csaf_redhat - rhsa-2022

rhsa-2022_9075

Vulnerability from csaf_redhat

Published

2022-12-15 16:21

Modified

2024-09-16 09:57

Summary

Red Hat Security Advisory: thunderbird security update

Notes

Topic

An update for thunderbird is now available for Red Hat Enterprise Linux 8.4 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Details

Mozilla Thunderbird is a standalone mail and newsgroup client. This update upgrades Thunderbird to version 102.6.0. Security Fix(es): * Mozilla: Arbitrary file read from a compromised content process (CVE-2022-46872) * Mozilla: Memory safety bugs fixed in Firefox ESR 102.6 and Thunderbird 102.6 (CVE-2022-46878) * Mozilla: Use-after-free in WebGL (CVE-2022-46880) * Mozilla: Memory corruption in WebGL (CVE-2022-46881) * Mozilla: Quoting from an HTML email with certain tags will trigger network requests and load remote content, regardless of a configuration to block remote content (CVE-2022-45414) * Mozilla: Drag and Dropped Filenames could have been truncated to malicious extensions (CVE-2022-46874) * Mozilla: Use-after-free in WebGL (CVE-2022-46882) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_vex",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for thunderbird is now available for Red Hat Enterprise Linux 8.4 Extended Update Support.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Mozilla Thunderbird is a standalone mail and newsgroup client.\n\nThis update upgrades Thunderbird to version 102.6.0.\n\nSecurity Fix(es):\n\n* Mozilla: Arbitrary file read from a compromised content process (CVE-2022-46872)\n\n* Mozilla: Memory safety bugs fixed in Firefox ESR 102.6 and Thunderbird 102.6 (CVE-2022-46878)\n\n* Mozilla: Use-after-free in WebGL (CVE-2022-46880)\n\n* Mozilla: Memory corruption in WebGL (CVE-2022-46881)\n\n* Mozilla: Quoting from an HTML email with certain tags will trigger network requests and load remote content, regardless of a configuration to block remote content (CVE-2022-45414)\n\n* Mozilla: Drag and Dropped Filenames could have been truncated to malicious extensions (CVE-2022-46874)\n\n* Mozilla: Use-after-free in WebGL (CVE-2022-46882)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat offerings.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2022:9075",
        "url": "https://access.redhat.com/errata/RHSA-2022:9075"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "2149868",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2149868"
      },
      {
        "category": "external",
        "summary": "2153441",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2153441"
      },
      {
        "category": "external",
        "summary": "2153449",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2153449"
      },
      {
        "category": "external",
        "summary": "2153454",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2153454"
      },
      {
        "category": "external",
        "summary": "2153463",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2153463"
      },
      {
        "category": "external",
        "summary": "2153466",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2153466"
      },
      {
        "category": "external",
        "summary": "2153467",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2153467"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://access.redhat.com/security/data/csaf/v2/advisories/2022/rhsa-2022_9075.json"
      }
    ],
    "title": "Red Hat Security Advisory: thunderbird security update",
    "tracking": {
      "current_release_date": "2024-09-16T09:57:56+00:00",
      "generator": {
        "date": "2024-09-16T09:57:56+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "3.33.3"
        }
      },
      "id": "RHSA-2022:9075",
      "initial_release_date": "2022-12-15T16:21:43+00:00",
      "revision_history": [
        {
          "date": "2022-12-15T16:21:43+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2022-12-15T16:21:43+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-09-16T09:57:56+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux AppStream EUS (v.8.4)",
                "product": {
                  "name": "Red Hat Enterprise Linux AppStream EUS (v.8.4)",
                  "product_id": "AppStream-8.4.0.Z.EUS",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:rhel_eus:8.4::appstream"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "thunderbird-0:102.6.0-2.el8_4.src",
                "product": {
                  "name": "thunderbird-0:102.6.0-2.el8_4.src",
                  "product_id": "thunderbird-0:102.6.0-2.el8_4.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/thunderbird@102.6.0-2.el8_4?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "thunderbird-0:102.6.0-2.el8_4.aarch64",
