[MFSA-2022-22] Security Vulnerabilities fixed in Thunderbird 91.10

Severity High

Affected Packages 1

Fixed Packages 1

CVEs 9

In general, these flaws cannot be exploited through email in the Thunderbird product because scripting is disabled when reading mail, but are potentially risks in browser or browser-like contexts.

CVE-2022-1834: Braille space character caused incorrect sender email to be shown for a digitally signed email (high)
When displaying the sender of an email, and the sender name contained the Braille Pattern Blank space character multiple times, Thunderbird would have displayed all the spaces. This could have been used by an attacker to send an email message with the attacker's digital signature, that was shown with an arbitrary sender email address chosen by the attacker. If the sender name started with a false email address, followed by many Braille space characters, the attacker's email address was not visible. Because Thunderbird compared the invisible sender address with the signature's email address, if the signing key or certificate was accepted by Thunderbird, the email was shown as having a valid digital signature.
CVE-2022-31736: Cross-Origin resource's length leaked (high)
A malicious website could have learned the size of a cross-origin resource that supported Range requests.
CVE-2022-31737: Heap buffer overflow in WebGL (high)
A malicious webpage could have caused an out-of-bounds write in WebGL, leading to memory corruption and a potentially exploitable crash.
CVE-2022-31738: Browser window spoof using fullscreen mode (high)
When exiting fullscreen mode, an iframe could have confused the browser about the current state of fullscreen, resulting in potential user confusion or spoofing attacks.
CVE-2022-31739: Attacker-influenced path traversal when saving downloaded files (high)
When downloading files on Windows, the % character was not escaped, which could have lead to a download incorrectly being saved to attacker-influenced paths that used variables such as %HOMEPATH% or %APPDATA%.
This bug only affects Thunderbird for Windows. Other operating systems are unaffected.
CVE-2022-31740: Register allocation problem in WASM on arm64 (high)
On arm64, WASM code could have resulted in incorrect assembly generation leading to a register allocation problem, and a potentially exploitable crash.
CVE-2022-31741: Uninitialized variable leads to invalid memory read (high)
A crafted CMS message could have been processed incorrectly, leading to an invalid memory read, and potentially further memory corruption.
CVE-2022-31742: Querying a WebAuthn token with a large number of allowCredential entries may have leaked cross-origin information (moderate)
An attacker could have exploited a timing attack by sending a large number of allowCredential entries and detecting the difference between invalid key handles and cross-origin key handles. This could have led to cross-origin account linking in violation of WebAuthn goals.
CVE-2022-31747: Memory safety bugs fixed in Thunderbird 91.10 (high)
Mozilla developers Andrew McCreight, Nicolas B. Pierron, and the Mozilla Fuzzing Team reported memory safety bugs present in Thunderbird 91.9. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.

Package	Affected Version
pkg:mozilla/Thunderbird	< 91.10

Package	Fixed Version
pkg:mozilla/Thunderbird	= 91.10

ID

MFSA-2022-22

Severity

high

URL

https://www.mozilla.org/en-US/security/advisories/mfsa2022-22

Published

2022-05-31T00:00:00
(2 years ago)

Modified

2022-05-31T00:00:00
(2 years ago)

Other Advisories

Source	# ID	Name	URL
Bugzilla	1767816		https://bugzilla.mozilla.org/show_bug.cgi?id=1767816
Bugzilla	1735923		https://bugzilla.mozilla.org/show_bug.cgi?id=1735923
Bugzilla	1743767		https://bugzilla.mozilla.org/show_bug.cgi?id=1743767
Bugzilla	1756388		https://bugzilla.mozilla.org/show_bug.cgi?id=1756388
Bugzilla	1765049		https://bugzilla.mozilla.org/show_bug.cgi?id=1765049
Bugzilla	1766806		https://bugzilla.mozilla.org/show_bug.cgi?id=1766806
Bugzilla	1767590		https://bugzilla.mozilla.org/show_bug.cgi?id=1767590
Bugzilla	1730434		https://bugzilla.mozilla.org/show_bug.cgi?id=1730434
Bugzilla	1760765	Memory safety bugs fixed in Thunderbird 91.10	https://bugzilla.mozilla.org/show_bug.cgi?id=1760765
Bugzilla	1765610	Memory safety bugs fixed in Thunderbird 91.10	https://bugzilla.mozilla.org/show_bug.cgi?id=1765610
Bugzilla	1766283	Memory safety bugs fixed in Thunderbird 91.10	https://bugzilla.mozilla.org/show_bug.cgi?id=1766283
Bugzilla	1767365	Memory safety bugs fixed in Thunderbird 91.10	https://bugzilla.mozilla.org/show_bug.cgi?id=1767365
Bugzilla	1768559	Memory safety bugs fixed in Thunderbird 91.10	https://bugzilla.mozilla.org/show_bug.cgi?id=1768559
Bugzilla	1768734	Memory safety bugs fixed in Thunderbird 91.10	https://bugzilla.mozilla.org/show_bug.cgi?id=1768734

Type	Package URL	Namespace	Name / Product	Version	Distribution / Platform	Arch	Patch / Fix
Affected	pkg:mozilla/Thunderbird		Thunderbird	< 91.10
Fixed	pkg:mozilla/Thunderbird		Thunderbird	= 91.10

# CVE	Description	CVSS	EPSS	EPSS Trend (30 days)	Affected Products	Weaknesses	Security Advisories	Exploits	PoC	Pubblication Date	Modification Date
# CVE	Description	CVSS	EPSS	EPSS Trend (30 days)	Affected Products	Weaknesses	Security Advisories	PoC	Pubblication Date	Modification Date