Opened 5 years ago
Closed 5 years ago
#15964 closed enhancement (fixed)
thunderbird-91.5.0
| Reported by: | Bruce Dubbs | Owned by: | Douglas R. Reno |
|---|---|---|---|
| Priority: | elevated | Milestone: | 11.1 |
| Component: | BOOK | Version: | git |
| Severity: | medium | Keywords: | |
| Cc: |
Description
New minor version.
Change History (4)
comment:1 by , 5 years ago
| Owner: | changed from to |
|---|---|
| Status: | new → assigned |
comment:3 by , 5 years ago
| Priority: | normal → elevated |
|---|
Mozilla Foundation Security Advisory 2022-03
Security Vulnerabilities fixed in Thunderbird 91.5
Announced
January 11, 2022
Impact
high
Products
Thunderbird
Fixed in
Thunderbird 91.5
In general, these flaws cannot be exploited through email in the Thunderbird product because scripting is disabled when reading mail, but are potentially risks in browser or browser-like contexts.
#CVE-2022-22746: Calling into reportValidity could have lead to fullscreen window spoof
Reporter
Irvan Kurniawan
Impact
high
Description
A race condition could have allowed bypassing the fullscreen notification which could have lead to a fullscreen window spoof being unnoticed.
This bug only affects Firefox for Windows. Other operating systems are unaffected.
References
Bug 1735071
#CVE-2022-22743: Browser window spoof using fullscreen mode
Reporter
Irvan Kurniawan
Impact
high
Description
When navigating from inside an iframe while requesting fullscreen access, an attacker-controlled tab could have made the browser unable to leave fullscreen mode.
References
Bug 1739220
#CVE-2022-22742: Out-of-bounds memory access when inserting text in edit mode
Reporter
Irvan Kurniawan
Impact
high
Description
When inserting text while in edit mode, some characters might have lead to out-of-bounds memory access causing a potentially exploitable crash.
References
Bug 1739923
#CVE-2022-22741: Browser window spoof using fullscreen mode
Reporter
Irvan Kurniawan
Impact
high
Description
When resizing a popup while requesting fullscreen access, the popup would have become unable to leave fullscreen mode.
References
Bug 1740389
#CVE-2022-22740: Use-after-free of ChannelEventQueue::mOwner
Reporter
bo13oy of Cyber Kunlun Lab
Impact
high
Description
Certain network request objects were freed too early when releasing a network request handle. This could have lead to a use-after-free causing a potentially exploitable crash.
References
Bug 1742334
#CVE-2022-22738: Heap-buffer-overflow in blendGaussianBlur
Reporter
Atte Kettunen
Impact
high
Description
Applying a CSS filter effect could have accessed out of bounds memory. This could have lead to a heap-buffer-overflow causing a potentially exploitable crash.
References
Bug 1742382
#CVE-2022-22737: Race condition when playing audio files
Reporter
bo13oy of Cyber Kunlun Lab
Impact
high
Description
Constructing audio sinks could have lead to a race condition when playing audio files and closing windows. This could have lead to a use-after-free causing a potentially exploitable crash.
References
Bug 1745874
#CVE-2021-4140: Iframe sandbox bypass with XSLT
Reporter
Peter Van der Beken
Impact
high
Description
It was possible to construct specific XSLT markup that would be able to bypass an iframe sandbox.
References
Bug 1746720
#CVE-2022-22748: Spoofed origin on external protocol launch dialog
Reporter
Alesandro Ortiz
Impact
moderate
Description
Malicious websites could have confused Firefox into showing the wrong origin when asking to launch a program and handling an external URL protocol.
References
Bug 1705211
#CVE-2022-22745: Leaking cross-origin URLs through securitypolicyviolation event
Reporter
Jannis Rautenstrauch
Impact
moderate
Description
Securitypolicyviolation events could have leaked cross-origin information for frame-ancestors violations
References
Bug 1735856
#CVE-2022-22744: The 'Copy as curl' feature in DevTools did not fully escape website-controlled data, potentially leading to command injection
Reporter
Mattias Jacobsson
Impact
moderate
Description
The constructed curl command from the "Copy as curl" feature in DevTools was not properly escaped for PowerShell. This could have lead to command injection if pasted into a Powershell prompt.
This bug only affects Thunderbird for Windows. Other operating systems are unaffected.
References
Bug 1737252
#CVE-2022-22747: Crash when handling empty pkcs7 sequence
Reporter
Tavis Ormandy
Impact
low
Description
After accepting an untrusted certificate, handling an empty pkcs7 sequence as part of the certificate data could have lead to a crash. This crash is believed to be unexploitable.
References
Bug 1735028
#CVE-2022-22739: Missing throttling on external protocol launch dialog
Reporter
Alesandro Ortiz
Impact
low
Description
Malicious websites could have tricked users into accepting launching a program to handle an external URL protocol.
References
Bug 1744158
#CVE-2022-22751: Memory safety bugs fixed in Thunderbird 91.5
Reporter
Mozilla developers and community
Impact
high
Description
Mozilla developers Calixte Denizet, Kershaw Chang, Christian Holler, Jason Kratzer, Gabriele Svelto, Tyson Smith, Simon Giesecke, and Steve Fink reported memory safety bugs present in Firefox 95 and Firefox ESR 91.4. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.
References
Memory safety bugs fixed in Thunderbird 91.5
Note that the patch is still required as well.
comment:4 by , 5 years ago
| Resolution: | → fixed |
|---|---|
| Status: | assigned → closed |
Note:
See TracTickets
for help on using tickets.
