Summary
Multiple security issues were discovered in Thunderbird. If a user were
tricked into opening a specially crafted website in a browsing context, an
attacker could potentially exploit these to cause a denial of service,
bypass permission prompts, obtain sensitive information, bypass security
restrictions, cause user confusion, or execute arbitrary code.
(CVE-2022-29909, CVE-2022-29911, CVE-2022-29912, CVE-2022-29913,
CVE-2022-29914, CVE-2022-29916, CVE-2022-29917)
It was discovered that Thunderbird would show the wrong security status
after viewing an attached message that is signed or encrypted. An attacker
could potentially exploit this by tricking the user into trusting the
authenticity of a message. (CVE-2022-1520)
It was discovered that the methods of an Array object could be corrupted
as a result of prototype pollution by sending a message to the parent
process. If a user were tricked into opening a specially crafted website
in a browsing context, an attacker could exploit this to execute
JavaScript in a privileged context. (CVE-2022-1529, CVE-2022-1802)
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 18.04 LTS 18.04:LTS | thunderbird | 1:91.9.1+build1-0ubuntu0.18.04.1 |
| Ubuntu · 20.04 LTS 20.04:LTS | thunderbird | 1:91.9.1+build1-0ubuntu0.20.04.1 |
| Ubuntu · 22.04 LTS 22.04:LTS | thunderbird | 1:91.9.1+build1-0ubuntu0.22.04.1 |
Vulnerabilities 10
-
Critical 9.8
Mozilla developers Andrew McCreight, Gabriele Svelto, Tom Ritter and the Mozilla Fuzzing Team reported memory safety bu…
-
High 8.8CVE-2022-1529 EPSS 18%
An attacker could have sent a message to the parent process where the contents were used to double-index into a JavaScr…
-
High 8.8
If an attacker was able to corrupt the methods of an Array object in JavaScript via prototype pollution, they could hav…
-
High 8.8
Documents in deeply-nested cross-origin browsing contexts could have obtained permissions granted to the top-level orig…
-
Medium 6.5
The parent process would not properly check whether the Speech Synthesis feature is enabled, when receiving instruction…
-
Medium 6.5
When reusing existing popups Firefox would have allowed them to cover the fullscreen notification UI, which could have …
-
Medium 6.5
Firefox behaved slightly differently for already known resources when loading CSS resources involving CSS variables. Th…
-
Medium 6.1
An improper implementation of the new iframe sandbox keyword <code>allow-top-navigation-by-user-activation</code> could…
-
Medium 6.1
Requests initiated through reader mode did not properly omit cookies with a SameSite attribute. This vulnerability affe…
-
Medium 4.3
When viewing an email message A, which contains an attached message B, where B is encrypted or digitally signed or both…
References
-
report
https://ubuntu.com/security/CVE-2022-1520
-
report
https://ubuntu.com/security/CVE-2022-1529
-
report
https://ubuntu.com/security/CVE-2022-1802
-
report
https://ubuntu.com/security/CVE-2022-29909
-
report
https://ubuntu.com/security/CVE-2022-29911
-
report
https://ubuntu.com/security/CVE-2022-29912
-
report
https://ubuntu.com/security/CVE-2022-29913
-
report
https://ubuntu.com/security/CVE-2022-29914
-
report
https://ubuntu.com/security/CVE-2022-29916
-
report
https://ubuntu.com/security/CVE-2022-29917