ALSA-2022:1730 - Thunderbird Security Update
Summary
ALSA-2022:1730: Important: thunderbird security update. Affects thunderbird versions < 91.9.0-3.el8_5.alma. Fixed in 91.9.0-3.el8_5.alma. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Mozilla Thunderbird is a standalone mail and newsgroup client. It provides users with a convenient way to manage their emails and participate in newsgroup discussions. Thunderbird is widely used and offers various features to enhance productivity and communication. However, it is susceptible to security vulnerabilities that can compromise user data and system integrity.
Vulnerability Detail
The latest security update for Thunderbird, version 91.9.0, addresses multiple vulnerabilities that could be exploited by attackers. These vulnerabilities include:
- Bypassing permission prompt in nested browsing contexts (CVE-2022-29909)
- Iframe Sandbox bypass (CVE-2022-29911)
- Fullscreen notification bypass using popups (CVE-2022-29914)
- Leaking browser history with CSS variables (CVE-2022-29916)
- Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9 (CVE-2022-29917)
- Reader mode bypassed SameSite cookies (CVE-2022-29912)
- Speech Synthesis feature not properly disabled (CVE-2022-29913)
- Incorrect security status shown after viewing an attached email (CVE-2022-1520)
These vulnerabilities can lead to various consequences, such as unauthorized access to sensitive information, bypassing security measures, and potential remote code execution. It is crucial to update Thunderbird to the latest version to mitigate these risks.
How To Fix
Minimum fixed version
91.9.0-3.el8_5.alma
This is the first release that contains the fix.
sudo dnf update thunderbirdTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
Updating Thunderbird to version 91.9.0 is crucial to address the identified vulnerabilities and protect user data. Regularly applying future security updates is also essential to stay protected against emerging threats. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for thunderbird →
FAQ
Thunderbird is a standalone mail and newsgroup client that allows users to manage their emails and participate in newsgroup discussions.
These vulnerabilities can result in unauthorized access to sensitive information, bypassing security measures, and potential remote code execution.
To fix the vulnerabilities, update Thunderbird to version 91.9.0 or later and regularly apply future security updates.
No specific workarounds have been mentioned for these vulnerabilities. It is recommended to update Thunderbird to the latest version.
To ensure the update is applied to all instances of Thunderbird, follow your organization's software update procedures and verify the version on each device.
Related vulnerabilities
Recent vulnerabilities recorded for thunderbird.
