This update for MozillaThunderbird fixes the following issues:
Security issues fixed:
- Update to MozillaThunderbird 60.6.1 (bsc#1130262):
- CVE-2019-9813: Fixed Ionmonkey type confusion with __proto__ mutations
- CVE-2019-9810: Fixed IonMonkey MArraySlice incorrect alias information
- Update to MozillaThunderbird 60.6 (bsc#1129821):
- CVE-2018-18506: Fixed an issue with Proxy Auto-Configuration file
- CVE-2019-9801: Fixed an issue which could allow Windows programs to be exposed to web content
- CVE-2019-9788: Fixed multiple memory safety bugs
- CVE-2019-9790: Fixed a Use-after-free vulnerability when removing in-use DOM elements
- CVE-2019-9791: Fixed an incorrect Type inference for constructors entered through on-stack replacement
with IonMonkey
- CVE-2019-9792: Fixed an issue where IonMonkey leaks JS_OPTIMIZED_OUT magic value to script
- CVE-2019-9793: Fixed multiple improper bounds checks when Spectre mitigations are disabled
- CVE-2019-9794: Fixed an issue where command line arguments not discarded during execution
- CVE-2019-9795: Fixed a Type-confusion vulnerability in IonMonkey JIT compiler
- CVE-2019-9796: Fixed a Use-after-free vulnerability in SMIL animation controller
Release notes:
https://www.mozilla.org/en-US/security/advisories/mfsa2019-12/
https://www.mozilla.org/en-US/security/advisories/mfsa2019-11/
- Submitted by Andreas Stieger (AndreasStieger)