Red Hat Security Advisory: thunderbird security update

Fixed packages 6

Vulnerabilities 8

• Critical 9.8
  CVE-2022-31736

  A malicious website could have learned the size of a cross-origin resource that supported Range requests. This vulnerab…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Dec 22, 2022
• Critical 9.8
  CVE-2022-31737

  A malicious webpage could have caused an out-of-bounds write in WebGL, leading to memory corruption and a potentially e…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Dec 22, 2022
• Critical 9.8
  CVE-2022-31747

  Mozilla developers Andrew McCreight, Nicolas B. Pierron, and the Mozilla Fuzzing Team reported memory safety bugs prese…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Dec 22, 2022
• High 8.8
  CVE-2022-31740

  On arm64, WASM code could have resulted in incorrect assembly generation leading to a register allocation problem, and …

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Dec 22, 2022
• High 8.8
  CVE-2022-31741

  A crafted CMS message could have been processed incorrectly, leading to an invalid memory read, and potentially further…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Dec 22, 2022
• Medium 6.5
  CVE-2022-1834

  When displaying the sender of an email, and the sender name contained the Braille Pattern Blank space character multipl…

  Mozilla Thunderbird thunderbird thunderbird Debian Ubuntu Alpine
  Dec 22, 2022
• Medium 6.5
  CVE-2022-31738

  When exiting fullscreen mode, an iframe could have confused the browser about the current state of fullscreen, resultin…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Dec 22, 2022
• Medium 6.5
  CVE-2022-31742

  An attacker could have exploited a timing attack by sending a large number of allowCredential entries and detecting the…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Dec 22, 2022

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2092018
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2092019
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2092021
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2092023
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2092024
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2092025
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2092026
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2092416
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_4891.json
• report
  https://access.redhat.com/security/cve/CVE-2022-1834
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-1834
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-1834
• report
  https://access.redhat.com/security/cve/CVE-2022-31736
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-31736
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-31736
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2022-21/#CVE-2022-31736
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2022-22/#CVE-2022-31736
• report
  https://access.redhat.com/security/cve/CVE-2022-31737
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-31737
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-31737
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2022-21/#CVE-2022-31737
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2022-22/#CVE-2022-31737
• report
  https://access.redhat.com/security/cve/CVE-2022-31738
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-31738
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-31738
• report
  https://access.redhat.com/security/cve/CVE-2022-31740
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-31740
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-31740
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2022-21/#CVE-2022-31740
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2022-22/#CVE-2022-31740
• report
  https://access.redhat.com/security/cve/CVE-2022-31741
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-31741
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-31741
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2022-21/#CVE-2022-31741
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2022-22/#CVE-2022-31741
• report
  https://access.redhat.com/security/cve/CVE-2022-31742
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-31742
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-31742