Summary
Mozilla Thunderbird is a standalone mail and newsgroup client.
This update upgrades Thunderbird to version 91.5.0.
Security Fix(es):
* Mozilla: Iframe sandbox bypass with XSLT (CVE-2021-4140)
* Mozilla: Race condition when playing audio files (CVE-2022-22737)
* Mozilla: Heap-buffer-overflow in blendGaussianBlur (CVE-2022-22738)
* Mozilla: Use-after-free of ChannelEventQueue::mOwner (CVE-2022-22740)
* Mozilla: Browser window spoof using fullscreen mode (CVE-2022-22741)
* Mozilla: Out-of-bounds memory access when inserting text in edit mode (CVE-2022-22742)
* Mozilla: Browser window spoof using fullscreen mode (CVE-2022-22743)
* Mozilla: Memory safety bugs fixed in Firefox 96 and Firefox ESR 91.5 (CVE-2022-22751)
* Mozilla: Leaking cross-origin URLs through securitypolicyviolation event (CVE-2022-22745)
* Mozilla: Spoofed origin on external protocol launch dialog (CVE-2022-22748)
* Mozilla: Missing throttling on external protocol launch dialog (CVE-2022-22739)
* Mozilla: Crash when handling empty pkcs7 sequence (CVE-2022-22747)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Rocky Linux · 8 | thunderbird | 0:91.5.0-1.el8_5 |
Vulnerabilities 12
-
Critical 9.8
It was possible to construct specific XSLT markup that would be able to bypass an iframe sandbox. This vulnerability af…
-
High 8.8
Applying a CSS filter effect could have accessed out of bounds memory. This could have lead to a heap-buffer-overflow c…
-
High 8.8
Certain network request objects were freed too early when releasing a network request handle. This could have lead to a…
-
High 8.8
Mozilla developers Calixte Denizet, Kershaw Chang, Christian Holler, Jason Kratzer, Gabriele Svelto, Tyson Smith, Simon…
-
High 7.5
Constructing audio sinks could have lead to a race condition when playing audio files and closing windows. This could h…
-
High 7.5
When resizing a popup while requesting fullscreen access, the popup would have become unable to leave fullscreen mode. …
-
Medium 6.5
Malicious websites could have tricked users into accepting launching a program to handle an external URL protocol. This…
-
Medium 6.5
When inserting text while in edit mode, some characters might have lead to out-of-bounds memory access causing a potent…
-
Medium 6.5
Securitypolicyviolation events could have leaked cross-origin information for frame-ancestors violations. This vulnerab…
-
Medium 6.5
After accepting an untrusted certificate, handling an empty pkcs7 sequence as part of the certificate data could have l…
-
Medium 6.5
Malicious websites could have confused Firefox into showing the wrong origin when asking to launch a program and handli…
-
Medium 4.3
When navigating from inside an iframe while requesting fullscreen access, an attacker-controlled tab could have made th…
References
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2039561
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2039563
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2039564
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2039565
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2039566
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2039567
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2039568
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2039569
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2039570
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2039572
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2039573
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2039574