Bug 794085 – <mail-client/thunderbird{,-bin}-78.11.0: multiple vulnerabilities

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description John Helmert III 2021-06-04 02:07:08 UTC]

See tracker for details. Highest severity bug is CVE-2021-29967:

Mozilla developers Gabriele Svelto, Anny Gakhokidze, Alexandru Michis, Christian Holler reported memory safety bugs present in Thunderbird 78.11. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.


Please bump.

[Comment 1 Larry the Git Cow 2021-06-13 18:21:50 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=1b33bd010bb2bafafa59f687284ce55430ce0cc8

commit 1b33bd010bb2bafafa59f687284ce55430ce0cc8
Author:     Thomas Deutschmann <[e-mail]>
AuthorDate: 2021-06-13 13:55:32 +0000
Commit:     Thomas Deutschmann <[e-mail]>
CommitDate: 2021-06-13 18:19:33 +0000

    mail-client/thunderbird-bin: security cleanup
    
    Bug: https://bugs.gentoo.org/794085
    Package-Manager: Portage-3.0.19, Repoman-3.0.3
    Signed-off-by: Thomas Deutschmann <[e-mail]>

 mail-client/thunderbird-bin/Manifest               |  66 ----
 .../thunderbird-bin/thunderbird-bin-78.10.2.ebuild | 378 ---------------------
 2 files changed, 444 deletions(-)

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=10fb5de39e4f33f808fe123374169f2e3af11361

commit 10fb5de39e4f33f808fe123374169f2e3af11361
Author:     Thomas Deutschmann <[e-mail]>
AuthorDate: 2021-06-13 13:54:55 +0000
Commit:     Thomas Deutschmann <[e-mail]>
CommitDate: 2021-06-13 18:19:33 +0000

    mail-client/thunderbird: security cleanup
    
    Bug: https://bugs.gentoo.org/794085
    Package-Manager: Portage-3.0.19, Repoman-3.0.3
    Signed-off-by: Thomas Deutschmann <[e-mail]>

 mail-client/thunderbird/Manifest                   |   66 --
 mail-client/thunderbird/thunderbird-78.10.2.ebuild | 1108 --------------------
 2 files changed, 1174 deletions(-)

[addCollapseLink(2, 1, 'Toggle comment display'); Comment 2 NATTkA bot 2021-07-23 19:08:22 UTC Comment hidden (obsolete)]

Unable to check for sanity:

> no match for package: mail-client/thunderbird-78.11.0

[addCollapseLink(3, 1, 'Toggle comment display'); Comment 3 NATTkA bot 2021-07-29 17:21:55 UTC Comment hidden (obsolete)]

Package list is empty or all packages have requested keywords.

[addCollapseLink(4, 1, 'Toggle comment display'); Comment 4 NATTkA bot 2021-07-29 17:30:06 UTC Comment hidden (obsolete)]

Package list is empty or all packages have requested keywords.

[addCollapseLink(5, 1, 'Toggle comment display'); Comment 5 NATTkA bot 2021-07-29 17:38:04 UTC Comment hidden (obsolete)]

Package list is empty or all packages have requested keywords.

[addCollapseLink(6, 1, 'Toggle comment display'); Comment 6 NATTkA bot 2021-07-29 17:46:11 UTC Comment hidden (obsolete)]

Package list is empty or all packages have requested keywords.

[addCollapseLink(7, 1, 'Toggle comment display'); Comment 7 NATTkA bot 2021-07-29 18:02:08 UTC Comment hidden (obsolete)]

Package list is empty or all packages have requested keywords.

[Comment 8 NATTkA bot 2021-07-29 18:10:27 UTC]

Package list is empty or all packages have requested keywords.

[Comment 9 Larry the Git Cow 2022-08-10 04:18:43 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/data/glsa.git/commit/?id=8856093f804feeda5fe9097d49ba3307aaefc9c2

commit 8856093f804feeda5fe9097d49ba3307aaefc9c2
Author:     GLSAMaker <[e-mail]>
AuthorDate: 2022-08-10 04:08:55 +0000
Commit:     John Helmert III <[e-mail]>
CommitDate: 2022-08-10 04:17:36 +0000

    [ GLSA 202208-14 ] Mozilla Thunderbird: Multiple Vulnerabilities
    
    Bug: https://bugs.gentoo.org/794085
    Bug: https://bugs.gentoo.org/802759
    Bug: https://bugs.gentoo.org/807943
    Bug: https://bugs.gentoo.org/811912
    Bug: https://bugs.gentoo.org/813501
    Bug: https://bugs.gentoo.org/822294
    Bug: https://bugs.gentoo.org/828539
    Bug: https://bugs.gentoo.org/831040
    Bug: https://bugs.gentoo.org/833520
    Bug: https://bugs.gentoo.org/834805
    Bug: https://bugs.gentoo.org/845057
    Bug: https://bugs.gentoo.org/846596
    Bug: https://bugs.gentoo.org/849047
    Bug: https://bugs.gentoo.org/857048
    Bug: https://bugs.gentoo.org/864577
    Signed-off-by: GLSAMaker <[e-mail]>
    Signed-off-by: John Helmert III <[e-mail]>

 glsa-202208-14.xml | 165 +++++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 165 insertions(+)

[Comment 10 John Helmert III 2022-08-10 04:26:44 UTC]

GLSA released, all done!