MX-17/18 Repository: The Thunderbird Thread

[mmikeinsantarosa]

thunderbird_60.5.1 is up and ready for download from MX test.

There were 5 High security issues fixed in this release.

Check the release notes page for more info.

- mike

[Eadwine Rose]

Installed it, looks like it's working fine :) Thanks!

[Eadwine Rose]

Just a heads up, from another topic, 60.5.2 is having issues.

https://support.mozilla.org/bm/questions/1251572

[mmikeinsantarosa]

Just a heads up, from another topic, 60.5.2 is having issues.

https://support.mozilla.org/bm/questions/1251572

thanks Eadwine.

[Kulmbacher]

Mozilla’s e-mail client Thunderbird 60.5.2 has been pulled, due to a major bug in Windows. Here are a few details, what went downhill and what ‘has been pulled’ mean.

https://borncity.com/win/2019/03/04/thu ... ch-5-2019/

just Windows ...

[Eadwine Rose]

Considering the new TB has enough issues with a number of users here it cannot hurt to be careful nor to report things when you see them.

[mmikeinsantarosa]

The test repo has just been updated with thunderbird-60.6.1

There were 2 critical security issues fixed in this release:

Security vulnerabilities fixed in Thunderbird 60.6.1

In general, these flaws cannot be exploited through email in the Thunderbird product because scripting is disabled when reading mail, but are potentially risks in browser or browser-like contexts.

#CVE-2019-9810: IonMonkey MArraySlice has incorrect alias information

Incorrect alias information in IonMonkey JIT compiler for Array.prototype.slice method may lead to missing bounds check and a buffer overflow.
References

Bug 1537924

#CVE-2019-9813: Ionmonkey type confusion with __proto__ mutations

Incorrect handling of __proto__ mutations may lead to type confusion in IonMonkey JIT code and can be leveraged for arbitrary memory read and write.
References

Bug 1538006

And finally, the release notes are here.

Please post any test results here.

- mike

[mmikeinsantarosa]

Our test repository has just been updated with thunderbird-60.7.0

There were 13 High, 3 moderate and 1 critical security vulnerabilities fixed in this release:

CVE-2019-9800: Memory safety bugs fixed in Firefox 67, Firefox ESR 60.7, and Thunderbird 60.7
Description
Mozilla developers and community members Olli Pettay, Bogdan Tara, Jan de Mooij, Jason Kratzer, Jan Varga, Gary Kwong, Tim Guan-tin Chien, Tyson Smith, Ronald Crane, and Ted Campbell reported memory safety bugs present in Firefox 66, Firefox ESR 60.6, and Thunderbird 60.6. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code.

You can peruse the release notes page here.

Please post any testing results here.

- mike

[srq2625]

BLUF:
Installed, tested --> seems to be just fine.

BACKGROUND:
Backed up my .thunderbird folder (just in case things went all pear-shaped) and installed (actually upgraded) to 60.7.0 (64-bit) using the MX Package Installer. Started the app. It did it's usual Mozilla thing of verifying components and then was up and running. A quick 10 minutes of testing (getting/sending/reading messages) and I really can't tell the difference between this and what it replaced (version 52??).

[mmikeinsantarosa]

We have 52.9 in main and had 60.6.1 in test. So it would have been from either of these 2. We're keeping the 52.9 in main because the add-in/on mechanism changed after this release and some of our users preferred the older setup. I run the latest to make sure I have all the security fixes in place. - mike