                "product": {
                  "name": "thunderbird-0:102.6.0-2.el8_4.aarch64",
                  "product_id": "thunderbird-0:102.6.0-2.el8_4.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/thunderbird@102.6.0-2.el8_4?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "thunderbird-debugsource-0:102.6.0-2.el8_4.aarch64",
                "product": {
                  "name": "thunderbird-debugsource-0:102.6.0-2.el8_4.aarch64",
                  "product_id": "thunderbird-debugsource-0:102.6.0-2.el8_4.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/thunderbird-debugsource@102.6.0-2.el8_4?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "thunderbird-debuginfo-0:102.6.0-2.el8_4.aarch64",
                "product": {
                  "name": "thunderbird-debuginfo-0:102.6.0-2.el8_4.aarch64",
                  "product_id": "thunderbird-debuginfo-0:102.6.0-2.el8_4.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/thunderbird-debuginfo@102.6.0-2.el8_4?arch=aarch64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "thunderbird-0:102.6.0-2.el8_4.ppc64le",
                "product": {
                  "name": "thunderbird-0:102.6.0-2.el8_4.ppc64le",
                  "product_id": "thunderbird-0:102.6.0-2.el8_4.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/thunderbird@102.6.0-2.el8_4?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "thunderbird-debugsource-0:102.6.0-2.el8_4.ppc64le",
                "product": {
                  "name": "thunderbird-debugsource-0:102.6.0-2.el8_4.ppc64le",
                  "product_id": "thunderbird-debugsource-0:102.6.0-2.el8_4.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/thunderbird-debugsource@102.6.0-2.el8_4?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "thunderbird-debuginfo-0:102.6.0-2.el8_4.ppc64le",
                "product": {
                  "name": "thunderbird-debuginfo-0:102.6.0-2.el8_4.ppc64le",
                  "product_id": "thunderbird-debuginfo-0:102.6.0-2.el8_4.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/thunderbird-debuginfo@102.6.0-2.el8_4?arch=ppc64le"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "thunderbird-0:102.6.0-2.el8_4.x86_64",
                "product": {
                  "name": "thunderbird-0:102.6.0-2.el8_4.x86_64",
                  "product_id": "thunderbird-0:102.6.0-2.el8_4.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/thunderbird@102.6.0-2.el8_4?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "thunderbird-debugsource-0:102.6.0-2.el8_4.x86_64",
                "product": {
                  "name": "thunderbird-debugsource-0:102.6.0-2.el8_4.x86_64",
                  "product_id": "thunderbird-debugsource-0:102.6.0-2.el8_4.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/thunderbird-debugsource@102.6.0-2.el8_4?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "thunderbird-debuginfo-0:102.6.0-2.el8_4.x86_64",
                "product": {
                  "name": "thunderbird-debuginfo-0:102.6.0-2.el8_4.x86_64",
                  "product_id": "thunderbird-debuginfo-0:102.6.0-2.el8_4.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/thunderbird-debuginfo@102.6.0-2.el8_4?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "thunderbird-0:102.6.0-2.el8_4.s390x",
                "product": {
                  "name": "thunderbird-0:102.6.0-2.el8_4.s390x",
                  "product_id": "thunderbird-0:102.6.0-2.el8_4.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/thunderbird@102.6.0-2.el8_4?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "thunderbird-debugsource-0:102.6.0-2.el8_4.s390x",
                "product": {
                  "name": "thunderbird-debugsource-0:102.6.0-2.el8_4.s390x",
                  "product_id": "thunderbird-debugsource-0:102.6.0-2.el8_4.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/thunderbird-debugsource@102.6.0-2.el8_4?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "thunderbird-debuginfo-0:102.6.0-2.el8_4.s390x",
                "product": {
                  "name": "thunderbird-debuginfo-0:102.6.0-2.el8_4.s390x",
                  "product_id": "thunderbird-debuginfo-0:102.6.0-2.el8_4.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/thunderbird-debuginfo@102.6.0-2.el8_4?arch=s390x"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "thunderbird-0:102.6.0-2.el8_4.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)",
          "product_id": "AppStream-8.4.0.Z.EUS:thunderbird-0:102.6.0-2.el8_4.aarch64"
        },
        "product_reference": "thunderbird-0:102.6.0-2.el8_4.aarch64",
        "relates_to_product_reference": "AppStream-8.4.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "thunderbird-0:102.6.0-2.el8_4.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)",
