ALSA-2022:0129 - Thunderbird Security Update
Summary
ALSA-2022:0129: Important: thunderbird security update. Affects thunderbird across 2 version ranges.
< 91.5.0-1.el8_5.alma
< 91.5.0-1.el8_5.alma.plus
Fixed in 91.5.0-1.el8_5.alma or 91.5.0-1.el8_5.alma.plus, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Mozilla Thunderbird is a standalone mail and newsgroup client. It provides users with a convenient way to manage their emails and participate in newsgroups. Thunderbird is widely used and is available on multiple platforms. However, it is susceptible to various security vulnerabilities that can compromise the confidentiality, integrity, and availability of user data.
Vulnerability Detail
The latest security update for Thunderbird, version 91.5.0, addresses multiple vulnerabilities. These include:
-
Iframe sandbox bypass with XSLT (CVE-2021-4140): This vulnerability allows an attacker to bypass the iframe sandbox and execute arbitrary code.
-
Race condition when playing audio files (CVE-2022-22737): A race condition in Thunderbird's audio playback functionality can lead to a crash or potential code execution.
-
Heap-buffer-overflow in blendGaussianBlur (CVE-2022-22738): An overflow issue in the blendGaussianBlur function can be exploited to execute arbitrary code.
-
Use-after-free of ChannelEventQueue::mOwner (CVE-2022-22740): A use-after-free vulnerability in Thunderbird's ChannelEventQueue can result in a crash or potential code execution.
-
Browser window spoof using fullscreen mode (CVE-2022-22741 and CVE-2022-22743): These vulnerabilities allow an attacker to spoof the origin of a browser window when in fullscreen mode, potentially leading to phishing attacks.
-
Out-of-bounds memory access when inserting text in edit mode (CVE-2022-22742): A memory access issue in Thunderbird's text insertion functionality can be exploited to execute arbitrary code.
-
Memory safety bugs fixed in Firefox 96 and Firefox ESR 91.5 (CVE-2022-22751): Multiple memory safety bugs have been fixed in Thunderbird, enhancing its overall stability and security.
-
Leaking cross-origin URLs through securitypolicyviolation event (CVE-2022-22745): This vulnerability allows an attacker to leak cross-origin URLs through the securitypolicyviolation event.
-
Spoofed origin on external protocol launch dialog (CVE-2022-22748): An attacker can spoof the origin of an external protocol launch dialog, potentially tricking users into executing malicious actions.
-
Missing throttling on external protocol launch dialog (CVE-2022-22739): Thunderbird fails to apply throttling on external protocol launch dialogs, which can lead to excessive resource consumption.
-
Crash when handling empty pkcs7 sequence (CVE-2022-22747): A crash can occur in Thunderbird when handling an empty pkcs7 sequence, potentially leading to a denial-of-service condition.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
sudo dnf update thunderbird-
< 91.5.0-1.el8_5.alma91.5.0-1.el8_5.alma -
< 91.5.0-1.el8_5.alma.plus91.5.0-1.el8_5.alma.plus
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Conclusion
The latest security update for Thunderbird addresses multiple vulnerabilities that could potentially compromise user data and system security. It is highly recommended to update Thunderbird to the latest version (91.5.0) to ensure the best protection against these security issues. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for thunderbird →
FAQ
Thunderbird is a standalone mail and newsgroup client developed by Mozilla. It allows users to manage their emails and participate in newsgroups.
These vulnerabilities can lead to various security risks, including remote code execution, information disclosure, and denial-of-service attacks. Attackers can exploit these vulnerabilities to compromise the confidentiality, integrity, and availability of user data.
To protect yourself, it is crucial to update Thunderbird to the latest version (91.5.0) as soon as possible. Additionally, practicing safe browsing habits, such as avoiding suspicious links and attachments, can help mitigate the risk of exploitation.
At the moment, there are no specific workarounds mentioned for these vulnerabilities. It is recommended to update Thunderbird to the latest version to ensure the best protection against these security issues.
For more detailed information about each vulnerability, including their impact, CVSS scores, and related references, you can refer to the CVE pages listed in the References section of the original vulnerability report.
Related vulnerabilities
Recent vulnerabilities recorded for thunderbird.
