Summary
Multiple security issues were discovered in Thunderbird. If a user were
tricked into opening a specially crafted website in a browsing context, an
attacker could potentially exploit these to cause a denial of service,
obtain sensitive information, spoof the UI, bypass CSP restrictions, or
execute arbitrary code. (CVE-2022-2200, CVE-2022-31736, CVE-2022-31737,
CVE-2022-31738, CVE-2022-31740, CVE-2022-31741, CVE-2022-31742,
CVE-2022-31744, CVE-2022-31747, CVE-2022-34468, CVE-2022-34470,
CVE-2022-34479, CVE-2022-34481, CVE-2022-34484)
It was discovered that an unavailable PAC file caused OCSP requests to
be blocked, resulting in incorrect error pages being displayed.
(CVE-2022-34472)
It was discovered that the Braille space character could be used to
cause Thunderbird to display the wrong sender address for signed messages.
An attacker could potentially exploit this to trick the user into
believing a message had been sent from somebody they trusted.
(CVE-2022-1834)
It was discovered that Thunderbird would consider an email with a
mismatched OpenPGP signature date as valid. An attacker could potentially
exploit this by replaying an older message in order to trick the user into
believing that the statements in the message are current. (CVE-2022-2226)
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 18.04 LTS 18.04:LTS | thunderbird | 1:91.11.0+build2-0ubuntu0.18.04.1 |
| Ubuntu · 20.04 LTS 20.04:LTS | thunderbird | 1:91.11.0+build2-0ubuntu0.20.04.1 |
| Ubuntu · 22.04 LTS 22.04:LTS | thunderbird | 1:91.11.0+build2-0ubuntu0.22.04.1 |
Vulnerabilities 17
-
Critical 9.8
A malicious website could have learned the size of a cross-origin resource that supported Range requests. This vulnerab…
-
Critical 9.8
A malicious webpage could have caused an out-of-bounds write in WebGL, leading to memory corruption and a potentially e…
-
Critical 9.8
Mozilla developers Andrew McCreight, Nicolas B. Pierron, and the Mozilla Fuzzing Team reported memory safety bugs prese…
-
Critical 9.8
Session history navigations may have led to a use-after-free and potentially exploitable crash. This vulnerability affe…
-
High 8.8CVE-2022-2200 EPSS 24%
If an object prototype was corrupted by an attacker, they would have been able to set undesired attributes on a JavaScr…
-
High 8.8
On arm64, WASM code could have resulted in incorrect assembly generation leading to a register allocation problem, and …
-
High 8.8
A crafted CMS message could have been processed incorrectly, leading to an invalid memory read, and potentially further…
-
High 8.8
An iframe that was not permitted to run scripts could do so if the user clicked on a <code>javascript:</code> link. Thi…
-
High 8.8
In the <code>nsTArray_Impl::ReplaceElementsAt()</code> function, an integer overflow could have occurred when the numbe…
-
High 8.8
The Mozilla Fuzzing Team reported potential vulnerabilities present in Thunderbird 91.10. Some of these bugs showed evi…
-
Medium 6.5
When displaying the sender of an email, and the sender name contained the Braille Pattern Blank space character multipl…
-
Medium 6.5
An OpenPGP digital signature includes information about the date when the signature was created. When displaying an ema…
-
Medium 6.5
When exiting fullscreen mode, an iframe could have confused the browser about the current state of fullscreen, resultin…
-
Medium 6.5
An attacker could have exploited a timing attack by sending a large number of allowCredential entries and detecting the…
-
Medium 6.5
An attacker could have injected CSS into stylesheets accessible via internal URIs, such as resource:, and in doing so b…
-
Medium 6.5
A malicious website that could create a popup could have resized the popup to overlay the address bar with its own cont…
-
Medium 4.3
If there was a PAC URL set and the server that hosts the PAC was not reachable, OCSP requests would have been blocked, …
References
-
report
https://ubuntu.com/security/CVE-2022-1834
-
report
https://ubuntu.com/security/CVE-2022-2200
-
report
https://ubuntu.com/security/CVE-2022-2226
-
report
https://ubuntu.com/security/CVE-2022-31736
-
report
https://ubuntu.com/security/CVE-2022-31737
-
report
https://ubuntu.com/security/CVE-2022-31738
-
report
https://ubuntu.com/security/CVE-2022-31740
-
report
https://ubuntu.com/security/CVE-2022-31741
-
report
https://ubuntu.com/security/CVE-2022-31742
-
report
https://ubuntu.com/security/CVE-2022-31744
-
report
https://ubuntu.com/security/CVE-2022-31747
-
report
https://ubuntu.com/security/CVE-2022-34468
-
report
https://ubuntu.com/security/CVE-2022-34470
-
report
https://ubuntu.com/security/CVE-2022-34472
-
report
https://ubuntu.com/security/CVE-2022-34479
-
report
https://ubuntu.com/security/CVE-2022-34481
-
report
https://ubuntu.com/security/CVE-2022-34484