Read the docs
Red Hat Security Advisory

RHSA-2022:6717

thunderbird security update

Released 2022-09-26 · Red Hat rating Important · View on Red Hat →

Fixed in

Fixes 11 records

TI-2022-03017 CVE-2022-3266 · GHSA-m3h7-qq8m-r923

Out-of-bounds read in Mozilla Firefox ESR

Priority MEDIUM 58

An out-of-bounds read can occur when decoding H264 video.

CVSS 3.1MEDIUM 5.5 Local No auth User interaction EPSS 0.00304 Published 2022-12-22 Partial fix · 102.3, 105 CWE-125
TI-2022-19505 CVE-2022-40962 · GHSA-wcx8-5vxf-rv69

Out-of-bounds write in Mozilla Firefox ESR

Priority MEDIUM 43

Mozilla developers Nika Layzell, Timothy Nikkel, Sebastian Hengst, Andreas Pehrson, and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 104 and Firefox ESR 102.2.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.0143 Published 2022-12-22 Partial fix · 102.3, 105 CWE-787
TI-2022-16482 CVE-2022-36059 · GHSA-rfv9-x7hh-xc32

Prototype pollution in matrix-js-sdk

Priority MEDIUM 43

matrix-js-sdk is a Matrix messaging protocol Client-Server SDK for JavaScript.

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.00932 Published 2023-03-28 Partial fix · 19.4.0 CWE-1321
TI-2022-02796 CVE-2022-3033 · GHSA-q68w-fq74-6jp9

Cross-site scripting in Mozilla Thunderbird

Priority LOW 39

If a Thunderbird user replied to a crafted HTML email containing a <code>meta</code> tag, with the <code>meta</code> tag having the <code>http-equiv="refresh"</code> attribute, and the content attribute specifying an URL…

CVSS 3.1HIGH 8.1 Network No auth User interaction EPSS 0.00805 Published 2022-12-22 Partial fix · 102.2.1, 91.13.1 CWE-79
TI-2022-19502 CVE-2022-40959 · GHSA-pc7h-fmrf-pp2j

Insecure storage of sensitive information in Mozilla Firefox ESR

Priority LOW 32

During iframe navigation, certain pages did not have their FeaturePolicy fully initialized leading to a bypass that leaked device permissions into untrusted subdocuments.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.0146 Published 2022-12-22 Partial fix · 102.3, 105 CWE-922
TI-2022-19503 CVE-2022-40960 · GHSA-w7vf-mp9x-925q

Use after free in Mozilla Firefox ESR

Priority LOW 31

Concurrent use of the URL parser with non-UTF-8 data was not thread-safe.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.01077 Published 2022-12-22 Partial fix · 102.3, 105 CWE-416
TI-2022-19501 CVE-2022-40958 · GHSA-7mxj-29p2-6g84

Injection in Mozilla Firefox ESR

Priority LOW 31

By injecting a cookie with certain special characters, an attacker on a shared subdomain which is not a secure context could set and thus overwrite cookies from a secure context, leading to session fixation and other att…

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.01177 Published 2022-12-22 Partial fix · 102.3, 105 CWE-74
TI-2022-02795 CVE-2022-3032 · GHSA-2xmh-3jxc-r2w6

When receiving an HTML email that contained an <code>iframe</code> element, which used a…

Priority LOW 30

When receiving an HTML email that contained an <code>iframe</code> element, which used a <code>srcdoc</code> attribute to define the inner HTML document, remote objects specified in the nested document, for example image…

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00707 Published 2022-12-22 Partial fix · 102.2.1, 91.13.1 CWE-610
TI-2022-19499 CVE-2022-40956 · GHSA-74v3-gjvq-vv7f

Cross-site scripting in Mozilla Firefox ESR

Priority LOW 29

When injecting an HTML base element, some requests would ignore the CSP's base-uri settings and accept the injected element's base instead.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00942 Published 2022-12-22 Partial fix · 102.3, 105 CWE-79
TI-2022-02797 CVE-2022-3034 · GHSA-wrfx-qxxc-92rj

Clickjacking in Mozilla Thunderbird

Priority LOW 21

When receiving an HTML email that specified to load an <code>iframe</code> element from a remote location, a request to the remote document was sent.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00569 Published 2022-12-22 Partial fix · 102.2.1, 91.13.1 CWE-1021