Summary
Mozilla Thunderbird is a standalone mail and newsgroup client.
This update upgrades Thunderbird to version 91.11.
Security Fix(es):
* Mozilla: CSP sandbox header without `allow-scripts` can be bypassed via retargeted javascript: URI (CVE-2022-34468)
* Mozilla: Use-after-free in nsSHistory (CVE-2022-34470)
* Mozilla: A popup window could be resized in a way to overlay the address bar with web content (CVE-2022-34479)
* Mozilla: Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11 (CVE-2022-34484)
* Mozilla: Undesired attributes could be set as part of prototype pollution (CVE-2022-2200)
* Mozilla: An email with a mismatching OpenPGP signature date was accepted as valid (CVE-2022-2226)
* Mozilla: CSP bypass enabling stylesheet injection (CVE-2022-31744)
* Mozilla: Unavailable PAC file resulted in OCSP requests being blocked (CVE-2022-34472)
* Mozilla: Potential integer overflow in ReplaceElementsAt (CVE-2022-34481)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux · 9 | thunderbird | 91.11.0-2.el9_0.alma |
Vulnerabilities 9
-
Critical 9.8
Session history navigations may have led to a use-after-free and potentially exploitable crash. This vulnerability affe…
-
High 8.8CVE-2022-2200 EPSS 24%
If an object prototype was corrupted by an attacker, they would have been able to set undesired attributes on a JavaScr…
-
High 8.8
An iframe that was not permitted to run scripts could do so if the user clicked on a <code>javascript:</code> link. Thi…
-
High 8.8
In the <code>nsTArray_Impl::ReplaceElementsAt()</code> function, an integer overflow could have occurred when the numbe…
-
High 8.8
The Mozilla Fuzzing Team reported potential vulnerabilities present in Thunderbird 91.10. Some of these bugs showed evi…
-
Medium 6.5
An OpenPGP digital signature includes information about the date when the signature was created. When displaying an ema…
-
Medium 6.5
An attacker could have injected CSS into stylesheets accessible via internal URIs, such as resource:, and in doing so b…
-
Medium 6.5
A malicious website that could create a popup could have resized the popup to overlay the address bar with its own cont…
-
Medium 4.3
If there was a PAC URL set and the server that hosts the PAC was not reachable, OCSP requests would have been blocked, …
References
-
report
https://access.redhat.com/security/cve/CVE-2022-2200
-
report
https://access.redhat.com/security/cve/CVE-2022-2226
-
report
https://access.redhat.com/security/cve/CVE-2022-31744
-
report
https://access.redhat.com/security/cve/CVE-2022-34468
-
report
https://access.redhat.com/security/cve/CVE-2022-34470
-
report
https://access.redhat.com/security/cve/CVE-2022-34472
-
report
https://access.redhat.com/security/cve/CVE-2022-34479
-
report
https://access.redhat.com/security/cve/CVE-2022-34481
-
report
https://access.redhat.com/security/cve/CVE-2022-34484
-
report
https://bugzilla.redhat.com/2102161
-
report
https://bugzilla.redhat.com/2102162
-
report
https://bugzilla.redhat.com/2102163
-
report
https://bugzilla.redhat.com/2102164
-
report
https://bugzilla.redhat.com/2102165
-
report
https://bugzilla.redhat.com/2102166
-
report
https://bugzilla.redhat.com/2102168
-
report
https://bugzilla.redhat.com/2102169
-
report
https://bugzilla.redhat.com/2102204
-
advisory
https://errata.almalinux.org/9/ALSA-2022-5482.html