ALSA-2022:6164 - Thunderbird Security Update
Summary
ALSA-2022:6164: Important: thunderbird security update. Affects thunderbird versions < 91.13.0-1.el8_6.alma. Fixed in 91.13.0-1.el8_6.alma. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Mozilla Thunderbird is a standalone mail and newsgroup client. It is widely used for managing email communication and accessing newsgroups. Thunderbird provides various features such as email organization, filtering, and search capabilities. It is vulnerable to multiple security issues that have been addressed in this update.
Vulnerability Detail
The security update addresses several vulnerabilities in Thunderbird:
-
CVE-2022-38472: This vulnerability allowed for address bar spoofing via XSLT error handling. An attacker could exploit this to deceive users by displaying a different URL in the address bar.
-
CVE-2022-38473: Cross-origin XSLT Documents could inherit the parent's permissions, potentially leading to unauthorized access to sensitive information.
-
CVE-2022-38477: Memory safety bugs were fixed in Firefox 104 and Firefox ESR 102.2. These bugs could potentially be exploited to execute arbitrary code or cause a denial of service.
-
CVE-2022-38478: Memory safety bugs were fixed in Firefox 104, Firefox ESR 102.2, and Firefox ESR 91.13. These bugs could potentially be exploited to execute arbitrary code or cause a denial of service.
-
CVE-2022-38476: This vulnerability involved a data race and potential use-after-free in PK11_ChangePW, which could result in arbitrary code execution or a denial of service.
How To Fix
Minimum fixed version
91.13.0-1.el8_6.alma
This is the first release that contains the fix.
sudo dnf update thunderbirdTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The security update for Thunderbird addresses multiple vulnerabilities that could potentially be exploited to deceive users, gain unauthorized access, execute arbitrary code, or cause a denial of service. It is crucial to update Thunderbird to the latest version to ensure the security and integrity of email communication. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for thunderbird →
FAQ
Thunderbird is a standalone mail and newsgroup client developed by Mozilla. It provides features for managing email communication and accessing newsgroups.
Address bar spoofing is a technique used by attackers to deceive users by displaying a different URL in the address bar than the actual website they are visiting.
Memory safety bugs refer to vulnerabilities that can be exploited to access or modify memory in unintended ways. These bugs can potentially lead to arbitrary code execution or denial of service.
To update Thunderbird, you can download the latest version from the official Mozilla website or use your package manager to update the software.
No specific workarounds have been mentioned for these vulnerabilities. It is recommended to update Thunderbird to the latest version to mitigate the risks.
Related vulnerabilities
Recent vulnerabilities recorded for thunderbird.
