ALSA-2022:6165 - Thunderbird Security Update
Summary
ALSA-2022:6165: Important: thunderbird security update. Affects thunderbird versions < 91.13.0-1.el9_0.alma. Fixed in 91.13.0-1.el9_0.alma. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Mozilla Thunderbird is a standalone mail and newsgroup client. It provides users with a convenient way to manage their emails and participate in newsgroup discussions. Thunderbird is widely used and offers various features such as customizable email filters, advanced search capabilities, and support for multiple email accounts. However, it is susceptible to security vulnerabilities that can potentially compromise user data and system integrity.
Vulnerability Detail
The latest security update for Thunderbird, version 91.13.0, addresses several important vulnerabilities:
-
CVE-2022-38472: This vulnerability involves address bar spoofing via XSLT error handling. An attacker could exploit this issue to deceive users into believing they are visiting a legitimate website when they are actually interacting with a malicious one.
-
CVE-2022-38473: Cross-origin XSLT Documents in Thunderbird could inherit the permissions of their parent, potentially leading to unauthorized access or privilege escalation.
-
CVE-2022-38477: Memory safety bugs in Firefox 104 and Firefox ESR 102.2, which Thunderbird is based on, have been fixed. These bugs could potentially be exploited to execute arbitrary code or cause a denial of service.
-
CVE-2022-38478: Similar to the previous vulnerability, memory safety bugs in Thunderbird and its underlying Firefox components have been addressed. These bugs could lead to arbitrary code execution or denial of service attacks.
-
CVE-2022-38476: This vulnerability involves a data race and potential use-after-free in the PK11_ChangePW function. An attacker could exploit this issue to manipulate cryptographic keys or cause a denial of service.
These vulnerabilities pose a significant risk to Thunderbird users and should be addressed promptly.
How To Fix
Minimum fixed version
91.13.0-1.el9_0.alma
This is the first release that contains the fix.
sudo dnf update thunderbirdTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The security update for Thunderbird version 91.13.0 addresses several important vulnerabilities that could potentially compromise user data and system integrity. It is crucial to update Thunderbird to the latest version to mitigate these risks. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for thunderbird →
FAQ
Thunderbird is a standalone mail and newsgroup client developed by Mozilla. It allows users to manage their emails, participate in newsgroup discussions, and offers various features for organizing and searching messages.
The identified vulnerabilities in Thunderbird can lead to address bar spoofing, unauthorized access or privilege escalation, arbitrary code execution, denial of service, and potential manipulation of cryptographic keys.
To update Thunderbird, open the application, go to the 'Help' menu, select 'About Thunderbird', and follow the prompts to install the latest version if available.
No specific workarounds have been provided for these vulnerabilities. It is recommended to update Thunderbird to the latest version to mitigate the risks.
You can find more information about these vulnerabilities, including their impact and CVSS scores, on the CVE pages listed in the References section of the original vulnerability report.
Related vulnerabilities
Recent vulnerabilities recorded for thunderbird.
