Security update for MozillaThunderbird SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2020:3642-1 Final 1 1 2020-12-07T12:30:26Z current 2020-12-07T12:30:26Z 2020-12-07T12:30:26Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for MozillaThunderbird This update for MozillaThunderbird fixes the following issues: - Mozilla Thunderbird was updated to 78.5.1 (MFSA 2020-53, bsc#1179530) - CVE-2020-26970: Fixed a stack overflow due to incorrect parsing of SMTP server response codes. - Various bug fixes The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2020-3642,SUSE-SLE-Product-WE-15-SP1-2020-3642 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2020/suse-su-20203642-1/ Link for SUSE-SU-2020:3642-1 https://lists.suse.com/pipermail/sle-security-updates/2020-December/007923.html E-Mail link for SUSE-SU-2020:3642-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1179530 SUSE Bug 1179530 https://www.suse.com/security/cve/CVE-2020-26970/ SUSE CVE CVE-2020-26970 page SUSE Linux Enterprise Workstation Extension 15 SP1 MozillaThunderbird-78.5.1-3.110.2 MozillaThunderbird-translations-common-78.5.1-3.110.2 MozillaThunderbird-translations-other-78.5.1-3.110.2 MozillaThunderbird-78.5.1-3.110.2 as a component of SUSE Linux Enterprise Workstation Extension 15 SP1 MozillaThunderbird-translations-common-78.5.1-3.110.2 as a component of SUSE Linux Enterprise Workstation Extension 15 SP1 MozillaThunderbird-translations-other-78.5.1-3.110.2 as a component of SUSE Linux Enterprise Workstation Extension 15 SP1 When reading SMTP server status codes, Thunderbird writes an integer value to a position on the stack that is intended to contain just one byte. Depending on processor architecture and stack layout, this leads to stack corruption that may be exploitable. This vulnerability affects Thunderbird < 78.5.1. CVE-2020-26970 SUSE Linux Enterprise Workstation Extension 15 SP1:MozillaThunderbird-78.5.1-3.110.2 SUSE Linux Enterprise Workstation Extension 15 SP1:MozillaThunderbird-translations-common-78.5.1-3.110.2 SUSE Linux Enterprise Workstation Extension 15 SP1:MozillaThunderbird-translations-other-78.5.1-3.110.2 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2020/suse-su-20203642-1/ https://www.suse.com/security/cve/CVE-2020-26970.html CVE-2020-26970 https://bugzilla.suse.com/1179530 SUSE Bug 1179530