4a103ac86f- Mozilla Thunderbird 78.3.2 * OpenPGP: Improved support for encrypting with subkeys * OpenPGP: Encrypted messages with international characters were sometimes displayed incorrectly * Single-click deletion of recipient pills with middle mouse button restored * Searching an address book list did not display results * Dark mode, high contrast, and Windows theming fixes
Wolfgang Rosenauer
2020-10-07 09:44:38 +00:00
c90bbb3be9- Mozilla Thunderbird 78.3.1 * fix crash in nsImapProtocol::CreateNewLineFromSocket (bmo#1667120)
Wolfgang Rosenauer
2020-09-25 06:32:50 +00:00
85d782a0f4- Mozilla Thunderbird 68.12.0 MFSA 2020-40 (bsc#1175686) * CVE-2020-15663 (bmo#1643199) Downgrade attack on the Mozilla Maintenance Service could have resulted in escalation of privilege * CVE-2020-15664 (bmo#1658214) Attacker-induced prompt for extension installation * CVE-2020-15669 (bmo#1656957) Use-After-Free when aborting an operation
Wolfgang Rosenauer
2020-08-30 11:12:59 +00:00
b774973e49Accepting request 830280 from home:michel_mno:branches:mozilla:Factory
Wolfgang Rosenauer
2020-08-30 11:02:29 +00:00
56310e4a94- Mozilla Thunderbird 68.6.0 MFSA 2020-10 (bsc#1166238) * CVE-2020-6805 (bmo#1610880) Use-after-free when removing data about origins * CVE-2020-6806 (bmo#1612308) BodyStream::OnInputStreamReady was missing protections against state confusion * CVE-2020-6807 (bmo#1614971) Use-after-free in cubeb during stream destruction * CVE-2020-6811 (bmo#1607742) Devtools' 'Copy as cURL' feature did not fully escape website-controlled data, potentially leading to command injection * CVE-2019-20503 (bmo#1613765) Out of bounds reads in sctp_load_addresses_from_init * CVE-2020-6812 (bmo#1616661) The names of AirPods with personally identifiable information were exposed to websites with camera or microphone permission * CVE-2020-6814 (bmo#1592078, bmo#1604847, bmo#1608256, bmo#1612636, bmo#1614339) Memory safety bugs fixed in Thunderbird 68.6 - requires NSS >= 3.44.3
Wolfgang Rosenauer
2020-03-14 13:26:42 +00:00
1afcee9271Accepting request 773527 from mozilla:Factory
Oliver Kurz
2020-02-14 15:23:55 +00:00
b44fdf6e1e- Mozilla Thunderbird 68.5.0 New * Support for Client Identity IMAP/SMTP Service Extension * Support for OAuth 2.0 authentication for POP3 accounts Fixes * Status area goes blank during account setup * Calendar: Could not remove color for default categories * Calendar: Prevent calendar component loading multiple times * Calendar: Today pane did not retain width between sessions MFSA 2020-07 (bsc#1163368) * CVE-2020-6793 (bmo#1608539) Out-of-bounds read when processing certain email messages * CVE-2020-6794 (bmo#1606619) Setting a master password post-Thunderbird 52 does not delete unencrypted previously stored passwords * CVE-2020-6795 (bmo#1611105) Crash processing S/MIME messages with multiple signatures * CVE-2020-6797 (bmo#1596668) (Mac OSX only) Extensions granted downloads.open permission could open arbitrary applications on Mac OSX * CVE-2020-6798 (bmo#1602944) Incorrect parsing of template tag could result in JavaScript injection * CVE-2020-6792 (bmo#1609607) Message ID calculcation was based on uninitialized data * CVE-2020-6800 (bmo#1595786,bmo#1596706,bmo#1598543,bmo#1604851, bmo#1608580,bmo#1608785,bmo#1605777) Memory safety bugs fixed in Thunderbird 68.5
Wolfgang Rosenauer
2020-02-11 20:44:27 +00:00
88ea2f535a- Mozilla Thunderbird 68.4.2 * Calendar: Task and Event tree colours adjusted for the dark theme * Retrieval of S/MIME certificates from LDAP failed * Address-parsing crash on some IMAP servers when mail.imap.use_envelope_cmd is set * Incorrect forwarding of HTML messages caused SMTP servers to respond with a timeout * Calendar: Various parts of the calendar UI stopped working when a second Thunderbird window opened
