ALSA-2022:0535

See a problem?
Source
https://errata.almalinux.org/8/ALSA-2022-0535.html
Import Source
https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux8/ALSA-2022:0535.json
JSON Data
https://api.osv.dev/v1/vulns/ALSA-2022:0535
Related
Published
2022-02-15T10:03:34Z
Modified
2022-02-15T23:59:21Z
Summary
Important: thunderbird security update
Details

Mozilla Thunderbird is a standalone mail and newsgroup client.

This update upgrades Thunderbird to version 91.6.0.

Security Fix(es):

  • Mozilla: Extensions could have bypassed permission confirmation during update (CVE-2022-22754)

  • Mozilla: Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6 (CVE-2022-22764)

  • Mozilla: Drag and dropping an image could have resulted in the dropped object being an executable (CVE-2022-22756)

  • Mozilla: Sandboxed iframes could have executed script if the parent appended elements (CVE-2022-22759)

  • Mozilla: Cross-Origin responses could be distinguished between script and non-script content-types (CVE-2022-22760)

  • Mozilla: frame-ancestors Content Security Policy directive was not enforced for framed extension pages (CVE-2022-22761)

  • Mozilla: Script Execution during invalid object state (CVE-2022-22763)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

References

Affected packages

AlmaLinux:8 / thunderbird

Package

Name
thunderbird

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
91.6.0-1.el8_5.alma

AlmaLinux:8 / thunderbird

Package

Name
thunderbird

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
91.6.0-1.el8_5.alma.plus