Important: Thunderbird Security Update - Arbitrary File Read and Memory Safety Bugs
Summary
ALSA-2022:9074: Important: thunderbird security update. Affects thunderbird versions < 102.6.0-2.el8_7.alma. Fixed in 102.6.0-2.el8_7.alma. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Mozilla Thunderbird is a standalone mail and newsgroup client. It is widely used for managing emails and accessing newsgroups. Thunderbird provides various features such as email organization, search functionality, and support for multiple email accounts. However, Thunderbird is vulnerable to several security issues that could potentially compromise user data and system integrity.
Vulnerability Detail
The recent update to Thunderbird addresses multiple security vulnerabilities. These include:
-
Arbitrary file read from a compromised content process (CVE-2022-46872): An attacker could exploit this vulnerability to read arbitrary files on the system.
-
Memory safety bugs fixed in Firefox ESR 102.6 and Thunderbird 102.6 (CVE-2022-46878): These bugs could lead to memory corruption and potential code execution.
-
Use-after-free in WebGL (CVE-2022-46880 and CVE-2022-46882): These vulnerabilities could be exploited to execute arbitrary code or cause a denial of service.
-
Memory corruption in WebGL (CVE-2022-46881): This vulnerability could allow an attacker to execute arbitrary code.
-
Quoting from an HTML email with certain tags will trigger network requests and load remote content, regardless of a configuration to block remote content (CVE-2022-45414): This could lead to unintended network requests and loading of remote content.
-
Drag and Dropped Filenames could have been truncated to malicious extensions (CVE-2022-46874): An attacker could manipulate filenames to execute malicious code.
These vulnerabilities pose a significant risk to Thunderbird users, as they could result in unauthorized access to sensitive information, remote code execution, or denial of service attacks.
How To Fix
Minimum fixed version
102.6.0-2.el8_7.alma
This is the first release that contains the fix.
sudo dnf update thunderbirdTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The recent Thunderbird security update addresses multiple vulnerabilities that could potentially compromise user data and system integrity. It is crucial for Thunderbird users to update to the latest version to ensure they are protected against these security risks. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for thunderbird →
FAQ
Thunderbird is a standalone mail and newsgroup client developed by Mozilla. It allows users to manage their emails, access newsgroups, and provides various features for email organization and search functionality.
The vulnerabilities addressed in this update could lead to unauthorized access to sensitive information, remote code execution, or denial of service attacks. It is crucial to update Thunderbird to mitigate these risks.
To update Thunderbird, open the application and go to the Help menu. From there, select 'About Thunderbird' and click on the 'Check for Updates' button. Follow the prompts to install the latest version.
No specific workarounds have been mentioned for these vulnerabilities. It is recommended to update Thunderbird to the latest version to address the security issues.
You can find more information about these vulnerabilities, including their impact, CVSS scores, and related details, on the CVE pages listed in the References section of the original vulnerability report.
Related vulnerabilities
Recent vulnerabilities recorded for thunderbird.