Wolfgang Rosenauer
2020-01-27 10:15:48 +00:00
c3ae989234- removed obsolete patch mozilla-bmo1511604.patch - added mozilla-bmo1602730.patch to fix LE<->BE issues in the platform (bmo#1602730)
Wolfgang Rosenauer
2020-01-11 08:43:34 +00:00
424175f38cMFSA 2020-04 (bsc#1160498, bsc#1160305)
Wolfgang Rosenauer
2020-01-11 08:36:41 +00:00
5d0ef2ba91- Mozilla Thunderbird 68.4.1 * Various improvements when setting up an account for a Microsoft Exchange server: Now offers IMAP/SMTP if available, better detection for Office 365 accounts; re-run configuration after password change Fixes: * After changing view layout, the message display pane showed garbled content under some circumstances * Various theme changes to achieve "pixel perfection": Unread icon, "no results" icon, paragraph format and font selector, background of folder summary tooltip * Tags were lost on messages in shared IMAP folders under some circumstances * Calendar: Event attendee dialog was not displayed correctly MFSA 2020-04 (bsc#1160498) * CVE-2019-17026 (bmo#1607443) IonMonkey type confusion with StoreElementHole and FallibleStoreElement * CVE-2019-17015 (bmo#1599005) Memory corruption in parent process during new content process initialization on Windows * CVE-2019-17016 (bmo#1599181) Bypass of @namespace CSS sanitization during pasting * CVE-2019-17017 (bmo#1603055) Type Confusion in XPCVariant.cpp * CVE-2019-17021 (bmo#1599008) Heap address disclosure in parent process during content process initialization on Windows * CVE-2019-17022 (bmo#1602843) CSS sanitization does not escape HTML tags * CVE-2019-17024 (bmo#1507180, bmo#1595470, bmo#1598605, bmo#1601826)
Wolfgang Rosenauer
2020-01-10 15:53:07 +00:00
1c4a233447- add mozilla-bmo1583471.patch to allow building with rust 1.39
Wolfgang Rosenauer
2019-12-27 17:27:22 +00:00
8e55c5b577- Mozilla Thunderbird 68.3.1 * In dark theme unread messages no longer shown in blue to Bugfixes * Message navigation with backward and forward buttons did not work in some circumstances
Wolfgang Rosenauer
2019-12-20 22:23:27 +00:00
82acc8435aAccepting request 758641 from home:AndreasStieger:branches:mozilla:Factory
Wolfgang Rosenauer
2019-12-20 22:19:58 +00:00
7a99e99658- Mozilla Thunderbird 68.3.0: * Message display toolbar action WebExtension API * Navigation buttons are now available in content tabs, for example those opened via an add-on search * other bugfixes MFSA 2019-38 * CVE-2019-17008 (bmo#1546331) Use-after-free in worker destruction * CVE-2019-13722 (bmo#1580156) Stack corruption due to incorrect number of arguments in WebRTC code * CVE-2019-17010 (bmo#1581084) Use-after-free when performing device orientation checks * CVE-2019-17005 (bmo#1584170) Buffer overflow in plain text serializer * CVE-2019-17011 (bmo#1591334) Use-after-free when retrieving a document in antitracking * CVE-2019-17012 (bmo#1449736, bmo#1533957, bmo#1560667, bmo#1567209, bmo#1580288, bmo#1585760, bmo#1592502) Memory safety bugs fixed in Firefox 71 and Firefox ESR 68.3 * Various updates to improve performance and stability - updated create-tar.sh to cover buildid and origin repo information - changed locale building procedure * removed obsolete compare-locales.tar.xz and thunderbird-broken-locales-build.patch - add mozilla-bmo849632.patch to fix color issues on big endian
Wolfgang Rosenauer
2019-12-05 22:21:05 +00:00
