Red Hat Security Advisory: thunderbird security update

Fixed packages 3

Vulnerabilities 11

• High 8.8
  CVE-2022-40962

  Mozilla developers Nika Layzell, Timothy Nikkel, Sebastian Hengst, Andreas Pehrson, and the Mozilla Fuzzing Team report…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Dec 22, 2022
• High 8.2
  CVE-2022-36059

  Prototype pollution in matrix-js-sdk

  matrix-js-sdk is a Matrix messaging protocol Client-Server SDK for JavaScript. In versions prior to 19.4.0 events sent with special strings in key places can temporarily disrupt or impede the matrix-js-sdk from functioning properly, potentially impacting the …

  Matrix matrix-js-sdk thunderbird thunderbird Debian Ubuntu Alpine npm
  Mar 28, 2023
• High 8.1
  CVE-2022-3033

  If a Thunderbird user replied to a crafted HTML email containing a <code>meta</code> tag, with the <code>meta</code> ta…

  Mozilla Thunderbird thunderbird thunderbird Debian Ubuntu
  Dec 22, 2022
• Medium 6.5
  CVE-2022-40957

  Inconsistent data in instruction and data cache when creating wasm code could lead to a potentially exploitable crash.<…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Dec 22, 2022
• Medium 6.5
  CVE-2022-40958

  By injecting a cookie with certain special characters, an attacker on a shared subdomain which is not a secure context …

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Dec 22, 2022
• Medium 6.5
  CVE-2022-40959

  During iframe navigation, certain pages did not have their FeaturePolicy fully initialized leading to a bypass that lea…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Dec 22, 2022
• Medium 6.5
  CVE-2022-40960

  Concurrent use of the URL parser with non-UTF-8 data was not thread-safe. This could lead to a use-after-free causing a…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Dec 22, 2022
• Medium 6.1
  CVE-2022-40956

  When injecting an HTML base element, some requests would ignore the CSP's base-uri settings and accept the injected ele…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Dec 22, 2022
• Medium 5.5
  CVE-2022-3266

  An out-of-bounds read can occur when decoding H264 video. This results in a potentially exploitable crash. This vulnera…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Dec 22, 2022
• Medium 4.3
  CVE-2022-3034

  When receiving an HTML email that specified to load an <code>iframe</code> element from a remote location, a request to…

  Mozilla Thunderbird thunderbird thunderbird Debian Ubuntu
  Dec 22, 2022
• Unscored —
  CVE-2022-3032

  When receiving an HTML email that contained an <code>iframe</code> element, which used a <code>srcdoc</code> attribute …

  Mozilla Thunderbird thunderbird thunderbird Debian Ubuntu
  Dec 22, 2022

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2123255
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2123256
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2123257
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2123258
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2128792
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2128793
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2128794
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2128795
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2128796
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2128797
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_6715.json
• report
  https://access.redhat.com/security/cve/CVE-2022-3032
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-3032
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-3032
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2022-38/#CVE-2022-3032
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2022-39/#CVE-2022-3032
• report
  https://access.redhat.com/security/cve/CVE-2022-3033
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-3033
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-3033
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2022-38/#CVE-2022-3033
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2022-39/#CVE-2022-3033
• report
  https://access.redhat.com/security/cve/CVE-2022-3034
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-3034
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-3034
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2022-38/#CVE-2022-3034
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2022-39/#CVE-2022-3034
• report
  https://access.redhat.com/security/cve/CVE-2022-3266
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2157739
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-3266
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-3266
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2022-41/#CVE-2022-3266
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2022-42/#CVE-2022-3266
• report
  https://access.redhat.com/security/cve/CVE-2022-36059
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-36059
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-36059
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2022-38/#CVE-2022-36059
• report
  https://access.redhat.com/security/cve/CVE-2022-40956
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-40956