          "product_id": "AppStream-8.4.0.Z.EUS:thunderbird-0:102.6.0-2.el8_4.ppc64le"
        },
        "product_reference": "thunderbird-0:102.6.0-2.el8_4.ppc64le",
        "relates_to_product_reference": "AppStream-8.4.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "thunderbird-0:102.6.0-2.el8_4.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)",
          "product_id": "AppStream-8.4.0.Z.EUS:thunderbird-0:102.6.0-2.el8_4.s390x"
        },
        "product_reference": "thunderbird-0:102.6.0-2.el8_4.s390x",
        "relates_to_product_reference": "AppStream-8.4.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "thunderbird-0:102.6.0-2.el8_4.src as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)",
          "product_id": "AppStream-8.4.0.Z.EUS:thunderbird-0:102.6.0-2.el8_4.src"
        },
        "product_reference": "thunderbird-0:102.6.0-2.el8_4.src",
        "relates_to_product_reference": "AppStream-8.4.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "thunderbird-0:102.6.0-2.el8_4.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)",
          "product_id": "AppStream-8.4.0.Z.EUS:thunderbird-0:102.6.0-2.el8_4.x86_64"
        },
        "product_reference": "thunderbird-0:102.6.0-2.el8_4.x86_64",
        "relates_to_product_reference": "AppStream-8.4.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "thunderbird-debuginfo-0:102.6.0-2.el8_4.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)",
          "product_id": "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.6.0-2.el8_4.aarch64"
        },
        "product_reference": "thunderbird-debuginfo-0:102.6.0-2.el8_4.aarch64",
        "relates_to_product_reference": "AppStream-8.4.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "thunderbird-debuginfo-0:102.6.0-2.el8_4.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)",
          "product_id": "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.6.0-2.el8_4.ppc64le"
        },
        "product_reference": "thunderbird-debuginfo-0:102.6.0-2.el8_4.ppc64le",
        "relates_to_product_reference": "AppStream-8.4.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "thunderbird-debuginfo-0:102.6.0-2.el8_4.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)",
          "product_id": "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.6.0-2.el8_4.s390x"
        },
        "product_reference": "thunderbird-debuginfo-0:102.6.0-2.el8_4.s390x",
        "relates_to_product_reference": "AppStream-8.4.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "thunderbird-debuginfo-0:102.6.0-2.el8_4.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)",
          "product_id": "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.6.0-2.el8_4.x86_64"
        },
        "product_reference": "thunderbird-debuginfo-0:102.6.0-2.el8_4.x86_64",
        "relates_to_product_reference": "AppStream-8.4.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "thunderbird-debugsource-0:102.6.0-2.el8_4.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)",
          "product_id": "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.6.0-2.el8_4.aarch64"
        },
        "product_reference": "thunderbird-debugsource-0:102.6.0-2.el8_4.aarch64",
        "relates_to_product_reference": "AppStream-8.4.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "thunderbird-debugsource-0:102.6.0-2.el8_4.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)",
          "product_id": "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.6.0-2.el8_4.ppc64le"
        },
        "product_reference": "thunderbird-debugsource-0:102.6.0-2.el8_4.ppc64le",
        "relates_to_product_reference": "AppStream-8.4.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "thunderbird-debugsource-0:102.6.0-2.el8_4.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)",
          "product_id": "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.6.0-2.el8_4.s390x"
        },
        "product_reference": "thunderbird-debugsource-0:102.6.0-2.el8_4.s390x",
        "relates_to_product_reference": "AppStream-8.4.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "thunderbird-debugsource-0:102.6.0-2.el8_4.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)",
          "product_id": "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.6.0-2.el8_4.x86_64"
        },
        "product_reference": "thunderbird-debugsource-0:102.6.0-2.el8_4.x86_64",
        "relates_to_product_reference": "AppStream-8.4.0.Z.EUS"
      }
    ]
  },
  "vulnerabilities": [
    {
      "acknowledgments": [
        {
          "names": [
            "the Mozilla project"
          ]
        },
        {
          "names": [
            "Sarah Jamie Lewis"
          ],
          "summary": "Acknowledged by upstream."
