Summary
Multiple security issues were discovered in Thunderbird. If a user were
tricked into opening a specially crafted website in a browsing context, an
attacker could potentially exploit these to cause a denial of service,
bypass Content Security Policy (CSP) or other security restrictions, or
execute arbitrary code. These issues only affect Ubuntu 18.04 LTS, Ubuntu
20.04 LTS and Ubuntu 22.04 LTS. (CVE-2022-3266, CVE-2022-40956,
CVE-2022-40957, CVE-2022-40958, CVE-2022-40959, CVE-2022-40960,
CVE-2022-40962)
Multiple security issues were discovered in the Matrix SDK bundled with
Thunderbird. An attacker could potentially exploit these in order to
impersonate another user. These issues only affect Ubuntu 18.04 LTS,
Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2022-39236, CVE-2022-39249,
CVE-2022-39250, CVE-2022-39251)
Multiple security issues were discovered in Thunderbird. If a user were
tricked into opening a specially crafted website in a browsing context, an
attacker could potentially exploit these to cause a denial of service,
obtain sensitive information, or execute arbitrary code. (CVE-2022-42927,
CVE-2022-42928, CVE-2022-42929, CVE-2022-42932)
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 18.04 LTS 18.04:LTS | thunderbird | 1:102.4.2+build2-0ubuntu0.18.04.1 |
| Ubuntu · 20.04 LTS 20.04:LTS | thunderbird | 1:102.4.2+build2-0ubuntu0.20.04.1 |
| Ubuntu · 22.04 LTS 22.04:LTS | thunderbird | 1:102.4.2+build2-0ubuntu0.22.04.1 |
Vulnerabilities 15
-
High 8.8
Mozilla developers Nika Layzell, Timothy Nikkel, Sebastian Hengst, Andreas Pehrson, and the Mozilla Fuzzing Team report…
-
High 8.8
Certain types of allocations were missing annotations that, if the Garbage Collector was in a specific state, could hav…
-
High 8.8
Mozilla developers Ashley Hale and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 105 and Fire…
-
High 8.6
Matrix JavaScript SDK vulnerable to key/device identifier confusion in SAS verification
Matrix JavaScript SDK is the Matrix Client-Server software development kit (SDK) for JavaScript. Prior to version 19.7.0, an attacker cooperating with a malicious homeserver could interfere with the verification flow between two users, injecting its own cross…
-
High 8.6
Matrix Javascript SDK vulnerable to Olm/Megolm protocol confusion
Matrix Javascript SDK is the Matrix Client-Server SDK for JavaScript. Prior to version 19.7.0, an attacker cooperating with a malicious homeserver can construct messages that legitimately appear to have come from another person, without any indication such as…
-
High 8.1
A same-origin policy violation could have allowed the theft of cross-origin URL entries, leaking the result of a redire…
-
High 7.5
Matrix Javascript SDK vulnerable to impersonation via forwarded Megolm sessions
Matrix Javascript SDK is the Matrix Client-Server SDK for JavaScript. Prior to version 19.7.0, an attacker cooperating with a malicious homeserver can construct messages appearing to have come from another person. Such messages will be marked with a grey shie…
-
Medium 6.5
Inconsistent data in instruction and data cache when creating wasm code could lead to a potentially exploitable crash.<…
-
Medium 6.5
By injecting a cookie with certain special characters, an attacker on a shared subdomain which is not a secure context …
-
Medium 6.5
During iframe navigation, certain pages did not have their FeaturePolicy fully initialized leading to a bypass that lea…
-
Medium 6.5
Concurrent use of the URL parser with non-UTF-8 data was not thread-safe. This could lead to a use-after-free causing a…
-
Medium 6.5
If a website called `window.print()` in a particular way, it could cause a denial of service of the browser, which may …
-
Medium 6.1
When injecting an HTML base element, some requests would ignore the CSP's base-uri settings and accept the injected ele…
-
Medium 5.5
An out-of-bounds read can occur when decoding H264 video. This results in a potentially exploitable crash. This vulnera…
-
Medium 4.3
Matrix Javascript SDK improper beacon events can cause availability issues
Matrix Javascript SDK is the Matrix Client-Server SDK for JavaScript. Starting with version 17.1.0-rc.1, improperly formed beacon events can disrupt or impede the matrix-js-sdk from functioning properly, potentially impacting the consumer's ability to process…
References
-
report
https://ubuntu.com/security/CVE-2022-3266
-
report
https://ubuntu.com/security/CVE-2022-39236
-
report
https://ubuntu.com/security/CVE-2022-39249
-
report
https://ubuntu.com/security/CVE-2022-39250
-
report
https://ubuntu.com/security/CVE-2022-39251
-
report
https://ubuntu.com/security/CVE-2022-40956
-
report
https://ubuntu.com/security/CVE-2022-40957
-
report
https://ubuntu.com/security/CVE-2022-40958
-
report
https://ubuntu.com/security/CVE-2022-40959
-
report
https://ubuntu.com/security/CVE-2022-40960
-
report
https://ubuntu.com/security/CVE-2022-40962
-
report
https://ubuntu.com/security/CVE-2022-42927
-
report
https://ubuntu.com/security/CVE-2022-42928
-
report
https://ubuntu.com/security/CVE-2022-42929
-
report
https://ubuntu.com/security/CVE-2022-42932