c11ba0a0ad- Mozilla Thunderbird 68.2.1 * A language for the user interface can now be chosen in the advanced settings (multilingual UI) * Fixed problem with Google authentication (OAuth2) * Selected or unread messages were not shown in the correct color in the thread pane (message list) under some circumstances * When using a language pack, names of standard folders weren't localized (boo#1149126) * Address book default startup directory in preferences panel was not persisted * Chat: Extended context menu on Instant messaging status dialog (Show Accounts) - added mozilla-bmo1504834-part4.patch to fix some visual issues on big endian platforms
Wolfgang Rosenauer
2019-11-01 13:32:38 +00:00
6fd5201f1c- Mozilla Thunderbird 68.2.0 * Message Display WebExtension API * Message Search WebExtension API * Better visual feedback for unread messages when using the dark theme * Fixed various issues when editing mailing list * Fixed application windows not maintaining their size after restart MFSA 2019-33 (bsc#1154738) * CVE-2019-15903 (bmo#1584907) Heap overflow in expat library in XML_GetCurrentLineNumber * CVE-2019-11757 (bmo#1577107) Use-after-free when creating index updates in IndexedDB * CVE-2019-11758 (bmo#1536227) Potentially exploitable crash due to 360 Total Security * CVE-2019-11759 (bmo#1577953) Stack buffer overflow in HKDF output * CVE-2019-11760 (bmo#1577719) Stack buffer overflow in WebRTC networking * CVE-2019-11761 (bmo#1561502) Unintended access to a privileged JSONView object * CVE-2019-11762 (bmo#1582857) document.domain-based origin isolation has same-origin-property violation * CVE-2019-11763 (bmo#1584216) Incorrect HTML parsing results in XSS bypass technique * CVE-2019-11764 (bmo#1558522, bmo#1577061, bmo#1548044, bmo#1571223, bmo#1573048, bmo#1578933, bmo#1575217, bmo#1583684, bmo#1586845, bmo#1581950, bmo#1583463, bmo#1586599) Memory safety bugs fixed in Firefox 70 and Firefox ESR 68.2 - removed obsolete patches mozilla-bmo1573381.patch mozilla-bmo1512162.patch
Wolfgang Rosenauer
2019-10-23 13:33:15 +00:00
44771bf8fd- Mozilla Thunderbird 68.1.2 Bugfixes * Some attachments couldn't be opened in messages originating from MS Outlook 2016 * Address book import from CSV * Performance problem in message body search * Ctrl+Enter to send a message would open an attachment if the attachment pane had focus * Calendar: Issues with "Today Pane" start-up * Calendar: Glitches with custom repeat and reminder number input * Calendar: Problems with WCAP provider - add mozilla-bmo1585099.patch to fix build with rust >= 1.38
Wolfgang Rosenauer
2019-10-11 12:48:56 +00:00
7583f45f65Accepting request 733853 from home:AndreasStieger:branches:mozilla:Factory
Wolfgang Rosenauer
2019-09-28 14:45:00 +00:00
d20afb31b3MFSA 2019-32 * CVE-2019-11755 (bmo#1240290) Spoofing a message author via a crafted S/MIME message
Wolfgang Rosenauer
2019-09-26 19:04:16 +00:00
3a3fedfe3fmozilla-bmo1512162.patch thunderbird-broken-locales-build.patch thunderbird-locale-build.patch
Wolfgang Rosenauer
2019-09-26 08:29:27 +00:00
7920c81c06- Mozilla Thunderbird 68.1.1 Bugfixes * Issues with attachments in IMAP messages * Gmail accounts ignored a non-standard trash folder selection * Entering/pasting lists of recipients into the addressing widget or mailing list not working reliably, especially when lists contained multiple commas or semicolons * Edit mailing list not working * Various theme fixes, especially dark theme improvements for Calendar * Contrast between tag label and background not optimal * Account Central pane always loaded at start-up * "Config Editor" button not removed if blocked by policy * Calendar: Free/busy information in attendees dialog not scrolled correctly. Note: Scroll arrows still not behaving correctly - require nodejs8 instead of generic nodejs for better cross-distribution support - call desktop database update on install - updated translations-other locale list - build correct ICU for Big Endian - remove kde.js since disabling instantApply breaks extensions and is obsolete with the move to HTML views for preferences (boo#1151186) - update create-tar.sh to latest revision and adjust tar_stamps - added platform patches from Firefox 68esr mozilla-bmo1005535.patch mozilla-bmo1463035.patch mozilla-bmo1504834-part1.patch mozilla-bmo1504834-part2.patch mozilla-bmo1504834-part3.patch mozilla-bmo1511604.patch mozilla-bmo1554971.patch
