Red Hat Security Advisory: thunderbird security update

Fixed packages 3

Vulnerabilities 7

• Critical 9.6
  CVE-2022-22759

  If a document created a sandboxed iframe without <code>allow-scripts</code>, and subsequently appended an element to th…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Dec 22, 2022
• High 8.8
  CVE-2022-22756

  If a user was convinced to drag and drop an image to their desktop or other folder, the resulting object could have bee…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Dec 22, 2022
• High 8.8
  CVE-2022-22761

  Web-accessible extension pages (pages with a moz-extension:// scheme) were not correctly enforcing the frame-ancestors …

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Dec 22, 2022
• High 8.8
  CVE-2022-22763

  When a worker is shutdown, it was possible to cause script to run late in the lifecycle, at a point after where it shou…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Dec 22, 2022
• High 8.8
  CVE-2022-22764

  Mozilla developers Paul Adenot and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 96 and Firef…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Dec 22, 2022
• Medium 6.5
  CVE-2022-22754

  If a user installed an extension of a particular type, the extension could have auto-updated itself and while doing so,…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Dec 22, 2022
• Medium 6.5
  CVE-2022-22760

  When importing resources using Web Workers, error messages would distinguish the difference between <code>application/j…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Dec 22, 2022

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2053236
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2053237
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2053238
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2053239
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2053240
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2053242
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2053243
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_0535.json
• report
  https://access.redhat.com/security/cve/CVE-2022-22754
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-22754
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-22754
• report
  https://access.redhat.com/security/cve/CVE-2022-22756
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-22756
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-22756
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2022-05/#CVE-2022-22756
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2022-06/#CVE-2022-22756
• report
  https://access.redhat.com/security/cve/CVE-2022-22759
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-22759
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-22759
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2022-05/#CVE-2022-22759
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2022-06/#CVE-2022-22759
• report
  https://access.redhat.com/security/cve/CVE-2022-22760
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-22760
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-22760
• report
  https://access.redhat.com/security/cve/CVE-2022-22761
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-22761
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-22761
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2022-05/#CVE-2022-22761
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2022-06/#CVE-2022-22761
• report
  https://access.redhat.com/security/cve/CVE-2022-22763
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-22763
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-22763
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2022-05/#CVE-2022-22763
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2022-06/#CVE-2022-22763
• report
  https://access.redhat.com/security/cve/CVE-2022-22764
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-22764
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-22764
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2022-05/#CVE-2022-22764