        }
      ],
      "cve": "CVE-2022-45414",
      "cwe": {
        "id": "CWE-200",
        "name": "Exposure of Sensitive Information to an Unauthorized Actor"
      },
      "discovery_date": "2022-11-30T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2149868"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nIf a Thunderbird user quoted from an HTML email and the email contained either a video tag with the poster attribute or an object tag with a data attribute, a network request to the referenced remote URL was performed regardless of a configuration to block remote content, and an image loaded from the poster attribute was shown in the composer window. These issues could have given an attacker additional capabilities when targeting releases that did not yet have a fix for CVE-2022-3033.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "Mozilla: Quoting from an HTML email with certain tags will trigger network requests and load remote content, regardless of a configuration to block remote content",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.4.0.Z.EUS:thunderbird-0:102.6.0-2.el8_4.aarch64",
          "AppStream-8.4.0.Z.EUS:thunderbird-0:102.6.0-2.el8_4.ppc64le",
          "AppStream-8.4.0.Z.EUS:thunderbird-0:102.6.0-2.el8_4.s390x",
          "AppStream-8.4.0.Z.EUS:thunderbird-0:102.6.0-2.el8_4.src",
          "AppStream-8.4.0.Z.EUS:thunderbird-0:102.6.0-2.el8_4.x86_64",
          "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.6.0-2.el8_4.aarch64",
          "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.6.0-2.el8_4.ppc64le",
          "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.6.0-2.el8_4.s390x",
          "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.6.0-2.el8_4.x86_64",
          "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.6.0-2.el8_4.aarch64",
          "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.6.0-2.el8_4.ppc64le",
          "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.6.0-2.el8_4.s390x",
          "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.6.0-2.el8_4.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2022-45414"
        },
        {
          "category": "external",
          "summary": "RHBZ#2149868",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2149868"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2022-45414",
          "url": "https://www.cve.org/CVERecord?id=CVE-2022-45414"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-45414",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-45414"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2022-50/#CVE-2022-45414",
          "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2022-50/#CVE-2022-45414"
        }
      ],
      "release_date": "2022-11-30T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.",
          "product_ids": [
            "AppStream-8.4.0.Z.EUS:thunderbird-0:102.6.0-2.el8_4.aarch64",
            "AppStream-8.4.0.Z.EUS:thunderbird-0:102.6.0-2.el8_4.ppc64le",
            "AppStream-8.4.0.Z.EUS:thunderbird-0:102.6.0-2.el8_4.s390x",
            "AppStream-8.4.0.Z.EUS:thunderbird-0:102.6.0-2.el8_4.src",
            "AppStream-8.4.0.Z.EUS:thunderbird-0:102.6.0-2.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.6.0-2.el8_4.aarch64",
            "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.6.0-2.el8_4.ppc64le",
            "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.6.0-2.el8_4.s390x",
            "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.6.0-2.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.6.0-2.el8_4.aarch64",
            "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.6.0-2.el8_4.ppc64le",
            "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.6.0-2.el8_4.s390x",
            "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.6.0-2.el8_4.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2022:9075"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.4.0.Z.EUS:thunderbird-0:102.6.0-2.el8_4.aarch64",
            "AppStream-8.4.0.Z.EUS:thunderbird-0:102.6.0-2.el8_4.ppc64le",
            "AppStream-8.4.0.Z.EUS:thunderbird-0:102.6.0-2.el8_4.s390x",
            "AppStream-8.4.0.Z.EUS:thunderbird-0:102.6.0-2.el8_4.src",
            "AppStream-8.4.0.Z.EUS:thunderbird-0:102.6.0-2.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.6.0-2.el8_4.aarch64",
            "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.6.0-2.el8_4.ppc64le",
            "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.6.0-2.el8_4.s390x",
            "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.6.0-2.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.6.0-2.el8_4.aarch64",
            "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.6.0-2.el8_4.ppc64le",
            "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.6.0-2.el8_4.s390x",
            "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.6.0-2.el8_4.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "Mozilla: Quoting from an HTML email with certain tags will trigger network requests and load remote content, regardless of a configuration to block remote content"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "the Mozilla project"
          ]
        },
        {
          "names": [
            "Nika Layzell"
          ],
          "summary": "Acknowledged by upstream."
