Summary
Mozilla Thunderbird is a standalone mail and newsgroup client.
This update upgrades Thunderbird to version 102.3.0.
Security Fix(es):
* Mozilla: Leaking of sensitive information when composing a response to an HTML email with a META refresh tag (CVE-2022-3033)
* Mozilla: Bypassing FeaturePolicy restrictions on transient pages (CVE-2022-40959)
* Mozilla: Data-race when parsing non-UTF-8 URLs in threads (CVE-2022-40960)
* Mozilla: Memory safety bugs fixed in Firefox 105 and Firefox ESR 102.3 (CVE-2022-40962)
* Mozilla: Remote content specified in an HTML document that was nested inside an iframe's srcdoc attribute was not blocked (CVE-2022-3032)
* Mozilla: An iframe element in an HTML email could trigger a network request (CVE-2022-3034)
* Mozilla: Matrix SDK bundled with Thunderbird vulnerable to denial-of-service attack (CVE-2022-36059)
* Mozilla: Bypassing Secure Context restriction for cookies with __Host and __Secure prefix (CVE-2022-40958)
* Mozilla: Content-Security-Policy base-uri bypass (CVE-2022-40956)
* Mozilla: Incoherent instruction cache when building WASM on ARM64 (CVE-2022-40957)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Rocky Linux · 8 | thunderbird | 0:102.3.0-3.el8_6 |
Vulnerabilities 10
-
High 8.8
Mozilla developers Nika Layzell, Timothy Nikkel, Sebastian Hengst, Andreas Pehrson, and the Mozilla Fuzzing Team report…
-
High 8.2
Prototype pollution in matrix-js-sdk
matrix-js-sdk is a Matrix messaging protocol Client-Server SDK for JavaScript. In versions prior to 19.4.0 events sent with special strings in key places can temporarily disrupt or impede the matrix-js-sdk from functioning properly, potentially impacting the …
-
High 8.1
If a Thunderbird user replied to a crafted HTML email containing a <code>meta</code> tag, with the <code>meta</code> ta…
-
Medium 6.5
Inconsistent data in instruction and data cache when creating wasm code could lead to a potentially exploitable crash.<…
-
Medium 6.5
By injecting a cookie with certain special characters, an attacker on a shared subdomain which is not a secure context …
-
Medium 6.5
During iframe navigation, certain pages did not have their FeaturePolicy fully initialized leading to a bypass that lea…
-
Medium 6.5
Concurrent use of the URL parser with non-UTF-8 data was not thread-safe. This could lead to a use-after-free causing a…
-
Medium 6.1
When injecting an HTML base element, some requests would ignore the CSP's base-uri settings and accept the injected ele…
-
Medium 4.3
When receiving an HTML email that specified to load an <code>iframe</code> element from a remote location, a request to…
-
Unscored —
When receiving an HTML email that contained an <code>iframe</code> element, which used a <code>srcdoc</code> attribute …
References
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2123255
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2123256
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2123257
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2123258
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2128792
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2128793
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2128794
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2128795
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2128796
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2128797