summaryrefslogtreecommitdiff
path: root/mail/thunderbird
diff options
context:
space:
mode:
authorryoon <ryoon@pkgsrc.org>2017-11-17 00:49:20 +0000
committerryoon <ryoon@pkgsrc.org>2017-11-17 00:49:20 +0000
commit3321827bb8a4fac960d9db42c380a999a81b4c7b (patch)
treeddae4962b59cfee13fecf5f9b0c73d4aa3d05864 /mail/thunderbird
parentaf9a6533466964a7f348a55a541c0d0794942e47 (diff)
downloadpkgsrc-3321827bb8a4fac960d9db42c380a999a81b4c7b.tar.gz
Update to 52.4.0
Chagelog: New In Thunderbird 52 a new behavior was introduced for replies to mailing list posts: "When replying to a mailing list, reply will be sent to address in From header ignoring Reply-to header". A new preference mail.override_list_reply_to allows to restore the previous behavior. Fixed Under certain circumstances (image attachment and non-image attachment), attached images were shown truncated in messages stored in IMAP folders not synchronised for offline use. Fixed IMAP UIDs > 0x7FFFFFFF not handled properly Security fixes: #CVE-2017-7793: Use-after-free with Fetch API Reporter Abhishek Arya Impact high Description A use-after-free vulnerability can occur in the Fetch API when the worker or the associated window are freed when still in use, resulting in a potentially exploitable crash. References Bug 1371889 #CVE-2017-7818: Use-after-free during ARIA array manipulation Reporter Nils Impact high Description A use-after-free vulnerability can occur when manipulating arrays of Accessible Rich Internet Applications (ARIA) elements within containers through the DOM. This results in a potentially exploitable crash. References Bug 1363723 #CVE-2017-7819: Use-after-free while resizing images in design mode Reporter Nils Impact high Description A use-after-free vulnerability can occur in design mode when image objects are resized if objects referenced during the resizing have been freed from memory. This results in a potentially exploitable crash. References Bug 1380292 #CVE-2017-7824: Buffer overflow when drawing and validating elements with ANGLE Reporter Omair, Andre Weissflog Impact high Description A buffer overflow occurs when drawing and validating elements with the ANGLE graphics library, used for WebGL content. This is due to an incorrect value being passed within the library during checks and results in a potentially exploitable crash. References Bug 1398381 #CVE-2017-7805: Use-after-free in TLS 1.2 generating handshake hashes Reporter Martin Thomson Impact high Description During TLS 1.2 exchanges, handshake hashes are generated which point to a message buffer. This saved data is used for later messages but in some cases, the handshake transcript can exceed the space available in the current buffer, causing the allocation of a new buffer. This leaves a pointer pointing to the old, freed buffer, resulting in a use-after-free when handshake hashes are then calculated afterwards. This can result in a potentially exploitable crash. References Bug 1377618 #CVE-2017-7814: Blob and data URLs bypass phishing and malware protection warnings Reporter François Marier Impact moderate Description File downloads encoded with blob: and data: URL elements bypassed normal file download checks though the Phishing and Malware Protection feature and its block lists of suspicious sites and files. This would allow malicious sites to lure users into downloading executables that would otherwise be detected as suspicious. References Bug 1376036 #CVE-2017-7825: