ALSA-2022:7178 - Thunderbird Security Update
Summary
ALSA-2022:7178: Important: thunderbird security update. Affects thunderbird versions < 102.4.0-1.el9_0.alma. Fixed in 102.4.0-1.el9_0.alma. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Mozilla Thunderbird is a standalone mail and newsgroup client. It provides users with a convenient way to manage their emails and participate in newsgroup discussions. Thunderbird is vulnerable to multiple security issues that could potentially be exploited by attackers.
Vulnerability Detail
The vulnerabilities in Thunderbird include:
- CVE-2022-39249: Matrix SDK bundled with Thunderbird is vulnerable to an impersonation attack by malicious server administrators.
- CVE-2022-39250: Matrix SDK bundled with Thunderbird is vulnerable to a device verification attack.
- CVE-2022-39251: Matrix SDK bundled with Thunderbird is vulnerable to an impersonation attack.
- CVE-2022-42927: Same-origin policy violation could have leaked cross-origin URLs.
- CVE-2022-42928: Memory Corruption in JS Engine.
- CVE-2022-39236: Matrix SDK bundled with Thunderbird is vulnerable to a data corruption issue.
- CVE-2022-42929: Denial of Service via window.print.
- CVE-2022-42932: Memory safety bugs fixed in Firefox ESR 102.4 and Thunderbird 102.4.
These vulnerabilities could lead to various consequences, including unauthorized access, data corruption, information leakage, and denial of service.
How To Fix
Minimum fixed version
102.4.0-1.el9_0.alma
This is the first release that contains the fix.
sudo dnf update thunderbirdTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
Mozilla Thunderbird is vulnerable to multiple security issues that could have serious consequences. It is crucial to update Thunderbird to the latest version to mitigate these vulnerabilities. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for thunderbird →
FAQ
Thunderbird is a standalone mail and newsgroup client developed by Mozilla.
The vulnerabilities in Thunderbird include impersonation attacks, device verification attacks, same-origin policy violation, memory corruption, data corruption, and denial of service.
These vulnerabilities could lead to unauthorized access, data corruption, information leakage, and denial of service.
To fix these vulnerabilities, update Thunderbird to version 102.4.0 or later.
You can download the latest version of Thunderbird from the official Mozilla website.
Related vulnerabilities
Recent vulnerabilities recorded for thunderbird.
