1. Home
  2. Security Advisories
  3. Mozilla
  4. MFSA-2022-18

[MFSA-2022-18] Security Vulnerabilities fixed in Thunderbird 91.9

Severity High
Affected Packages 1
Fixed Packages 1
CVEs 8
Info Packages References Vulnerabilities

In general, these flaws cannot be exploited through email in the Thunderbird product because scripting is disabled when reading mail, but are potentially risks in browser or browser-like contexts.

  • CVE-2022-1520: Incorrect security status shown after viewing an attached email (low)
    When viewing an email message A, which contains an attached message B, where B is encrypted or digitally signed or both, Thunderbird may show an incorrect encryption or signature status. After opening and viewing the attached message B, when returning to the display of message A, the message A might be shown with the security status of message B.

  • CVE-2022-29909: Bypassing permission prompt in nested browsing contexts (high)
    Documents in deeply-nested cross-origin browsing contexts could obtain permissions granted to the top-level origin, bypassing the existing prompt and wrongfully inheriting the top-level permissions.

  • CVE-2022-29911: iframe sandbox bypass (high)
    An improper implementation of the new iframe sandbox keyword <code>allow-top-navigation-by-user-activation</code> could lead to script execution without <code>allow-scripts</code> being present.

  • CVE-2022-29912: Reader mode bypassed SameSite cookies (moderate)
    Requests initiated through reader mode did not properly omit cookies with a SameSite attribute.

  • CVE-2022-29913: Speech Synthesis feature not properly disabled (moderate)
    The parent process would not properly check whether the Speech Synthesis feature is enabled, when receiving instructions from a child process.

  • CVE-2022-29914: Fullscreen notification bypass using popups (high)
    When reusing existing popups Thunderbird would allow them to cover the fullscreen notification UI, which could enable browser spoofing attacks.

  • CVE-2022-29916: Leaking browser history with CSS variables (high)
    Thunderbird would behave slightly differently for already known resources, when loading CSS resources through resolving CSS variables. This could be used to probe the browser history.

  • CVE-2022-29917: Memory safety bugs fixed in Thunderbird 91.9 (high)
    Mozilla developers Gabriele Svelto, Tom Ritter and the Mozilla Fuzzing Team reported memory safety bugs present in Thunderbird 91.8. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.

Package Affected Version
pkg:mozilla/Thunderbird < 91.9
Package Fixed Version
pkg:mozilla/Thunderbird = 91.9
ID
MFSA-2022-18
Severity
high
URL
https://www.mozilla.org/en-US/security/advisories/mfsa2022-18
Published
2022-05-03T00:00:00
(2 years ago)
Modified
2022-05-03T00:00:00
(2 years ago)
Other Advisories
Source # ID Name URL
Bugzilla 1745019 https://bugzilla.mozilla.org/show_bug.cgi?id=1745019
Bugzilla 1755081 https://bugzilla.mozilla.org/show_bug.cgi?id=1755081
Bugzilla 1761981 https://bugzilla.mozilla.org/show_bug.cgi?id=1761981
Bugzilla 1692655 https://bugzilla.mozilla.org/show_bug.cgi?id=1692655
Bugzilla 1764778 https://bugzilla.mozilla.org/show_bug.cgi?id=1764778
Bugzilla 1746448 https://bugzilla.mozilla.org/show_bug.cgi?id=1746448
Bugzilla 1760674 https://bugzilla.mozilla.org/show_bug.cgi?id=1760674
Bugzilla 1684739 Memory safety bugs fixed in Thunderbird 91.9 https://bugzilla.mozilla.org/show_bug.cgi?id=1684739
Bugzilla 1706441 Memory safety bugs fixed in Thunderbird 91.9 https://bugzilla.mozilla.org/show_bug.cgi?id=1706441
Bugzilla 1753298 Memory safety bugs fixed in Thunderbird 91.9 https://bugzilla.mozilla.org/show_bug.cgi?id=1753298
Bugzilla 1762614 Memory safety bugs fixed in Thunderbird 91.9 https://bugzilla.mozilla.org/show_bug.cgi?id=1762614
Bugzilla 1762620 Memory safety bugs fixed in Thunderbird 91.9 https://bugzilla.mozilla.org/show_bug.cgi?id=1762620
Type Package URL Namespace Name / Product Version Distribution / Platform Arch Patch / Fix
Affected pkg:mozilla/Thunderbird Thunderbird < 91.9
Fixed pkg:mozilla/Thunderbird Thunderbird = 91.9
# CVE Description CVSS EPSS EPSS Trend (30 days) Affected Products Weaknesses Security Advisories Exploits PoC Pubblication Date Modification Date
# CVE Description CVSS EPSS EPSS Trend (30 days) Affected Products Weaknesses Security Advisories PoC Pubblication Date Modification Date