OS X fonts render some Tibetan and Arabic unicode characters as spaces Reporter Khalil Zhani Impact moderate Description Several fonts on OS X display some Tibetan and Arabic characters as whitespace. When used in the addressbar as part of an IDN this can be used for domain name spoofing attacks. Note: This attack only affects OS X operating systems. Other operating systems are unaffected. References Bug 1393624 Bug 1390980 #CVE-2017-7823: CSP sandbox directive did not create a unique origin Reporter Jun Kokatsu Impact moderate Description The content security policy (CSP) sandbox directive did not create a unique origin for the document, causing it to behave as if the allow-same-origin keyword were always specified. This could allow a Cross-Site Scripting (XSS) attack to be launched from unsafe content. References Bug 1396320 #CVE-2017-7810: Memory safety bugs fixed in Firefox 56, Firefox ESR 52.4, and Thunderbird 52.4 Reporter Mozilla developers and community Impact critical Description Mozilla developers and community members Christoph Diehl, Jan de Mooij, Jason Kratzer, Randell Jesup, Tom Ritter, Tyson Smith, and Sebastian Hengst reported memory safety bugs present in Firefox 55, Firefox ESR 52.3, and Thunderbird 52.3. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. References Memory safety bugs fixed in Firefox 56 and Firefox ESR 52.4
Diffstat (limited to 'mail/thunderbird')
-rw-r--r--mail/thunderbird/Makefile5
-rw-r--r--mail/thunderbird/distinfo10
2 files changed, 7 insertions, 8 deletions
diff --git a/mail/thunderbird/Makefile b/mail/thunderbird/Makefile
index b57cd457fa7..e316f5f228e 100644
--- a/mail/thunderbird/Makefile
+++ b/mail/thunderbird/Makefile
@@ -1,9 +1,8 @@
-# $NetBSD: Makefile,v 1.197 2017/09/18 09:53:26 maya Exp $
+# $NetBSD: Makefile,v 1.198 2017/11/17 00:49:20 ryoon Exp $
DISTNAME= thunderbird-${TB_VER}.source
PKGNAME= thunderbird-${TB_VER}
-PKGREVISION= 2
-TB_VER= 52.3.0
+TB_VER= 52.4.0
CATEGORIES= mail
MASTER_SITES= ${MASTER_SITE_MOZILLA:=thunderbird/releases/${TB_VER}/source/}
EXTRACT_SUFX= .tar.xz
diff --git a/mail/thunderbird/distinfo b/mail/thunderbird/distinfo
index 2c495c02d33..c997ae54416 100644
--- a/mail/thunderbird/distinfo
+++ b/mail/thunderbird/distinfo
@@ -1,9 +1,9 @@
-$NetBSD: distinfo,v 1.192 2017/08/19 04:19:03 ryoon Exp $
+$NetBSD: distinfo,v 1.193 2017/11/17 00:49:20 ryoon Exp $
-SHA1 (thunderbird-52.3.0.source.tar.xz) = 5dc18774e599af3d50a9ff66d28e861a41e4bb5a
-RMD160 (thunderbird-52.3.0.source.tar.xz) = 29a316267156c32390fd1a852dbb832ff0c5d3eb
-SHA512 (thunderbird-52.3.0.source.tar.xz) = 10e6495d207328aae325a797be1de5e535b5d967df929b0af9d7554d0473b5a7931c8f9cb1793e843b1913f441f790169dd4ac1ad9e0e53e66bc8e1c1dd60e66
-Size (thunderbird-52.3.0.source.tar.xz) = 228532004 bytes
+SHA1 (thunderbird-52.4.0.source.tar.xz) = a51299181996abb6b861a7a5e41a770ef357ceb4
+RMD160 (thunderbird-52.4.0.source.tar.xz) = 09e960c97f13eaf0818cfce0b573ef94f371ad92
+SHA512 (thunderbird-52.4.0.source.tar.xz) = 6ac39cecca9e53b51754d7a8bd7cae228d197eb234b03a2386c16fd665f4f7a67f10bbdf981c20b3f7a21a5ef67e2771154a3dd9f249c6a884c48a9e59bcfc78
+Size (thunderbird-52.4.0.source.tar.xz) = 228561704 bytes
SHA1 (patch-calendar_lightning_Makefile.in) = 02a1528f2da82f1d4ff4931a7d7dc8227b7fa9f2
SHA1 (patch-calendar_lightning_build_universal.mk) = 86dc2c6b4f9feb835570111078aa5d08a389d0da
SHA1 (patch-calendar_providers_gdata_Makefile.in) = 0e90ddc9aecc817b0b150bbc37d23ddec97b093e