<?xml version="1.0" encoding="UTF-8"?>
<cvrfdoc xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:cpe="http://cpe.mitre.org/language/2.0" xmlns:cvrf="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/cvrf" xmlns:cvrf-common="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/common" xmlns:cvssv2="http://scap.nist.gov/schema/cvss-v2/1.0" xmlns:cvssv3="https://www.first.org/cvss/cvss-v3.0.xsd" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:ns0="http://purl.org/dc/elements/1.1/" xmlns:prod="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/prod" xmlns:scap-core="http://scap.nist.gov/schema/scap-core/1.0" xmlns:sch="http://purl.oclc.org/dsdl/schematron" xmlns:vuln="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/cvrf">
  <DocumentTitle xml:lang="en">Security update for MozillaThunderbird</DocumentTitle>
  <DocumentType>SUSE Patch</DocumentType>
  <DocumentPublisher Type="Vendor">
    <ContactDetails>security@suse.de</ContactDetails>
    <IssuingAuthority>SUSE Security Team</IssuingAuthority>
  </DocumentPublisher>
  <DocumentTracking>
    <Identification>
      <ID>SUSE-SU-2020:3642-1</ID>
    </Identification>
    <Status>Final</Status>
    <Version>1</Version>
    <RevisionHistory>
      <Revision>
        <Number>1</Number>
        <Date>2020-12-07T12:30:26Z</Date>
        <Description>current</Description>
      </Revision>
    </RevisionHistory>
    <InitialReleaseDate>2020-12-07T12:30:26Z</InitialReleaseDate>
    <CurrentReleaseDate>2020-12-07T12:30:26Z</CurrentReleaseDate>
    <Generator>
      <Engine>cve-database/bin/generate-cvrf.pl</Engine>
      <Date>2017-02-24T01:00:00Z</Date>
    </Generator>
  </DocumentTracking>
  <DocumentNotes>
    <Note Title="Topic" Type="Summary" Ordinal="1" xml:lang="en">Security update for MozillaThunderbird</Note>
    <Note Title="Details" Type="General" Ordinal="2" xml:lang="en">This update for MozillaThunderbird fixes the following issues:

- Mozilla Thunderbird was updated to 78.5.1 (MFSA 2020-53, bsc#1179530)
- CVE-2020-26970: Fixed a stack overflow due to incorrect parsing of SMTP server response codes.
- Various bug fixes
</Note>
    <Note Title="Terms of Use" Type="Legal Disclaimer" Ordinal="3" xml:lang="en">The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).</Note>
    <Note Title="Patchnames" Type="Details" Ordinal="4" xml:lang="en">SUSE-2020-3642,SUSE-SLE-Product-WE-15-SP1-2020-3642</Note>
  </DocumentNotes>
  <DocumentDistribution xml:lang="en">Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0)</DocumentDistribution>
  <DocumentReferences>
    <Reference Type="Self">
      <URL>https://www.suse.com/support/update/announcement/2020/suse-su-20203642-1/</URL>
      <Description>Link for SUSE-SU-2020:3642-1</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://lists.suse.com/pipermail/sle-security-updates/2020-December/007923.html</URL>
      <Description>E-Mail link for SUSE-SU-2020:3642-1</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/support/security/rating/</URL>
      <Description>SUSE Security Ratings</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1179530</URL>
      <Description>SUSE Bug 1179530</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/security/cve/CVE-2020-26970/</URL>
      <Description>SUSE CVE CVE-2020-26970 page</Description>
    </Reference>
  </DocumentReferences>
  <ProductTree xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/prod">
    <Branch Type="Product Family" Name="SUSE Linux Enterprise Workstation Extension 15 SP1">
      <Branch Type="Product Name" Name="SUSE Linux Enterprise Workstation Extension 15 SP1">
        <FullProductName ProductID="SUSE Linux Enterprise Workstation Extension 15 SP1" CPE="cpe:/o:suse:sle-we:15:sp1">SUSE Linux Enterprise Workstation Extension 15 SP1</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Version" Name="MozillaThunderbird-78.5.1-3.110.2">
      <FullProductName ProductID="MozillaThunderbird-78.5.1-3.110.2">MozillaThunderbird-78.5.1-3.110.2</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="MozillaThunderbird-translations-common-78.5.1-3.110.2">
      <FullProductName ProductID="MozillaThunderbird-translations-common-78.5.1-3.110.2">MozillaThunderbird-translations-common-78.5.1-3.110.2</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="MozillaThunderbird-translations-other-78.5.1-3.110.2">
      <FullProductName ProductID="MozillaThunderbird-translations-other-78.5.1-3.110.2">MozillaThunderbird-translations-other-78.5.1-3.110.2</FullProductName>
    </Branch>
    <Relationship ProductReference="MozillaThunderbird-78.5.1-3.110.2" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Workstation Extension 15 SP1">
      <FullProductName ProductID="SUSE Linux Enterprise Workstation Extension 15 SP1:MozillaThunderbird-78.5.1-3.110.2">MozillaThunderbird-78.5.1-3.110.2 as a component of SUSE Linux Enterprise Workstation Extension 15 SP1</FullProductName>
    </Relationship>
    <Relationship ProductReference="MozillaThunderbird-translations-common-78.5.1-3.110.2" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Workstation Extension 15 SP1">
      <FullProductName ProductID="SUSE Linux Enterprise Workstation Extension 15 SP1:MozillaThunderbird-translations-common-78.5.1-3.110.2">MozillaThunderbird-translations-common-78.5.1-3.110.2 as a component of SUSE Linux Enterprise Workstation Extension 15 SP1</FullProductName>
    </Relationship>
    <Relationship ProductReference="MozillaThunderbird-translations-other-78.5.1-3.110.2" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Workstation Extension 15 SP1">
      <FullProductName ProductID="SUSE Linux Enterprise Workstation Extension 15 SP1:MozillaThunderbird-translations-other-78.5.1-3.110.2">MozillaThunderbird-translations-other-78.5.1-3.110.2 as a component of SUSE Linux Enterprise Workstation Extension 15 SP1</FullProductName>
    </Relationship>
  </ProductTree>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="1">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">When reading SMTP server status codes, Thunderbird writes an integer value to a position on the stack that is intended to contain just one byte. Depending on processor architecture and stack layout, this leads to stack corruption that may be exploitable. This vulnerability affects Thunderbird &lt; 78.5.1.</Note>
    </Notes>
    <CVE>CVE-2020-26970</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>SUSE Linux Enterprise Workstation Extension 15 SP1:MozillaThunderbird-78.5.1-3.110.2</ProductID>
        <ProductID>SUSE Linux Enterprise Workstation Extension 15 SP1:MozillaThunderbird-translations-common-78.5.1-3.110.2</ProductID>
        <ProductID>SUSE Linux Enterprise Workstation Extension 15 SP1:MozillaThunderbird-translations-other-78.5.1-3.110.2</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>critical</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>9.3</BaseScoreV2>
        <VectorV2>AV:N/AC:M/Au:N/C:C/I:C/A:C</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>8.8</BaseScoreV3>
        <VectorV3>CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
</Description>
        <URL>https://www.suse.com/support/update/announcement/2020/suse-su-20203642-1/</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2020-26970.html</URL>
        <Description>CVE-2020-26970</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1179530</URL>
        <Description>SUSE Bug 1179530</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
</cvrfdoc>
