9R3gQ804r7vKdQx6zVeLEVC5cFE6q6GCnMlYezDvczXxwdGkw=
=nlIa
- -----END PGP SIGNATURE-----
- ------------------------------------------------------------------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
- - -------------------------------------------------------------------------
Debian Security Advisory DSA-4897-1 security@debian.org
https://www.debian.org/security/ Moritz Muehlenhoff
April 22, 2021 https://www.debian.org/security/faq
- - -------------------------------------------------------------------------
Package : thunderbird
CVE ID : CVE-2021-23961 CVE-2021-23991 CVE-2021-23992 CVE-2021-23993
CVE-2021-23994 CVE-2021-23995 CVE-2021-23998 CVE-2021-23999
CVE-2021-24002 CVE-2021-29945 CVE-2021-29946 CVE-2021-29948
CVE-2021-29949
Multiple security issues were discovered in Thunderbird, which could
result in the execution of arbitrary code or information disclosure.
In adddition a number of security issues were addressed in the OpenPGP
support.
For the stable distribution (buster), these problems have been fixed in
version 1:78.10.0-1~deb10u1.
We recommend that you upgrade your thunderbird packages.
For the detailed security status of thunderbird please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/thunderbird
Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/
Mailing list: debian-security-announce@lists.debian.org
- -----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEtuYvPRKsOElcDakFEMKTtsN8TjYFAmCBQj8ACgkQEMKTtsN8
Tjb1hQ/+OvvzhH4UIziQQe9PMcNjvfSFOky+Ptma1m8l8Izrl3YVH5zBVn4wGAP5
Vf0Lih3DdF91lcJQ6O3Q7qrX344yExFi0GFXLTHCVOiyk7/agH1MlIedtHg3iUwK
EFHV/MI3gk0QE7CjAphXg2KT2oav66wSYVWw97uKH2yei3Ew+qKLZu4BeiKbKzqC
uRFe5mIgNqpxQaK+/Zb1V/sXEy0knkJd1i4RLlxybylDTE3PullTw9XomgMR9FLh
2ONrg9Lo1b2aMDeEEhicc0+F33hmLSR+vr7AqQApW6zGusOkwpBrGHO4pCyFjr3a
X8h3Fw5sDb1oehVAc9sKdtx4yTcCJE+5jeNq9ZVh5W6DBUvBLVSsfXkUbzGVrLDy
MU1AwK76QRTcb3S3roHPtk+p/xqCZr4xRQCuv4ZR26mW1WEDwt4N+ipwZ6pwAJuF
OmvxOcTFp9cHYeJkhAeF+imV5P6ArDXFqwBhwqYBQRB71HJyKg73pKstYluxDN6C
kYhgslCKXGXcDe/xZNDprv+2/5bugG1ZumhHJLem+QBemeVxwB+eVzICX9W7rENM
9v6jNx023KIDJFqeSCq3NWalBdqbG5UagAuVbK+i7VlwkrGlhdFpugH5cNes6hxb
BxBeuLJ94UkrtgQx4oh7oM3+eac0NM4GT5BaQEweHJ8ZUT3h/Ps=
=wI4A
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBYIJBYONLKJtyKPYoAQjJ3A//cwaGjiqHoRCzWSdiG2ePZQSXoeVaRNTu
FGEdtAWnclTLihSbnJQMb2Yo3i6goVNPEvMIuKfuqdM6lqAY14qUxoOsYSZ3GFVQ
hKETbcmEVk1nqQIkOV8H01WhBoZNxZllkLCDC5KFXcPDEHww3Z8Yfl8tZTY0y8D+
dTP6t2TAGtzUbh2ji1jfUQS3QnKiX6zC+z98IQttBzpFfyGZHYdUvViatmONWEyC
qMIz99Iw8wlFN7ACMzI5oDW1I+UiVr9YS6ihb3quwSHgPfuhuVCMH1/mflCPreVi
fjCK+SAYFx8TlCp+nqw5MDqZiLxvtOhA0uhBd0FpiHynt4CsgNZvsbzYPJFh/Eux
UY7u6234Jlk2WNPxfleC78Qipo2PRyDcmYdaXuEK4ij/vFfPXzAGI+6xRergSMqo
9BIc3XN/QExPs4MSD2R+ryIzvF0H5E7+pNqKFs62lv/2twrPpMxdRl+a+UWNsGu9
VoTsp6Tcv8dyo63CHsin7S0GsR9DK3xksuMzfsTokk6P90VrAsJ5MRgJvzqGD9U9
Jf9Zwrag+n3KZJV3tlI22LuiqKrXpjOH+nGpb1VlIZdW0RAr5up03Cc2rvTEuWPA
dBTeHiTyC+23v5v6XaqCURsaqxSHFy7ghTxb1kQv8dkheYQK25LLset+Cddo0/kt
PllXnbc6Jag=
=9aUV
-----END PGP SIGNATURE-----