Thunderbird 45.5.0 released
- https://www.mozilla.org/en-US/thunderbird/45.5.0/releasenotes/
Nov 18, 2016
What’s New:
Changed: IMPORTANT: Changed recipient address entry: Arrow-keys now copy the pop-up value to the input field. Mouse-hovered pop-up value can no longer be confirmed with tab or enter key. This restores the behavior of Thunderbird 24.
Changed: Support changes to character limit in Twitter
Fixed:
- Reply with selected text containing quote resulted in wrong quoting level indication
- Mail address display at header pane displayed incorrectly if the address contains UTF-8 according to RFC 6532
- Attempting to sort messages on the Date field whilst a quick filter is applied got stuck on sort descending
- Email invitation might not be displayed when description contains non-ASCII characters
- http://www.securitytracker.com/id/1037371
CVE Reference: CVE-2016-9079
Dec 1 2016
Fix Available: Yes Vendor Confirmed: Yes Exploit Included: Yes
Version(s): prior to 45.5.1
Impact: A remote user can create JavaScript content that, when loaded by the target user, will execute arbitrary code on the target user's system.
Solution: Mozilla.org has issued a fix for Mozilla Thunderbird (45.5.1)…
___
Security vulnerabilities fixed in Thunderbird 45.7
- https://www.mozilla.org/en-US/security/advisories/mfsa2017-03/
Jan 26, 2017 Critical
CVE-2017-5375: Excessive JIT code allocation allows bypass of ASLR and DEP
CVE-2017-5376: Use-after-free in XSL
CVE-2017-5373: Memory safety bugs fixed in Thunderbird 45.7
- https://www.mozilla.org/en-US/security/advisories/mfsa2017-07/ Critical
CVE-2017-5400: asm.js JIT-spray bypass of ASLR and DEP
CVE-2017-5401: Memory Corruption when handling ErrorResult
CVE-2017-5402: Use-after-free working with events in FontFace objects
CVE-2017-5404: Use-after-free working with ranges in selections
CVE-2017-5398: Memory safety bugs fixed in Thunderbird 45.8
- https://www.mozilla.org/en-US/security/advisories/mfsa2017-09/ Critical
CVE-2017-5400: asm.js JIT-spray bypass of ASLR and DEP
CVE-2017-5401: Memory Corruption when handling ErrorResult
CVE-2017-5402: Use-after-free working with events in FontFace objects
CVE-2017-5403: Use-after-free using addRange to add range to an incorrect root object
CVE-2017-5404: Use-after-free working with ranges in selections
Fixed:
- Crash due to incompatibility with McAfee Anti-SPAM add-on. Add-on is blocked in 52.0.1
- Clicking on a link in an email may not open this link in the external browser…
Fixed:
Background images not working and other issues related to embedded images when composing email
Google Oauth setup can sometimes not progress to the next step
Fixed:
- Large attachments may not be shown or saved correctly if the message is stored in an IMAP folder which is not synchronized for offline use
- Unable to load full message via POP if message was downloaded partially (or only headers) before
- Some attachments can't be opened or saved if the message body is empty
- Crash when compacting IMAP folder
Known Issues:
unresolved:
- Large number of blank pages being printed under certain circumstances
- Crash due to incompatibility with McAfee Anti-SPAM add-on. Workaround: Start in safe mode and -disable- McAfee Anti-Spam Extension
Thunderbird 52.2.0 released
- https://www.mozilla.org/en-US/thunderbird/52.2.0/releasenotes/
June 14, 2017
What’s New:
Fixed:
- Embedded images not shown in email received from Hotmail/Outlook webmailer
- Detection of non-ASCII font names in font selector
- Attachment not forwarded correctly under certain circumstances
- Multiple requests for master password when GMail OAuth2 is enabled
- Large number of blank pages being printed under certain circumstances when invalid preferences were present
- Messages sent via the Simple MAPI interface are forced to HTML
- Calendar: Invitations can't be printed
- Mailing list (group) not accessible from macOS or Outlook address book
- Clicking on links with references/anchors where target doesn't exist in the message not opening in external browser
Thunderbird 52.3.0 released
- https://www.mozilla.org/en-US/thunderbird/52.3.0/releasenotes/
Aug 16, 2017
Fixed:
- Unwanted inline images shown in rogue SPAM messages
- Deleting message from the POP3 server not working when maildir storage was used
- Message disposition flag (replied / forwarded) lost when reply or forwarded message was stored as draft and draft was sent later
- Inline images not scaled to fit when printing
- Selected text from another message sometimes included in a reply
- No authorisation prompt displayed when inserting image into email body although image URL requires authentication
- Large attachments taking a long time to open under some circumstances
New: In Thunderbird 52 a new behavior was introduced for replies to mailing list posts: "When replying to a mailing list, reply will be sent to address in From header ignoring Reply-to header". A new preference mail.override_list_reply_to allows to restore the previous behavior.
Fixed:
- Under certain circumstances (image attachment and non-image attachment), attached images were shown truncated in messages stored in IMAP folders not synchronised for offline use.
- IMAP UIDs > 0x7FFFFFFF not handled properly
- Various security fixes*
Thunderbird 52.5.0 released
- https://www.mozilla.org/en-US/thunderbird/52.5.0/releasenotes/
Nov 23, 2017
New: Better support for Charter/Spectrum IMAP: Thunderbird will now detect Charter's IMAP service and send an additional - IMAP select command to the server. Check the various preferences ending in "force_select" to see whether auto-detection has discovered this case.
Fixed:
- In search folders spanning multiple base folders clicking on a message sometimes marked another message as read
- IMAP alerts have been corrected and now show the correct server name in case of connection problems
- POP alerts have been corrected and now indicate connection problems in case the configured POP server cannot be found
- Various security fixes:
- https://www.mozilla.org/en-US/security/known-vulnerabilities/thunderbird/#thunderbird52.5
