249 lines
12 KiB
JSON
249 lines
12 KiB
JSON
{
|
||
"Definition": [
|
||
{
|
||
"ID": "oval:org.altlinux.errata:def:20212504",
|
||
"Version": "oval:org.altlinux.errata:def:20212504",
|
||
"Class": "patch",
|
||
"Metadata": {
|
||
"Title": "ALT-PU-2021-2504: package `thunderbird` update to version 78.13.0-alt1",
|
||
"AffectedList": [
|
||
{
|
||
"Family": "unix",
|
||
"Platforms": [
|
||
"ALT Linux branch c10f1"
|
||
],
|
||
"Products": [
|
||
"ALT SP Workstation",
|
||
"ALT SP Server"
|
||
]
|
||
}
|
||
],
|
||
"References": [
|
||
{
|
||
"RefID": "ALT-PU-2021-2504",
|
||
"RefURL": "https://errata.altlinux.org/ALT-PU-2021-2504",
|
||
"Source": "ALTPU"
|
||
},
|
||
{
|
||
"RefID": "BDU:2021-04068",
|
||
"RefURL": "https://bdu.fstec.ru/vul/2021-04068",
|
||
"Source": "BDU"
|
||
},
|
||
{
|
||
"RefID": "BDU:2021-04069",
|
||
"RefURL": "https://bdu.fstec.ru/vul/2021-04069",
|
||
"Source": "BDU"
|
||
},
|
||
{
|
||
"RefID": "BDU:2021-04070",
|
||
"RefURL": "https://bdu.fstec.ru/vul/2021-04070",
|
||
"Source": "BDU"
|
||
},
|
||
{
|
||
"RefID": "BDU:2021-04071",
|
||
"RefURL": "https://bdu.fstec.ru/vul/2021-04071",
|
||
"Source": "BDU"
|
||
},
|
||
{
|
||
"RefID": "BDU:2021-04072",
|
||
"RefURL": "https://bdu.fstec.ru/vul/2021-04072",
|
||
"Source": "BDU"
|
||
},
|
||
{
|
||
"RefID": "BDU:2021-04073",
|
||
"RefURL": "https://bdu.fstec.ru/vul/2021-04073",
|
||
"Source": "BDU"
|
||
},
|
||
{
|
||
"RefID": "CVE-2021-29980",
|
||
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2021-29980",
|
||
"Source": "CVE"
|
||
},
|
||
{
|
||
"RefID": "CVE-2021-29984",
|
||
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2021-29984",
|
||
"Source": "CVE"
|
||
},
|
||
{
|
||
"RefID": "CVE-2021-29985",
|
||
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2021-29985",
|
||
"Source": "CVE"
|
||
},
|
||
{
|
||
"RefID": "CVE-2021-29986",
|
||
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2021-29986",
|
||
"Source": "CVE"
|
||
},
|
||
{
|
||
"RefID": "CVE-2021-29988",
|
||
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2021-29988",
|
||
"Source": "CVE"
|
||
},
|
||
{
|
||
"RefID": "CVE-2021-29989",
|
||
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2021-29989",
|
||
"Source": "CVE"
|
||
}
|
||
],
|
||
"Description": "This update upgrades thunderbird to version 78.13.0-alt1. \nSecurity Fix(es):\n\n * BDU:2021-04068: Уязвимость браузера Mozilla Firefox, позволяющая нарушителю выполнить произвольный код в целевой системе\n\n * BDU:2021-04069: Уязвимость веб-браузеров Firefox, Firefox ESR, почтового клиента Thunderbird, связанная с возникновением конфликта интерпретаций, позволяющая нарушителю получить доступ к конфиденциальным данным, нарушить их целостность, а также вызвать отказ в обслуживании\n\n * BDU:2021-04070: Уязвимость браузера Mozilla Firefox, позволяющая нарушителю выполнить произвольный код в целевой системе\n\n * BDU:2021-04071: Уязвимость браузера Mozilla Firefox, позволяющая нарушителю выполнить произвольный код в целевой системе\n\n * BDU:2021-04072: Уязвимость метода MediaCacheStream::NotifyDataReceived почтового клиента Thunderbird, браузеров Firefox и Firefox ESR, позволяющая нарушителю выполнить произвольный код в целевой системе\n\n * BDU:2021-04073: Уязвимость браузера Mozilla Firefox, позволяющая нарушителю выполнить произвольный код в целевой системе\n\n * CVE-2021-29980: Uninitialized memory in a canvas object could have caused an incorrect free() leading to memory corruption and a potentially exploitable crash. This vulnerability affects Thunderbird \u003c 78.13, Thunderbird \u003c 91, Firefox ESR \u003c 78.13, and Firefox \u003c 91.\n\n * CVE-2021-29984: Instruction reordering resulted in a sequence of instructions that would cause an object to be incorrectly considered during garbage collection. This led to memory corruption and a potentially exploitable crash. This vulnerability affects Thunderbird \u003c 78.13, Thunderbird \u003c 91, Firefox ESR \u003c 78.13, and Firefox \u003c 91.\n\n * CVE-2021-29985: A use-after-free vulnerability in media channels could have led to memory corruption and a potentially exploitable crash. This vulnerability affects Thunderbird \u003c 78.13, Thunderbird \u003c 91, Firefox ESR \u003c 78.13, and Firefox \u003c 91.\n\n * CVE-2021-29986: A suspected race condition when calling getaddrinfo led to memory corruption and a potentially exploitable crash. *Note: This issue only affected Linux operating systems. Other operating systems are unaffected.* This vulnerability affects Thunderbird \u003c 78.13, Thunderbird \u003c 91, Firefox ESR \u003c 78.13, and Firefox \u003c 91.\n\n * CVE-2021-29988: Firefox incorrectly treated an inline list-item element as a block element, resulting in an out of bounds read or memory corruption, and a potentially exploitable crash. This vulnerability affects Thunderbird \u003c 78.13, Thunderbird \u003c 91, Firefox ESR \u003c 78.13, and Firefox \u003c 91.\n\n * CVE-2021-29989: Mozilla developers reported memory safety bugs present in Firefox 90 and Firefox ESR 78.12. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Thunderbird \u003c 78.13, Firefox ESR \u003c 78.13, and Firefox \u003c 91.",
