Red Hat Security Advisory: thunderbird security update

Fixed packages 3

Vulnerabilities 5

• High 8.8
  CVE-2022-38473

  A cross-origin iframe referencing an XSLT document would inherit the parent domain's permissions (such as microphone or…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Dec 22, 2022
• High 8.8
  CVE-2022-38477

  Mozilla developer Nika Layzell and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 103 and Fire…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Dec 22, 2022
• High 8.8
  CVE-2022-38478

  Members the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 103, Firefox ESR 102.1, and Firefox ESR…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Dec 22, 2022
• High 7.5
  CVE-2022-38476

  A data race could occur in the <code>PK11_ChangePW</code> function, potentially leading to a use-after-free vulnerabili…

  Mozilla Thunderbird Firefox ESR thunderbird Browsers Debian Ubuntu Alpine
  Dec 22, 2022
• Medium 6.5
  CVE-2022-38472

  An attacker could have abused XSLT error handling to associate attacker-controlled content with another origin which wa…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Dec 22, 2022

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2120673
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2120674
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2120678
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2120695
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2120696
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_6166.json
• report
  https://access.redhat.com/security/cve/CVE-2022-38472
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-38472
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-38472
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2022-34/#CVE-2022-38472
• report
  https://access.redhat.com/security/cve/CVE-2022-38473
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-38473
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-38473
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2022-34/#CVE-2022-38473
• report
  https://access.redhat.com/security/cve/CVE-2022-38476
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-38476
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-38476
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2022-34/#CVE-2022-38476
• report
  https://access.redhat.com/security/cve/CVE-2022-38477
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-38477
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-38477
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2022-34/#CVE-2022-38477
• report
  https://access.redhat.com/security/cve/CVE-2022-38478
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-38478
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-38478
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2022-34/#CVE-2022-38478