RHSA-2022:7184

Vulnerability from csaf_opensuse - Published: 2022-10-25 00:00 - Updated: 2026-09-20 11:23
Summary
security update for thunderbird
Severity
Important
Notes
Title of the patch: security update for thunderbird
Description of the patch: This security update provides a functional equivalent of RHSA-2022:7184. The original Red Hat(R) advisory is available from the Red Hat web site at https://access.redhat.com/errata/RHSA-2022:7184.
Patchnames: RHSA-2022:7184
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
CVE-2022-39236
4.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Affected products
Product Identifier Version Remediation
Unresolved product id: SUSE Liberty Linux 7:thunderbird-0:102.4.0-1.el7_9.x86_64 —
Vendor Fix
Threats
Impact important
CVE-2022-39249
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Affected products
Recommended 1 product, the same list as for CVE-2022-39236
Threats
Impact important
CVE-2022-39250
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Affected products
Recommended 1 product, the same list as for CVE-2022-39236
Threats
Impact important
CVE-2022-39251
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Affected products
Recommended 1 product, the same list as for CVE-2022-39236
Threats
Impact important
CVE-2022-42927
7.5 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected products
Recommended 1 product, the same list as for CVE-2022-39236
Threats
Impact important
CVE-2022-42928
7.5 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected products
Recommended 1 product, the same list as for CVE-2022-39236
Threats
Impact important
CVE-2022-42929
6.1 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected products
Recommended 1 product, the same list as for CVE-2022-39236
Threats
Impact important
CVE-2022-42932
6.1 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected products
Recommended 1 product, the same list as for CVE-2022-39236
Threats
Impact important
References
To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "security update for thunderbird",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This security update provides a functional equivalent of RHSA-2022:7184.\nThe original Red Hat(R) advisory is available from the Red Hat web site at\nhttps://access.redhat.com/errata/RHSA-2022:7184.\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "RHSA-2022:7184",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/rhsa-2022_7184.json"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2022-39236 page",
        "url": "https://www.suse.com/security/cve/CVE-2022-39236/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2022-39249 page",
        "url": "https://www.suse.com/security/cve/CVE-2022-39249/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2022-39250 page",
        "url": "https://www.suse.com/security/cve/CVE-2022-39250/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2022-39251 page",
        "url": "https://www.suse.com/security/cve/CVE-2022-39251/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2022-42927 page",
        "url": "https://www.suse.com/security/cve/CVE-2022-42927/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2022-42928 page",
        "url": "https://www.suse.com/security/cve/CVE-2022-42928/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2022-42929 page",
        "url": "https://www.suse.com/security/cve/CVE-2022-42929/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2022-42932 page",
        "url": "https://www.suse.com/security/cve/CVE-2022-42932/"
      }
    ],
    "title": "security update for thunderbird",
    "tracking": {
      "current_release_date": "2026-09-20T11:23:34Z",
      "generator": {
        "date": "2022-10-25T00:00:00Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "RHSA-2022:7184",
      "initial_release_date": "2022-10-25T00:00:00Z",
      "revision_history": [
        {
          "date": "2022-10-25T00:00:00Z",
          "number": "1",
          "summary": "Current version"
        },
        {
          "date": "2026-09-20T11:23:34Z",
          "number": "2",
          "summary": "unknown changes"
        }
      ],
      "status": "final",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "thunderbird-0:102.4.0-1.el7_9.x86_64",
                "product": {
                  "name": "thunderbird-0:102.4.0-1.el7_9.x86_64",
                  "product_id": "thunderbird-0:102.4.0-1.el7_9.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/thunderbird@102.4.0-1.el7_9?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Liberty Linux 7",
                "product": {
                  "name": "SUSE Liberty Linux 7",
                  "product_id": "SUSE Liberty Linux 7",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sll:7"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "thunderbird-0:102.4.0-1.el7_9.x86_64 as component of SUSE Liberty Linux 7",
          "product_id": "SUSE Liberty Linux 7:thunderbird-0:102.4.0-1.el7_9.x86_64"
        },
        "product_reference": "thunderbird-0:102.4.0-1.el7_9.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 7"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2022-39236",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2022-39236"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Matrix Javascript SDK is the Matrix Client-Server SDK for JavaScript. Starting with version 17.1.0-rc.1, improperly formed beacon events can disrupt or impede the matrix-js-sdk from functioning properly, potentially impacting the consumer\u0027s ability to process data safely. Note that the matrix-js-sdk can appear to be operating normally but be excluding or corrupting runtime data presented to the consumer. This is patched in matrix-js-sdk v19.7.0. Redacting applicable events, waiting for the sync processor to store data, and restarting the client are possible workarounds. Alternatively, redacting the applicable events and clearing all storage will fix the further perceived issues. Downgrading to an unaffected version, noting that such a version may be subject to other vulnerabilities, will additionally resolve the issue.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 7:thunderbird-0:102.4.0-1.el7_9.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2022-39236",
