Summary
Multiple security issues were discovered in Thunderbird. If a user were
tricked into opening a specially crafted website in a browsing context, an
attacker could potentially exploit these to cause a denial of service,
conduct spoofing attacks, or execute arbitrary code. (CVE-2022-1097,
CVE-2022-1196, CVE-2022-28281, CVE-2022-28282, CVE-2022-28285,
CVE-2022-28286, CVE-2022-28289)
It was discovered that Thunderbird ignored OpenPGP revocation when
importing a revoked key in some circumstances. An attacker could
potentially exploit this by tricking the user into trusting the
authenticity of a message or tricking them into use a revoked key to
send an encrypted message. (CVE-2022-1197)
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 18.04 LTS 18.04:LTS | thunderbird | 1:91.8.1+build1-0ubuntu0.18.04.1 |
| Ubuntu · 20.04 LTS 20.04:LTS | thunderbird | 1:91.8.1+build1-0ubuntu0.20.04.1 |
Vulnerabilities 8
-
High 8.8CVE-2022-28281 Public exploit
If a compromised content process sent an unexpected number of WebAuthN Extensions in a Register command to the parent p…
-
High 8.8
Mozilla developers and community members Nika Layzell, Andrew McCreight, Gabriele Svelto, and the Mozilla Fuzzing Team …
-
Medium 6.5
<code>NSSToken</code> objects were referenced via direct points, and could have been accessed in an unsafe way on diffe…
-
Medium 6.5
After a VR Process is destroyed, a reference to it may have been retained and used, leading to a use-after-free and pot…
-
Medium 6.5
By using a link with <code>rel="localization"</code> a use-after-free could have been triggered by destroying an object…
-
Medium 6.5
When generating the assembly code for <code>MLoadTypedArrayElementHole</code>, an incorrect AliasSet was used. In conju…
-
Medium 5.4
When importing a revoked key that specified key compromise as the revocation reason, Thunderbird did not update the exi…
-
Medium 5.4
Due to a layout change, iframe contents could have been rendered outside of its border. This could have led to user con…
References
-
report
https://ubuntu.com/security/CVE-2022-1097
-
report
https://ubuntu.com/security/CVE-2022-1196
-
report
https://ubuntu.com/security/CVE-2022-1197
-
report
https://ubuntu.com/security/CVE-2022-28281
-
report
https://ubuntu.com/security/CVE-2022-28282
-
report
https://ubuntu.com/security/CVE-2022-28285
-
report
https://ubuntu.com/security/CVE-2022-28286
-
report
https://ubuntu.com/security/CVE-2022-28289