        }
      ],
      "cve": "CVE-2022-46872",
      "cwe": {
        "id": "CWE-200",
        "name": "Exposure of Sensitive Information to an Unauthorized Actor"
      },
      "discovery_date": "2022-12-13T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2153441"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "The Mozilla Foundation Security Advisory describes this flaw as: An attacker who compromised a content process could have partially escaped the sandbox to read arbitrary files via clipboard-related IPC messages.\r\n\r\n*This bug only affects Firefox for Linux. Other operating systems are unaffected.*",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "Mozilla: Arbitrary file read from a compromised content process",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.4.0.Z.EUS:thunderbird-0:102.6.0-2.el8_4.aarch64",
          "AppStream-8.4.0.Z.EUS:thunderbird-0:102.6.0-2.el8_4.ppc64le",
          "AppStream-8.4.0.Z.EUS:thunderbird-0:102.6.0-2.el8_4.s390x",
          "AppStream-8.4.0.Z.EUS:thunderbird-0:102.6.0-2.el8_4.src",
          "AppStream-8.4.0.Z.EUS:thunderbird-0:102.6.0-2.el8_4.x86_64",
          "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.6.0-2.el8_4.aarch64",
          "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.6.0-2.el8_4.ppc64le",
          "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.6.0-2.el8_4.s390x",
          "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.6.0-2.el8_4.x86_64",
          "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.6.0-2.el8_4.aarch64",
          "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.6.0-2.el8_4.ppc64le",
          "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.6.0-2.el8_4.s390x",
          "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.6.0-2.el8_4.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2022-46872"
        },
        {
          "category": "external",
          "summary": "RHBZ#2153441",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2153441"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2022-46872",
          "url": "https://www.cve.org/CVERecord?id=CVE-2022-46872"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-46872",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-46872"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2022-52/#CVE-2022-46872",
          "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2022-52/#CVE-2022-46872"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2022-53/#CVE-2022-46872",
          "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2022-53/#CVE-2022-46872"
        }
      ],
      "release_date": "2022-12-13T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.",
          "product_ids": [
            "AppStream-8.4.0.Z.EUS:thunderbird-0:102.6.0-2.el8_4.aarch64",
            "AppStream-8.4.0.Z.EUS:thunderbird-0:102.6.0-2.el8_4.ppc64le",
            "AppStream-8.4.0.Z.EUS:thunderbird-0:102.6.0-2.el8_4.s390x",
            "AppStream-8.4.0.Z.EUS:thunderbird-0:102.6.0-2.el8_4.src",
            "AppStream-8.4.0.Z.EUS:thunderbird-0:102.6.0-2.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.6.0-2.el8_4.aarch64",
            "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.6.0-2.el8_4.ppc64le",
            "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.6.0-2.el8_4.s390x",
            "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.6.0-2.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.6.0-2.el8_4.aarch64",
            "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.6.0-2.el8_4.ppc64le",
            "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.6.0-2.el8_4.s390x",
            "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.6.0-2.el8_4.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2022:9075"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.4.0.Z.EUS:thunderbird-0:102.6.0-2.el8_4.aarch64",
            "AppStream-8.4.0.Z.EUS:thunderbird-0:102.6.0-2.el8_4.ppc64le",
            "AppStream-8.4.0.Z.EUS:thunderbird-0:102.6.0-2.el8_4.s390x",
            "AppStream-8.4.0.Z.EUS:thunderbird-0:102.6.0-2.el8_4.src",
            "AppStream-8.4.0.Z.EUS:thunderbird-0:102.6.0-2.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.6.0-2.el8_4.aarch64",
            "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.6.0-2.el8_4.ppc64le",
            "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.6.0-2.el8_4.s390x",
            "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.6.0-2.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.6.0-2.el8_4.aarch64",
            "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.6.0-2.el8_4.ppc64le",
            "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.6.0-2.el8_4.s390x",
            "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.6.0-2.el8_4.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "Mozilla: Arbitrary file read from a compromised content process"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "the Mozilla project"
          ]
        },
        {
          "names": [
            "Matthias Zoellner"
          ],
          "summary": "Acknowledged by upstream."
