Red Hat Security Advisory: thunderbird security update

Fixed packages 9

Vulnerabilities 7

• Critical 9.8
  CVE-2022-46882

  A use-after-free in WebGL extensions could have led to a potentially exploitable crash. This vulnerability affects Fire…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Dec 22, 2022
• High 8.8
  CVE-2022-46874

  A file with a long filename could have had its filename truncated to remove the valid extension, leaving a malicious ex…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Dec 22, 2022
• High 8.8
  CVE-2022-46878

  Mozilla developers Randell Jesup, Valentin Gosu, Olli Pettay, and the Mozilla Fuzzing Team reported memory safety bugs …

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Dec 22, 2022
• High 8.8
  CVE-2022-46881

  An optimization in WebGL was incorrect in some cases, and could have led to memory corruption and a potentially exploit…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Dec 22, 2022
• High 8.6
  CVE-2022-46872

  An attacker who compromised a content process could have partially escaped the sandbox to read arbitrary files via clip…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Dec 22, 2022
• High 8.1
  CVE-2022-45414

  If a Thunderbird user quoted from an HTML email, for example by replying to the email, and the email contained either a…

  Mozilla Thunderbird thunderbird thunderbird Debian Ubuntu
  Dec 22, 2022
• Medium 6.5
  CVE-2022-46880

  A missing check related to tex units could have led to a use-after-free and potentially exploitable crash.<br />*Note*:…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Dec 22, 2022

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2149868
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2153441
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2153449
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2153454
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2153463
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2153466
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2153467
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_9076.json
• report
  https://access.redhat.com/security/cve/CVE-2022-45414
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-45414
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-45414
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2022-50/#CVE-2022-45414
• report
  https://access.redhat.com/security/cve/CVE-2022-46872
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-46872
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-46872
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2022-52/#CVE-2022-46872
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2022-53/#CVE-2022-46872
• report
  https://access.redhat.com/security/cve/CVE-2022-46874
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-46874
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-46874
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2022-52/#CVE-2022-46874
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2022-53
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2022-54/#CVE-2022-46874
• report
  https://access.redhat.com/security/cve/CVE-2022-46878
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-46878
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-46878
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2022-52/#CVE-2022-46878
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2022-53/#CVE-2022-46878
• report
  https://access.redhat.com/security/cve/CVE-2022-46880
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-46880
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-46880
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2022-52/#CVE-2022-46880
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2022-53/#CVE-2022-46880
• report
  https://access.redhat.com/security/cve/CVE-2022-46881
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-46881
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-46881
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2022-52/#CVE-2022-46881
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2022-53/#CVE-2022-46881