Red Hat Security Advisory: thunderbird security update

Fixed packages 3

Vulnerabilities 14

• Critical 9.6
  CVE-2022-26486 Exploited

  An unexpected message in the WebGPU IPC framework could lead to a use-after-free and exploitable sandbox escape. We hav…

  Mozilla Firefox Thunderbird Firefox ESR Android Browsers Debian Ubuntu Alpine
  Dec 22, 2022

  KEV Mar 7, 2022
• High 8.8
  CVE-2022-26485 Exploited Public exploit EPSS 14%

  Removing an XSLT parameter during processing could have lead to an exploitable use-after-free. We have had reports of a…

  Mozilla Firefox Thunderbird Firefox ESR Android Browsers Debian Ubuntu Alpine
  Dec 22, 2022

  KEV Mar 7, 2022
• Critical 9.8
  CVE-2022-22822 Public exploit

  addBinding in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.

  thunderbird firefox insighttoolkit4 expat Debian Ubuntu Azure Linux Alpine
  Jan 8, 2022
• Critical 9.8
  CVE-2022-22823

  build_model in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.

  thunderbird firefox insighttoolkit4 expat Debian Ubuntu Azure Linux Alpine
  Jan 8, 2022
• Critical 9.8
  CVE-2022-22824

  defineAttribute in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.

  thunderbird firefox insighttoolkit4 expat Debian Ubuntu Azure Linux Alpine
  Jan 8, 2022
• Critical 9.8
  CVE-2022-25235 Public exploit

  xmltok_impl.c in Expat (aka libexpat) before 2.4.5 lacks certain validation of encoding, such as checks for whether a U…

  thunderbird firefox insighttoolkit4 expat Debian Ubuntu Azure Linux Alpine
  Feb 16, 2022
• Critical 9.8
  CVE-2022-25236 Public exploit EPSS 35%

  xmlparse.c in Expat (aka libexpat) before 2.4.5 allows attackers to insert namespace-separator characters into namespac…

  thunderbird firefox insighttoolkit4 expat Debian Ubuntu Azure Linux Alpine
  Feb 16, 2022
• Critical 9.8
  CVE-2022-25315 Public exploit

  In Expat (aka libexpat) before 2.4.5, there is an integer overflow in storeRawNames.

  thunderbird firefox insighttoolkit4 expat Debian Ubuntu Azure Linux Alpine
  Feb 18, 2022
• Critical 9.6
  CVE-2022-26384

  If an attacker could control the contents of an iframe sandboxed with <code>allow-popups</code> but not <code>allow-scr…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Dec 22, 2022
• High 8.8
  CVE-2022-0566

  It may be possible for an attacker to craft an email message that causes Thunderbird to perform an out-of-bounds write …

  Mozilla Thunderbird thunderbird thunderbird Debian Ubuntu Alpine
  Dec 22, 2022
• High 8.8
  CVE-2022-26381

  An attacker could have caused a use-after-free by forcing a text reflow in an SVG object leading to a potentially explo…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Dec 22, 2022
• High 7.5
  CVE-2022-26387

  When installing an add-on, Firefox verified the signature before prompting the user; but while the user was confirming …

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Dec 22, 2022
• Medium 6.5
  CVE-2022-26386

  Previously Firefox for macOS and Linux would download temporary files to a user-specific directory in <code>/tmp</code>…

  Mozilla Thunderbird Firefox ESR thunderbird Browsers Debian Ubuntu Alpine
  Dec 22, 2022
• Medium 4.3
  CVE-2022-26383

  When resizing a popup after requesting fullscreen access, the popup would not display the fullscreen notification. This…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Dec 22, 2022

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2055591
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2056363
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2056366
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2056370
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2061735
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2061736
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2062220
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2062221
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2062222
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2062223
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2062224
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_0845.json
• report
  https://access.redhat.com/security/cve/CVE-2022-0566
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-0566
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-0566
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2022-07/#CVE-2022-0566
• report
  https://access.redhat.com/security/cve/CVE-2022-22822
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2044457
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-22822
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-22822
• article
  https://github.com/libexpat/libexpat/pull/539
• report
  https://access.redhat.com/security/cve/CVE-2022-22823
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2044464
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-22823
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-22823
• report
  https://access.redhat.com/security/cve/CVE-2022-22824
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2044467
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-22824
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-22824
• report
  https://access.redhat.com/security/cve/CVE-2022-25235
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-25235
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-25235
• article
  https://blog.hartwork.org/posts/expat-2-4-5-released/
• report
  https://access.redhat.com/security/cve/CVE-2022-25236
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-25236
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-25236
• report
  https://access.redhat.com/security/cve/CVE-2022-25315
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-25315