Wolfgang Rosenauer
2019-09-25 15:13:22 +00:00
f56d76b94fAccepting request 732309 from home:AndreasStieger:branches:mozilla:Factory
Wolfgang Rosenauer
2019-09-21 15:27:38 +00:00
22ec736272Accepting request 732226 from home:munix9
Wolfgang Rosenauer
2019-09-20 17:52:56 +00:00
28408893c0Accepting request 732134 from home:marxin:branches:mozilla:Factory
Wolfgang Rosenauer
2019-09-20 11:19:56 +00:00
558b06a6a9Accepting request 732106 from home:bmwiedemann:branches:mozilla:Factory
Wolfgang Rosenauer
2019-09-20 10:17:10 +00:00
e07044c22bAccepting request 730872 from mozilla:FactoryYuchen Lin2019-09-18 11:06:13 +00:00
08fe2a30d3- Mozilla Thunderbird 68.1.0 add-on is required for this account type. IMAP still exists as alternative. * several bugfixes MFSA 2019-30 * CVE-2019-11739 (bmo#1571481) Covert Content Attack on S/MIME encryption using a crafted multipart/alternative message * CVE-2019-11746 (bmo#1564449) Use-after-free while manipulating video * CVE-2019-11744 (bmo#1562033) XSS by breaking out of title and textarea elements using innerHTML * CVE-2019-11742 (bmo#1559715) Same-origin policy violation with SVG filters and canvas to steal * CVE-2019-11752 (bmo#1501152) Use-after-free while extracting a key value in IndexedDB * CVE-2019-11743 (bmo#1560495) Cross-origin access to unload event attributes * CVE-2019-11740 (bmo#1563133,bmo#1573160) Memory safety bugs fixed in Firefox 69, Firefox ESR 68.1, and Firefox ESR 60.9, Thunderbird 68.1, and Thunderbird 60.9 - removed upstreamed fix-build-after-y2038-changes-in-glibc.patch - added thunderbird-locale-build.patch to fix locale build
Wolfgang Rosenauer
2019-09-13 20:15:12 +00:00
b26a281145- Mozilla Thunderbird 60.9.0 * Offer to configure Exchange accounts for Office365. A third-party add-on is required for this account type. IMAP still exists as alternative. MFSA 2019-27 * Use-after-free while manipulating video CVE-2019-11746 (bmo#1564449) * XSS by breaking out of title and textarea elements using innerHTML CVE-2019-11744 (bmo#1562033) * Same-origin policy violation with SVG filters and canvas to steal cross-origin images CVE-2019-11742 (bmo#1559715) * Use-after-free while extracting a key value in IndexedDB CVE-2019-11752 (bmo#1501152) * Sandbox escape through Firefox Sync CVE-2019-9812 (bmo#1538008, bmo#1538015) * Cross-origin access to unload event attributes CVE-2019-11743 (bmo#1560495) Navigation-Timing Level 2 specification * Memory safety bugs fixed in Firefox 69, Firefox ESR 68.1, and Firefox ESR 60.9 CVE-2019-11740 (bmo#1563133, bmo#1573160)
Wolfgang Rosenauer
2019-09-06 12:24:37 +00:00
191740d32d- Mozilla Thunderbird 60.8.0 * Calendar: Problems when editing event times, some related to AM/PM setting in non-English locales MFSA 2019-23 (boo#1140868) * CVE-2019-9811 (bmo#1538007, bmo#1539598, bmo#1563327) Sandbox escape via installation of malicious languagepack * CVE-2019-11711 (bmo#1552541) Script injection within domain through inner window reuse * CVE-2019-11712 (bmo#1543804) Cross-origin POST requests can be made with NPAPI plugins by following 308 redirects * CVE-2019-11713 (bmo#1528481) Use-after-free with HTTP/2 cached stream * CVE-2019-11729 (bmo#1515342) Empty or malformed p256-ECDH public keys may trigger a segmentation fault * CVE-2019-11715 (bmo#1555523) HTML parsing error can contribute to content XSS * CVE-2019-11717 (bmo#1548306) Caret character improperly escaped in origins * CVE-2019-11719 (bmo#1540541) Out-of-bounds read when importing curve25519 private key * CVE-2019-11730 (bmo#1558299) Same-origin policy treats all files in a directory as having the same-origin * CVE-2019-11709 (bmo#1547266, bmo#1540759, bmo#1548822, bmo#1550498 bmo#1515052, bmo#1539219, bmo#1547757, bmo#1550498, bmo#1533522) Memory safety bugs fixed in Firefox 68 and Firefox ESR 60.8 and Thunderbird 60.8