        }
      ],
      "cve": "CVE-2022-46874",
      "cwe": {
        "id": "CWE-222",
        "name": "Truncation of Security-relevant Information"
      },
      "discovery_date": "2022-12-13T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2153449"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nA file with a long filename could have had its filename truncated to remove the valid extension, leaving a malicious extension in its place. This could potentially led to user confusion and the execution of malicious code.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "Mozilla: Drag and Dropped Filenames could have been truncated to malicious extensions",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory. Note that this CVE was actually fixed in Thunderbird 102.6.1 despite being initially included in the advisories for Thunderbird 102.6. A future update for Thunderbird 102.7 will address this CVE in Red Hat Enterprise Linux.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.4.0.Z.EUS:thunderbird-0:102.6.0-2.el8_4.aarch64",
          "AppStream-8.4.0.Z.EUS:thunderbird-0:102.6.0-2.el8_4.ppc64le",
          "AppStream-8.4.0.Z.EUS:thunderbird-0:102.6.0-2.el8_4.s390x",
          "AppStream-8.4.0.Z.EUS:thunderbird-0:102.6.0-2.el8_4.src",
          "AppStream-8.4.0.Z.EUS:thunderbird-0:102.6.0-2.el8_4.x86_64",
          "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.6.0-2.el8_4.aarch64",
          "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.6.0-2.el8_4.ppc64le",
          "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.6.0-2.el8_4.s390x",
          "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.6.0-2.el8_4.x86_64",
          "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.6.0-2.el8_4.aarch64",
          "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.6.0-2.el8_4.ppc64le",
          "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.6.0-2.el8_4.s390x",
          "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.6.0-2.el8_4.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2022-46874"
        },
        {
          "category": "external",
          "summary": "RHBZ#2153449",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2153449"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2022-46874",
          "url": "https://www.cve.org/CVERecord?id=CVE-2022-46874"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-46874",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-46874"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2022-52/#CVE-2022-46874",
          "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2022-52/#CVE-2022-46874"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2022-53",
          "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2022-53"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2022-54/#CVE-2022-46874",
          "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2022-54/#CVE-2022-46874"
        }
      ],
      "release_date": "2022-12-13T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.",
          "product_ids": [
            "AppStream-8.4.0.Z.EUS:thunderbird-0:102.6.0-2.el8_4.aarch64",
            "AppStream-8.4.0.Z.EUS:thunderbird-0:102.6.0-2.el8_4.ppc64le",
            "AppStream-8.4.0.Z.EUS:thunderbird-0:102.6.0-2.el8_4.s390x",
            "AppStream-8.4.0.Z.EUS:thunderbird-0:102.6.0-2.el8_4.src",
            "AppStream-8.4.0.Z.EUS:thunderbird-0:102.6.0-2.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.6.0-2.el8_4.aarch64",
            "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.6.0-2.el8_4.ppc64le",
            "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.6.0-2.el8_4.s390x",
            "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.6.0-2.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.6.0-2.el8_4.aarch64",
            "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.6.0-2.el8_4.ppc64le",
            "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.6.0-2.el8_4.s390x",
            "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.6.0-2.el8_4.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2022:9075"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.4.0.Z.EUS:thunderbird-0:102.6.0-2.el8_4.aarch64",
            "AppStream-8.4.0.Z.EUS:thunderbird-0:102.6.0-2.el8_4.ppc64le",
            "AppStream-8.4.0.Z.EUS:thunderbird-0:102.6.0-2.el8_4.s390x",
            "AppStream-8.4.0.Z.EUS:thunderbird-0:102.6.0-2.el8_4.src",
            "AppStream-8.4.0.Z.EUS:thunderbird-0:102.6.0-2.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.6.0-2.el8_4.aarch64",
            "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.6.0-2.el8_4.ppc64le",
            "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.6.0-2.el8_4.s390x",
            "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.6.0-2.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.6.0-2.el8_4.aarch64",
            "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.6.0-2.el8_4.ppc64le",
            "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.6.0-2.el8_4.s390x",
            "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.6.0-2.el8_4.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "Mozilla: Drag and Dropped Filenames could have been truncated to malicious extensions"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "the Mozilla project"
          ]
        },
        {
          "names": [
            "Mozilla developers"
          ],
          "summary": "Acknowledged by upstream."