          "url": "https://www.suse.com/security/cve/CVE-2022-39236"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1204411 for CVE-2022-39236",
          "url": "https://bugzilla.suse.com/1204411"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 7:thunderbird-0:102.4.0-1.el7_9.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 7:thunderbird-0:102.4.0-1.el7_9.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2022-10-25T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2022-39236"
    },
    {
      "cve": "CVE-2022-39249",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2022-39249"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Matrix Javascript SDK is the Matrix Client-Server SDK for JavaScript. Prior to version 19.7.0, an attacker cooperating with a malicious homeserver can construct messages appearing to have come from another person. Such messages will be marked with a grey shield on some platforms, but this may be missing in others. This attack is possible due to the matrix-js-sdk implementing a too permissive key forwarding strategy on the receiving end. Starting with version 19.7.0, the default policy for accepting key forwards has been made more strict in the matrix-js-sdk. matrix-js-sdk will now only accept forwarded keys in response to previously issued requests and only from own, verified devices. The SDK now sets a `trusted` flag on the decrypted message upon decryption, based on whether the key used to decrypt the message was received from a trusted source. Clients need to ensure that messages decrypted with a key with `trusted = false` are decorated appropriately, for example, by showing a warning for such messages. This attack requires coordination between a malicious homeserver and an attacker, and those who trust your homeservers do not need a workaround.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 7:thunderbird-0:102.4.0-1.el7_9.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2022-39249",
          "url": "https://www.suse.com/security/cve/CVE-2022-39249"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1204411 for CVE-2022-39249",
          "url": "https://bugzilla.suse.com/1204411"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 7:thunderbird-0:102.4.0-1.el7_9.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 7:thunderbird-0:102.4.0-1.el7_9.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2022-10-25T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2022-39249"
    },
    {
      "cve": "CVE-2022-39250",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2022-39250"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Matrix JavaScript SDK is the Matrix Client-Server software development kit (SDK) for JavaScript. Prior to version 19.7.0, an attacker cooperating with a malicious homeserver could interfere with the verification flow between two users, injecting its own cross-signing user identity in place of one of the users\u0027 identities. This would lead to the other device trusting/verifying the user identity under the control of the homeserver instead of the intended one. The vulnerability is a bug in the matrix-js-sdk, caused by checking and signing user identities and devices in two separate steps, and inadequately fixing the keys to be signed between those steps. Even though the attack is partly made possible due to the design decision of treating cross-signing user identities as Matrix devices on the server side (with their device ID set to the public part of the user identity key), no other examined implementations were vulnerable. Starting with version 19.7.0, the matrix-js-sdk has been modified to double check that the key signed is the one that was verified instead of just referencing the key by ID. An additional check has been made to report an error when one of the device ID matches a cross-signing key. As this attack requires coordination between a malicious homeserver and an attacker, those who trust their homeservers do not need a particular workaround.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 7:thunderbird-0:102.4.0-1.el7_9.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2022-39250",
          "url": "https://www.suse.com/security/cve/CVE-2022-39250"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1204411 for CVE-2022-39250",
          "url": "https://bugzilla.suse.com/1204411"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 7:thunderbird-0:102.4.0-1.el7_9.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 7:thunderbird-0:102.4.0-1.el7_9.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2022-10-25T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2022-39250"
    },
    {
