Red Hat Security Advisory: thunderbird security update

Fixed packages 3

Vulnerabilities 12

• Critical 9.8
  CVE-2021-4140

  It was possible to construct specific XSLT markup that would be able to bypass an iframe sandbox. This vulnerability af…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Dec 22, 2022
• High 8.8
  CVE-2022-22738

  Applying a CSS filter effect could have accessed out of bounds memory. This could have lead to a heap-buffer-overflow c…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Dec 22, 2022
• High 8.8
  CVE-2022-22740

  Certain network request objects were freed too early when releasing a network request handle. This could have lead to a…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Dec 22, 2022
• High 8.8
  CVE-2022-22751

  Mozilla developers Calixte Denizet, Kershaw Chang, Christian Holler, Jason Kratzer, Gabriele Svelto, Tyson Smith, Simon…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Dec 22, 2022
• High 7.5
  CVE-2022-22737

  Constructing audio sinks could have lead to a race condition when playing audio files and closing windows. This could h…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Dec 22, 2022
• High 7.5
  CVE-2022-22741

  When resizing a popup while requesting fullscreen access, the popup would have become unable to leave fullscreen mode. …

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Dec 22, 2022
• Medium 6.5
  CVE-2022-22739

  Malicious websites could have tricked users into accepting launching a program to handle an external URL protocol. This…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Dec 22, 2022
• Medium 6.5
  CVE-2022-22742

  When inserting text while in edit mode, some characters might have lead to out-of-bounds memory access causing a potent…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Dec 22, 2022
• Medium 6.5
  CVE-2022-22745

  Securitypolicyviolation events could have leaked cross-origin information for frame-ancestors violations. This vulnerab…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Dec 22, 2022
• Medium 6.5
  CVE-2022-22747

  After accepting an untrusted certificate, handling an empty pkcs7 sequence as part of the certificate data could have l…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Dec 22, 2022
• Medium 6.5
  CVE-2022-22748

  Malicious websites could have confused Firefox into showing the wrong origin when asking to launch a program and handli…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Dec 22, 2022
• Medium 4.3
  CVE-2022-22743

  When navigating from inside an iframe while requesting fullscreen access, an attacker-controlled tab could have made th…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Dec 22, 2022

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2039561
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2039563
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2039564
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2039565
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2039566
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2039567
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2039568
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2039569
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2039570
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2039572
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2039573
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2039574
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_0123.json
• report
  https://access.redhat.com/security/cve/CVE-2021-4140
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-4140
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-4140
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2022-02/#CVE-2021-4140
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2022-03/#CVE-2021-4140
• report
  https://access.redhat.com/security/cve/CVE-2022-22737
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-22737
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-22737
• report
  https://access.redhat.com/security/cve/CVE-2022-22738
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-22738
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-22738
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2022-02/#CVE-2022-22738
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2022-03/#CVE-2022-22738
• report
  https://access.redhat.com/security/cve/CVE-2022-22739
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-22739
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-22739
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2022-02/#CVE-2022-22739
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2022-03/#CVE-2022-22739
• report
  https://access.redhat.com/security/cve/CVE-2022-22740
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-22740
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-22740
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2022-02/#CVE-2022-22740
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2022-03/#CVE-2022-22740
• report
  https://access.redhat.com/security/cve/CVE-2022-22741
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-22741