Red Hat Security Advisory: thunderbird security update

Fixed packages 3

Vulnerabilities 9

• High 8.8
  CVE-2022-28281 Public exploit

  If a compromised content process sent an unexpected number of WebAuthN Extensions in a Register command to the parent p…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Dec 22, 2022
• High 8.8
  CVE-2022-28289

  Mozilla developers and community members Nika Layzell, Andrew McCreight, Gabriele Svelto, and the Mozilla Fuzzing Team …

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Dec 22, 2022
• High 7.5
  CVE-2022-24713 Public exploit EPSS 14%

  Regular expression denial of service in Rust's regex crate

  regex is an implementation of regular expressions for the Rust language. The regex crate features built-in mitigations to prevent denial of service attacks caused by untrusted regexes, or untrusted input matched by trusted regexes. Those (tunable) mitigations…

  rust-lang regex thunderbird firefox Debian Ubuntu Azure Linux Alpine crates.io
  Mar 8, 2022
• Medium 6.5
  CVE-2022-1097

  <code>NSSToken</code> objects were referenced via direct points, and could have been accessed in an unsafe way on diffe…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Dec 22, 2022
• Medium 6.5
  CVE-2022-1196

  After a VR Process is destroyed, a reference to it may have been retained and used, leading to a use-after-free and pot…

  Mozilla Thunderbird Firefox ESR thunderbird Browsers Debian Ubuntu Alpine
  Dec 22, 2022
• Medium 6.5
  CVE-2022-28282

  By using a link with <code>rel="localization"</code> a use-after-free could have been triggered by destroying an object…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Dec 22, 2022
• Medium 6.5
  CVE-2022-28285

  When generating the assembly code for <code>MLoadTypedArrayElementHole</code>, an incorrect AliasSet was used. In conju…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Dec 22, 2022
• Medium 5.4
  CVE-2022-1197

  When importing a revoked key that specified key compromise as the revocation reason, Thunderbird did not update the exi…

  Mozilla Thunderbird thunderbird thunderbird Debian Ubuntu Alpine
  Dec 22, 2022
• Medium 5.4
  CVE-2022-28286

  Due to a layout change, iframe contents could have been rendered outside of its border. This could have led to user con…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Dec 22, 2022

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2072559
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2072560
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2072561
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2072562
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2072563
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2072564
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2072565
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2072566
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2072963
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_1303.json
• report
  https://access.redhat.com/security/cve/CVE-2022-1097
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-1097
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-1097
• report
  https://access.redhat.com/security/cve/CVE-2022-1196
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-1196
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-1196
• report
  https://access.redhat.com/security/cve/CVE-2022-1197
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-1197
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-1197
• report
  https://access.redhat.com/security/cve/CVE-2022-24713
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-24713
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-24713
• report
  https://access.redhat.com/security/cve/CVE-2022-28281
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-28281
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-28281
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2022-14/#CVE-2022-28281
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2022-15/#CVE-2022-28281
• report
  https://access.redhat.com/security/cve/CVE-2022-28282
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-28282
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-28282
• report
  https://access.redhat.com/security/cve/CVE-2022-28285
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-28285
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-28285
• report
  https://access.redhat.com/security/cve/CVE-2022-28286
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-28286
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-28286
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2022-14/#CVE-2022-28286
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2022-15/#CVE-2022-28286