      "cve": "CVE-2022-39251",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2022-39251"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Matrix Javascript SDK is the Matrix Client-Server SDK for JavaScript. Prior to version 19.7.0, an attacker cooperating with a malicious homeserver can construct messages that legitimately appear to have come from another person, without any indication such as a grey shield. Additionally, a sophisticated attacker cooperating with a malicious homeserver could employ this vulnerability to perform a targeted attack in order to send fake to-device messages appearing to originate from another user. This can allow, for example, to inject the key backup secret during a self-verification, to make a targeted device start using a malicious key backup spoofed by the homeserver. These attacks are possible due to a protocol confusion vulnerability that accepts to-device messages encrypted with Megolm instead of Olm. Starting with version 19.7.0, matrix-js-sdk has been modified to only accept Olm-encrypted to-device messages. Out of caution, several other checks have been audited or added. This attack requires coordination between a malicious home server and an attacker, so those who trust their home servers do not need a workaround.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 7:thunderbird-0:102.4.0-1.el7_9.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2022-39251",
          "url": "https://www.suse.com/security/cve/CVE-2022-39251"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1204411 for CVE-2022-39251",
          "url": "https://bugzilla.suse.com/1204411"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 7:thunderbird-0:102.4.0-1.el7_9.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 7:thunderbird-0:102.4.0-1.el7_9.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2022-10-25T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2022-39251"
    },
    {
      "cve": "CVE-2022-42927",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2022-42927"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A same-origin policy violation could have allowed the theft of cross-origin URL entries, leaking the result of a redirect, via `performance.getEntries()`. This vulnerability affects Firefox \u003c 106, Firefox ESR \u003c 102.4, and Thunderbird \u003c 102.4.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 7:thunderbird-0:102.4.0-1.el7_9.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2022-42927",
          "url": "https://www.suse.com/security/cve/CVE-2022-42927"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1204421 for CVE-2022-42927",
          "url": "https://bugzilla.suse.com/1204421"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 7:thunderbird-0:102.4.0-1.el7_9.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 7:thunderbird-0:102.4.0-1.el7_9.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2022-10-25T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2022-42927"
    },
    {
      "cve": "CVE-2022-42928",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2022-42928"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Certain types of allocations were missing annotations that, if the Garbage Collector was in a specific state, could have lead to memory corruption and a potentially exploitable crash. This vulnerability affects Firefox \u003c 106, Firefox ESR \u003c 102.4, and Thunderbird \u003c 102.4.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 7:thunderbird-0:102.4.0-1.el7_9.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2022-42928",
          "url": "https://www.suse.com/security/cve/CVE-2022-42928"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1204421 for CVE-2022-42928",
          "url": "https://bugzilla.suse.com/1204421"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 7:thunderbird-0:102.4.0-1.el7_9.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 7:thunderbird-0:102.4.0-1.el7_9.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2022-10-25T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2022-42928"
    },
    {
      "cve": "CVE-2022-42929",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2022-42929"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "If a website called `window.print()` in a particular way, it could cause a denial of service of the browser, which may persist beyond browser restart depending on the user\u0027s session restore settings. This vulnerability affects Firefox \u003c 106, Firefox ESR \u003c 102.4, and Thunderbird \u003c 102.4.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 7:thunderbird-0:102.4.0-1.el7_9.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2022-42929",
          "url": "https://www.suse.com/security/cve/CVE-2022-42929"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1204421 for CVE-2022-42929",
          "url": "https://bugzilla.suse.com/1204421"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 7:thunderbird-0:102.4.0-1.el7_9.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 7:thunderbird-0:102.4.0-1.el7_9.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2022-10-25T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2022-42929"
    },
    {
      "cve": "CVE-2022-42932",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2022-42932"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Mozilla developers Ashley Hale and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 105 and Firefox ESR 102.3. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox \u003c 106, Firefox ESR \u003c 102.4, and Thunderbird \u003c 102.4.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 7:thunderbird-0:102.4.0-1.el7_9.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2022-42932",
          "url": "https://www.suse.com/security/cve/CVE-2022-42932"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1204421 for CVE-2022-42932",
          "url": "https://bugzilla.suse.com/1204421"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 7:thunderbird-0:102.4.0-1.el7_9.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 7:thunderbird-0:102.4.0-1.el7_9.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2022-10-25T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2022-42932"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.