|
||
"Advisory": {
|
||
"From": "errata.altlinux.org",
|
||
"Severity": "High",
|
||
"Rights": "Copyright 2024 BaseALT Ltd.",
|
||
"Issued": {
|
||
"Date": "2021-08-12"
|
||
},
|
||
"Updated": {
|
||
"Date": "2021-08-12"
|
||
},
|
||
"BDUs": [
|
||
{
|
||
"ID": "BDU:2021-04068",
|
||
"CVSS": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
|
||
"CVSS3": "AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
|
||
"CWE": "CWE-119",
|
||
"Href": "https://bdu.fstec.ru/vul/2021-04068",
|
||
"Impact": "High",
|
||
"Public": "20210810"
|
||
},
|
||
{
|
||
"ID": "BDU:2021-04069",
|
||
"CVSS": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
|
||
"CVSS3": "AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
|
||
"CWE": "CWE-125",
|
||
"Href": "https://bdu.fstec.ru/vul/2021-04069",
|
||
"Impact": "High",
|
||
"Public": "20210810"
|
||
},
|
||
{
|
||
"ID": "BDU:2021-04070",
|
||
"CVSS": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
|
||
"CVSS3": "AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
|
||
"CWE": "CWE-119",
|
||
"Href": "https://bdu.fstec.ru/vul/2021-04070",
|
||
"Impact": "High",
|
||
"Public": "20210810"
|
||
},
|
||
{
|
||
"ID": "BDU:2021-04071",
|
||
"CVSS": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
|
||
"CVSS3": "AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
|
||
"CWE": "CWE-119",
|
||
"Href": "https://bdu.fstec.ru/vul/2021-04071",
|
||
"Impact": "High",
|
||
"Public": "20210810"
|
||
},
|
||
{
|
||
"ID": "BDU:2021-04072",
|
||
"CVSS": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
|
||
"CVSS3": "AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
|
||
"CWE": "CWE-416",
|
||
"Href": "https://bdu.fstec.ru/vul/2021-04072",
|
||
"Impact": "High",
|
||
"Public": "20210810"
|
||
},
|
||
{
|
||
"ID": "BDU:2021-04073",
|
||
"CVSS": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
|
||
"CVSS3": "AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
|
||
"CWE": "CWE-119",
|
||
"Href": "https://bdu.fstec.ru/vul/2021-04073",
|
||
"Impact": "High",
|
||
"Public": "20210810"
|
||
}
|
||
],
|
||
"CVEs": [
|
||
{
|
||
"ID": "CVE-2021-29980",
|
||
"CVSS": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
|
||
"CVSS3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
|
||
"CWE": "CWE-909",
|
||
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2021-29980",
|
||
"Impact": "High",
|
||
"Public": "20210817"
|
||
},
|
||
{
|
||
"ID": "CVE-2021-29984",
|
||
"CVSS": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
|
||
"CVSS3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
|
||
"CWE": "CWE-787",
|
||
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2021-29984",
|
||
"Impact": "High",
|
||
"Public": "20210817"
|
||
},
|
||
{
|
||
"ID": "CVE-2021-29985",
|
||
"CVSS": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
|
||
"CVSS3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
|
||
"CWE": "CWE-416",
|
||
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2021-29985",
|
||
"Impact": "High",
|
||
"Public": "20210817"
|
||
},
|
||
{
|
||
"ID": "CVE-2021-29986",
|
||
"CVSS": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
|
||
"CVSS3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
||
"CWE": "CWE-362",
|
||
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2021-29986",
|
||
"Impact": "High",
|
||
"Public": "20210817"
|
||
},
|
||
{
|
||
"ID": "CVE-2021-29988",
|
||
"CVSS": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
|
||
"CVSS3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
|
||
"CWE": "CWE-125",
|
||
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2021-29988",
|
||
"Impact": "High",
|
||
"Public": "20210817"
|
||
},
|
||
{
|
||
"ID": "CVE-2021-29989",
|
||
"CVSS": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
|
||
"CVSS3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
|
||
"CWE": "CWE-787",
|
||
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2021-29989",
|
||
"Impact": "High",
|
||
"Public": "20210817"
|
||
}
|
||
],
|
||
"AffectedCPEs": {
|
||
"CPEs": [
|
||
"cpe:/o:alt:spworkstation:10",
|
||
"cpe:/o:alt:spserver:10"
|
||
]
|
||
}
|
||
}
|
||
},
|
||
"Criteria": {
|
||
"Operator": "AND",
|
||
"Criterions": [
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:4001",
|
||
"Comment": "ALT Linux must be installed"
|
||
}
|
||
],
|
||
"Criterias": [
|
||
{
|
||
"Operator": "OR",
|
||
"Criterions": [
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:20212504001",
|
||
"Comment": "rpm-build-thunderbird is earlier than 0:78.13.0-alt1"
|
||
},
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:20212504002",
|
||
"Comment": "thunderbird is earlier than 0:78.13.0-alt1"
|
||
},
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:20212504003",
|
||
"Comment": "thunderbird-wayland is earlier than 0:78.13.0-alt1"
|
||
}
|
||
]
|
||
}
|
||
]
|
||
}
|
||
}
|
||
]
|
||
} |