SB2021060417 - SUSE update for MozillaThunderbird
Published: June 4, 2021
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 4 secuirty vulnerabilities.
1) Cleartext storage of sensitive information (CVE-ID: CVE-2021-29950)
The vulnerability allows a local user to gain access to sensitive information.
The vulnerability exists due to the way Thunderbird handles secret OpenPGP keys. The application unprotects a secret OpenPGP key prior to using it for a decryption,
signing or key import task. If the task runs into a failure, the secret
key may remain in memory in its unprotected state. A local user or malicious application can read the key and use it to decrypt email messages.
2) Security restrictions bypass (CVE-ID: CVE-2021-29951)
The vulnerability allows a local user to bypass implemented security restrictions.
The vulnerability exists due to the way Mozilla Maintenance Service is installed in the Windows operating system. After installation the Mozilla Maintenance Service is granted SERVICE_START access to BUILTIN|Users which, in a domain network, grants normal remote users access to start or stop the service. A local domain user can spam the "Stop" command and prevent the browser update service from operating.
The vulnerability affects only Firefox ESR installed on operating system Windows 10 build 1709 and older.
3) Cleartext storage of sensitive information (CVE-ID: CVE-2021-29956)
The vulnerability allows a local user to gain access to sensitive information.
The vulnerability exists due to OpenPGP secret keys that were imported using Thunderbird. were stored unencrypted on the user's local disk. The master password protection was inactive for those keys. A local user can gain access to sensitive information.
4) Protection Mechanism Failure (CVE-ID: CVE-2021-29957)
The vulnerability allows a remote attacker to bypass implemented security restrictions.
The vulnerability exists due to insufficient implementation of security measures. If a MIME encoded email contains an OpenPGP inline signed or encrypted message part, but also contains an additional unprotected part, Thunderbird did not indicate that only parts of the message are protected.
Remediation
Install update from vendor's website.