Red Hat Security Advisory: thunderbird security update

Fixed packages 3

Vulnerabilities 8

• High 8.8
  CVE-2022-42928

  Certain types of allocations were missing annotations that, if the Garbage Collector was in a specific state, could hav…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Dec 22, 2022
• High 8.8
  CVE-2022-42932

  Mozilla developers Ashley Hale and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 105 and Fire…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Dec 22, 2022
• High 8.6
  CVE-2022-39250

  Matrix JavaScript SDK vulnerable to key/device identifier confusion in SAS verification

  Matrix JavaScript SDK is the Matrix Client-Server software development kit (SDK) for JavaScript. Prior to version 19.7.0, an attacker cooperating with a malicious homeserver could interfere with the verification flow between two users, injecting its own cross…

  Matrix matrix-js-sdk thunderbird node-matrix-js-sdk Debian Ubuntu Alpine npm
  Sep 29, 2022
• High 8.6
  CVE-2022-39251

  Matrix Javascript SDK vulnerable to Olm/Megolm protocol confusion

  Matrix Javascript SDK is the Matrix Client-Server SDK for JavaScript. Prior to version 19.7.0, an attacker cooperating with a malicious homeserver can construct messages that legitimately appear to have come from another person, without any indication such as…

  Matrix matrix-js-sdk thunderbird node-matrix-js-sdk Debian Ubuntu Alpine npm
  Sep 28, 2022
• High 8.1
  CVE-2022-42927

  A same-origin policy violation could have allowed the theft of cross-origin URL entries, leaking the result of a redire…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Dec 22, 2022
• High 7.5
  CVE-2022-39249

  Matrix Javascript SDK vulnerable to impersonation via forwarded Megolm sessions

  Matrix Javascript SDK is the Matrix Client-Server SDK for JavaScript. Prior to version 19.7.0, an attacker cooperating with a malicious homeserver can construct messages appearing to have come from another person. Such messages will be marked with a grey shie…

  Matrix matrix-js-sdk thunderbird node-matrix-js-sdk Debian Ubuntu Alpine npm
  Sep 28, 2022
• Medium 6.5
  CVE-2022-42929

  If a website called `window.print()` in a particular way, it could cause a denial of service of the browser, which may …

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Dec 22, 2022
• Medium 4.3
  CVE-2022-39236

  Matrix Javascript SDK improper beacon events can cause availability issues

  Matrix Javascript SDK is the Matrix Client-Server SDK for JavaScript. Starting with version 17.1.0-rc.1, improperly formed beacon events can disrupt or impede the matrix-js-sdk from functioning properly, potentially impacting the consumer's ability to process…

  Matrix matrix-js-sdk thunderbird node-matrix-js-sdk Debian Ubuntu Alpine npm
  Sep 28, 2022

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2135391
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2135393
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2135395
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2135396
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2136156
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2136157
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2136158
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2136159
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_7181.json
• report
  https://access.redhat.com/security/cve/CVE-2022-39236
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-39236
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-39236
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2022-43/#CVE-2022-39236
• report
  https://access.redhat.com/security/cve/CVE-2022-39249
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-39249
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-39249
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2022-43/#CVE-2022-39249
• report
  https://access.redhat.com/security/cve/CVE-2022-39250
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-39250
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-39250
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2022-43/#CVE-2022-39250
• report
  https://access.redhat.com/security/cve/CVE-2022-39251
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-39251
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-39251
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2022-43/#CVE-2022-39251
• report
  https://access.redhat.com/security/cve/CVE-2022-42927
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-42927
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-42927
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2022-45/#CVE-2022-42927
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2022-46/#CVE-2022-42927
• report
  https://access.redhat.com/security/cve/CVE-2022-42928
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-42928
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-42928
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2022-45/#CVE-2022-42928
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2022-46/#CVE-2022-42928
• report
  https://access.redhat.com/security/cve/CVE-2022-42929
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-42929
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-42929