Kevin Kofler via devel wrote:
Marius Schwarz wrote:
I know it was a security update for https://www.mozilla.org/en-US/security/advisories/mfsa2022-38/ https://www.mozilla.org/en-US/security/advisories/mfsa2022-38/, so better safe and live with some minor bugs, than to be sorry.
Debian claims on https://security-tracker.debian.org/tracker/CVE-2022-3033 that Thunderbird 91 is not even vulnerable to the CVEs fixed by that advisory, only Thunderbird 102 releases (prior to the fix) were.
And if that claim is wrong, you can simply backport the fixes: The MFSA lists the bug IDs, so just search for those in the hg history: https://hg.mozilla.org/comm-central/log?rev=1784838 https://hg.mozilla.org/comm-central/log?rev=1783831 https://hg.mozilla.org/comm-central/log?rev=1745751 https://hg.mozilla.org/comm-central/log?rev=1787741
In particular, the fix for the high-impact CVE-2022-3033 is a one-line addition. It does not make sense to upgrade to an incompatible version for that fix.
Kevin Kofler