Important: Thunderbird Security Update - Arbitrary File Read and Memory Safety Bugs
Summary
ALSA-2022:9080: Important: thunderbird security update. Affects thunderbird versions < 102.6.0-2.el9_1.alma. Fixed in 102.6.0-2.el9_1.alma. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Mozilla Thunderbird is a standalone mail and newsgroup client. It provides users with a convenient way to manage their emails and participate in newsgroup discussions. Thunderbird is vulnerable to multiple security issues that could potentially compromise the confidentiality, integrity, and availability of user data.
Vulnerability Detail
The identified vulnerabilities in Thunderbird include:
-
Arbitrary file read from a compromised content process (CVE-2022-46872): This vulnerability allows an attacker to read arbitrary files from a compromised content process, potentially exposing sensitive information.
-
Memory safety bugs fixed in Firefox ESR 102.6 and Thunderbird 102.6 (CVE-2022-46878): These memory safety bugs could lead to memory corruption and potentially allow an attacker to execute arbitrary code.
-
Use-after-free in WebGL (CVE-2022-46880 and CVE-2022-46882): These vulnerabilities could be exploited to execute arbitrary code or cause a denial of service by leveraging a use-after-free condition in WebGL.
-
Memory corruption in WebGL (CVE-2022-46881): This vulnerability could lead to memory corruption and potentially allow an attacker to execute arbitrary code.
-
Quoting from an HTML email with certain tags will trigger network requests and load remote content, regardless of a configuration to block remote content (CVE-2022-45414): This vulnerability allows remote content to be loaded even if the user has configured Thunderbird to block such content.
-
Drag and Dropped Filenames could have been truncated to malicious extensions (CVE-2022-46874): This vulnerability could allow an attacker to trick users into opening malicious files by truncating filenames during drag and drop operations.
These vulnerabilities pose a significant risk to Thunderbird users and should be addressed promptly.
How To Fix
Minimum fixed version
102.6.0-2.el9_1.alma
This is the first release that contains the fix.
sudo dnf update thunderbirdTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no known workarounds for these vulnerabilities. It is crucial to update Thunderbird to the latest version to mitigate the risk.
Conclusion
It is crucial for Thunderbird users to update their software to the latest version to address the identified vulnerabilities. Failure to do so could expose users to various security risks, including unauthorized access to sensitive information and the execution of malicious code. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for thunderbird →
FAQ
Thunderbird is a standalone mail and newsgroup client developed by Mozilla. It allows users to manage their emails and participate in newsgroup discussions.
These vulnerabilities could potentially lead to arbitrary file read, memory corruption, execution of arbitrary code, and loading of remote content. This could result in unauthorized access to sensitive information, denial of service, or the execution of malicious code on the user's system.
To protect yourself, it is recommended to update Thunderbird to the latest version as soon as possible. Additionally, exercise caution when opening email attachments or clicking on links from unknown or suspicious sources.
No, there are no known workarounds for these vulnerabilities. Updating Thunderbird to the latest version is the best course of action.
You can find more information about these vulnerabilities, including their impact, CVSS scores, and related details, on the CVE pages listed in the References section of the original vulnerability report.
Related vulnerabilities
Recent vulnerabilities recorded for thunderbird.
