File _patchinfo of Package patchinfo.36467

<patchinfo incident="36467">
  <issue tracker="bnc" id="1231879">VUL-0: MozillaFirefox / MozillaThunderbird: update to 132 and 128.4esr</issue>
  <issue tracker="bnc" id="1233355">VUL-0: CVE-2024-11159: MozillaThunderbird: update to 128.4.3 and 132.0.1</issue>
  <issue tracker="cve" id="2024-10464"/>
  <issue tracker="cve" id="2024-10467"/>
  <issue tracker="cve" id="2024-10466"/>
  <issue tracker="cve" id="2024-10461"/>
  <issue tracker="cve" id="2024-10465"/>
  <issue tracker="cve" id="2024-11159"/>
  <issue tracker="cve" id="2024-10458"/>
  <issue tracker="cve" id="2024-10463"/>
  <issue tracker="cve" id="2024-10460"/>
  <issue tracker="cve" id="2024-10462"/>
  <issue tracker="cve" id="2024-10459"/>
  <packager>MSirringhaus</packager>
  <rating>critical</rating>
  <category>security</category>
  <summary>Security update for MozillaThunderbird</summary>
  <description>This update for MozillaThunderbird fixes the following issues:

- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable
  * fixed: Message corruption could be propagated when reading mbox
  * fixed: Folder compaction was not abandoned on shutdown
  * fixed: Folder compaction did not clean up on failure
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded
  * fixed: Applying column view to folder and children could
    break if folder error occurred
  * fixed: Remote content notifications were broken with
    encrypted messages
  * fixed: Updating criteria of a saved search resulted in poor
    search performance
  * fixed: Drop-downs may not work in some places
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 Potential disclosure of plaintext in OpenPGP encrypted message

- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction
  * fixed: New profile creation caused console errors
  * fixed: Repair folder could result in older messages showing
    wrong date and time
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed
  * fixed: Visual and UX improvements
  * fixed: Clicking on an HTML button could cause Thunderbird to freeze
  * fixed: Messages could not be selected for dragging
  * fixed: Could not open attached file in a MIME encrypted message
  * fixed: Account creation "Setup Documentation" link was broken
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile
  * fixed: Could not drag all-day events from one day to another
    in week view

- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal

- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message
  * fixed: Thunderbird update did not update language pack
    version until another restart
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 Permission leak via embed or object elements
  * CVE-2024-10459 Use-after-free in layout with accessibility
  * CVE-2024-10460 Confusing display of origin for external protocol handler prompt
  * CVE-2024-10461 XSS due to Content-Disposition being ignored in multipart/x-mixed-replace response
  * CVE-2024-10462 Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 Cross origin video frame leak
  * CVE-2024-10464 History interface could have been used to cause a Denial of Service condition in the browser
  * CVE-2024-10465 Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 DOM push subscription message could hang Firefox
  * CVE-2024-10467 Memory safety bugs fixed in Firefox 132, Thunderbird 132, Firefox ESR 128.4, and Thunderbird 128.4
</description>
</patchinfo>