Wolfgang Rosenauer
2019-07-12 06:49:32 +00:00
1bf9c22999Accepting request 714441 from home:bmwiedemann:branches:mozilla:Factory
Wolfgang Rosenauer
2019-07-11 13:06:47 +00:00
35447776a4- Mozilla Thunderbird 60.7.0 * Attachment pane of Write window no longer focussed when attaching files using a keyboard shortcut MFSA 2019-15 (boo#1135824) * CVE-2019-9815 (bmo#1546544) Disable hyperthreading on content JavaScript threads on macOS * CVE-2019-9816 (bmo#1536768) Type confusion with object groups and UnboxedObjects * CVE-2019-9817 (bmo#1540221) Stealing of cross-domain images using canvas * CVE-2019-9818 (bmo#1542581) (Windows only) Use-after-free in crash generation server * CVE-2019-9819 (bmo#1532553) Compartment mismatch with fetch API * CVE-2019-9820 (bmo#1536405) Use-after-free of ChromeEventHandler by DocShell * CVE-2019-11691 (bmo#1542465) Use-after-free in XMLHttpRequest * CVE-2019-11692 (bmo#1544670) Use-after-free removing listeners in the event listener manager * CVE-2019-11693 (bmo#1532525) Buffer overflow in WebGL bufferdata on Linux * CVE-2019-7317 (bmo#1542829) Use-after-free in png_image_free of libpng library * CVE-2019-9797 (bmo#1528909) Cross-origin theft of images with createImageBitmap * CVE-2018-18511 (bmo#1526218) Cross-origin theft of images with ImageBitmapRenderingContext * CVE-2019-11694 (bmo#1534196) (Windows only) Uninitialized memory memory leakage in Windows sandbox
Wolfgang Rosenauer
2019-05-25 20:31:48 +00:00
0f6a91aeeaAccepting request 697648 from mozilla:FactoryYuchen Lin2019-04-25 15:52:07 +00:00
35edb05724Accepting request 697618 from home:marxin:branches:mozilla:Factory
Wolfgang Rosenauer
2019-04-24 20:43:44 +00:00
3e2908cf21- Mozilla Thunderbird 60.6.1 MFSA 2019-12 (bsc#1130262) * CVE-2019-9810 (bmo#1537924) IonMonkey MArraySlice has incorrect alias information * CVE-2019-9813 (bmo#1538006) Ionmonkey type confusion with __proto__ mutations
Wolfgang Rosenauer
2019-03-27 16:08:50 +00:00
82c07d74ff- Mozilla Thunderbird 60.6.0 * Calendar: Can't create repeating event with end date when using certain time zones, for example Europe/Minsk * some minor bugfixes * using 60.6.0esr Mozilla platform (bsc#1129821)
Wolfgang Rosenauer
2019-03-20 21:48:06 +00:00
6fbce4789b- Mozilla Thunderbird 60.5.2 * UTF-8 support for MAPISendMail * Problem with S/MIME certificate verification when receiving email from Outlook (issue introduced in version 60.5.1)
Wolfgang Rosenauer
2019-02-26 17:37:51 +00:00
e33ebb5c9bAccepting request 676696 from mozilla:Factory
Stephan Kulow
2019-02-24 17:01:39 +00:00
e67981f7a0- Mozilla Thunderbird 60.5.1 * CalDav access to some servers not working MFSA 2019-06 (bsc#1125330) * CVE-2018-18356 bmo#1525817 Use-after-free in Skia * CVE-2019-5785 bmo#1525433 Integer overflow in Skia * CVE-2018-18335 bmo#1525815 Buffer overflow in Skia with accelerated Canvas 2D * CVE-2018-18509 bmo#1507218 S/MIME signature spoofing - Mozilla Thunderbird 60.5.0:
Wolfgang Rosenauer
2019-02-14 22:12:08 +00:00
46b2e6acbbAccepting request 669999 from mozilla:Factory
Stephan Kulow
2019-02-08 11:05:39 +00:00
Wolfgang Rosenauer
Dominique Leuenberger
Yuchen Lin
Oliver Kurz
Stephan Kulow