Summary
Mozilla Thunderbird is a standalone mail and newsgroup client.
This update upgrades Thunderbird to version 102.4.0.
Security Fix(es):
* Mozilla: Matrix SDK bundled with Thunderbird vulnerable to an impersonation attack by malicious server administrators (CVE-2022-39249)
* Mozilla: Matrix SDK bundled with Thunderbird vulnerable to a device verification attack (CVE-2022-39250)
* Mozilla: Matrix SDK bundled with Thunderbird vulnerable to an impersonation attack (CVE-2022-39251)
* Mozilla: Same-origin policy violation could have leaked cross-origin URLs (CVE-2022-42927)
* Mozilla: Memory Corruption in JS Engine (CVE-2022-42928)
* Mozilla: Matrix SDK bundled with Thunderbird vulnerable to a data corruption issue (CVE-2022-39236)
* Mozilla: Denial of Service via window.print (CVE-2022-42929)
* Mozilla: Memory safety bugs fixed in Firefox ESR 102.4 and Thunderbird 102.4 (CVE-2022-42932)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux · 8 | thunderbird | 102.4.0-1.el8_6.alma |
Vulnerabilities 8
-
High 8.8
Certain types of allocations were missing annotations that, if the Garbage Collector was in a specific state, could hav…
-
High 8.8
Mozilla developers Ashley Hale and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 105 and Fire…
-
High 8.6
Matrix JavaScript SDK vulnerable to key/device identifier confusion in SAS verification
Matrix JavaScript SDK is the Matrix Client-Server software development kit (SDK) for JavaScript. Prior to version 19.7.0, an attacker cooperating with a malicious homeserver could interfere with the verification flow between two users, injecting its own cross…
-
High 8.6
Matrix Javascript SDK vulnerable to Olm/Megolm protocol confusion
Matrix Javascript SDK is the Matrix Client-Server SDK for JavaScript. Prior to version 19.7.0, an attacker cooperating with a malicious homeserver can construct messages that legitimately appear to have come from another person, without any indication such as…
-
High 8.1
A same-origin policy violation could have allowed the theft of cross-origin URL entries, leaking the result of a redire…
-
High 7.5
Matrix Javascript SDK vulnerable to impersonation via forwarded Megolm sessions
Matrix Javascript SDK is the Matrix Client-Server SDK for JavaScript. Prior to version 19.7.0, an attacker cooperating with a malicious homeserver can construct messages appearing to have come from another person. Such messages will be marked with a grey shie…
-
Medium 6.5
If a website called `window.print()` in a particular way, it could cause a denial of service of the browser, which may …
-
Medium 4.3
Matrix Javascript SDK improper beacon events can cause availability issues
Matrix Javascript SDK is the Matrix Client-Server SDK for JavaScript. Starting with version 17.1.0-rc.1, improperly formed beacon events can disrupt or impede the matrix-js-sdk from functioning properly, potentially impacting the consumer's ability to process…
References
-
report
https://access.redhat.com/security/cve/CVE-2022-39236
-
report
https://access.redhat.com/security/cve/CVE-2022-39249
-
report
https://access.redhat.com/security/cve/CVE-2022-39250
-
report
https://access.redhat.com/security/cve/CVE-2022-39251
-
report
https://access.redhat.com/security/cve/CVE-2022-42927
-
report
https://access.redhat.com/security/cve/CVE-2022-42928
-
report
https://access.redhat.com/security/cve/CVE-2022-42929
-
report
https://access.redhat.com/security/cve/CVE-2022-42932
-
report
https://bugzilla.redhat.com/2135391
-
report
https://bugzilla.redhat.com/2135393
-
report
https://bugzilla.redhat.com/2135395
-
report
https://bugzilla.redhat.com/2135396
-
report
https://bugzilla.redhat.com/2136156
-
report
https://bugzilla.redhat.com/2136157
-
report
https://bugzilla.redhat.com/2136158
-
report
https://bugzilla.redhat.com/2136159
-
advisory
https://errata.almalinux.org/8/ALSA-2022-7190.html