        }
      ],
      "cve": "CVE-2022-46878",
      "cwe": {
        "id": "CWE-120",
        "name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
      },
      "discovery_date": "2022-12-13T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2153454"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nMozilla developers Randell Jesup, Valentin Gosu, Olli Pettay, and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 107 and Firefox ESR 102.5. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "Mozilla: Memory safety bugs fixed in Firefox ESR 102.6 and Thunderbird 102.6",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.4.0.Z.EUS:thunderbird-0:102.6.0-2.el8_4.aarch64",
          "AppStream-8.4.0.Z.EUS:thunderbird-0:102.6.0-2.el8_4.ppc64le",
          "AppStream-8.4.0.Z.EUS:thunderbird-0:102.6.0-2.el8_4.s390x",
          "AppStream-8.4.0.Z.EUS:thunderbird-0:102.6.0-2.el8_4.src",
          "AppStream-8.4.0.Z.EUS:thunderbird-0:102.6.0-2.el8_4.x86_64",
          "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.6.0-2.el8_4.aarch64",
          "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.6.0-2.el8_4.ppc64le",
          "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.6.0-2.el8_4.s390x",
          "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.6.0-2.el8_4.x86_64",
          "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.6.0-2.el8_4.aarch64",
          "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.6.0-2.el8_4.ppc64le",
          "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.6.0-2.el8_4.s390x",
          "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.6.0-2.el8_4.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2022-46878"
        },
        {
          "category": "external",
          "summary": "RHBZ#2153454",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2153454"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2022-46878",
          "url": "https://www.cve.org/CVERecord?id=CVE-2022-46878"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-46878",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-46878"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2022-52/#CVE-2022-46878",
          "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2022-52/#CVE-2022-46878"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2022-53/#CVE-2022-46878",
          "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2022-53/#CVE-2022-46878"
        }
      ],
      "release_date": "2022-12-13T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.",
          "product_ids": [
            "AppStream-8.4.0.Z.EUS:thunderbird-0:102.6.0-2.el8_4.aarch64",
            "AppStream-8.4.0.Z.EUS:thunderbird-0:102.6.0-2.el8_4.ppc64le",
            "AppStream-8.4.0.Z.EUS:thunderbird-0:102.6.0-2.el8_4.s390x",
            "AppStream-8.4.0.Z.EUS:thunderbird-0:102.6.0-2.el8_4.src",
            "AppStream-8.4.0.Z.EUS:thunderbird-0:102.6.0-2.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.6.0-2.el8_4.aarch64",
            "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.6.0-2.el8_4.ppc64le",
            "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.6.0-2.el8_4.s390x",
            "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.6.0-2.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.6.0-2.el8_4.aarch64",
            "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.6.0-2.el8_4.ppc64le",
            "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.6.0-2.el8_4.s390x",
            "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.6.0-2.el8_4.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2022:9075"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.4.0.Z.EUS:thunderbird-0:102.6.0-2.el8_4.aarch64",
            "AppStream-8.4.0.Z.EUS:thunderbird-0:102.6.0-2.el8_4.ppc64le",
            "AppStream-8.4.0.Z.EUS:thunderbird-0:102.6.0-2.el8_4.s390x",
            "AppStream-8.4.0.Z.EUS:thunderbird-0:102.6.0-2.el8_4.src",
            "AppStream-8.4.0.Z.EUS:thunderbird-0:102.6.0-2.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.6.0-2.el8_4.aarch64",
            "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.6.0-2.el8_4.ppc64le",
            "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.6.0-2.el8_4.s390x",
            "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.6.0-2.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.6.0-2.el8_4.aarch64",
            "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.6.0-2.el8_4.ppc64le",
            "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.6.0-2.el8_4.s390x",
            "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.6.0-2.el8_4.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "Mozilla: Memory safety bugs fixed in Firefox ESR 102.6 and Thunderbird 102.6"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "the Mozilla project"
          ]
        },
        {
          "names": [
            "Atte Kettunen"
          ],
          "summary": "Acknowledged by upstream."
        }
      ],
      "cve": "CVE-2022-46880",
      "cwe": {
        "id": "CWE-416",
        "name": "Use After Free"
      },
      "discovery_date": "2022-12-13T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2153463"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "The Mozilla Foundation Security Advisory describes this flaw as: A missing check related to tex units could have led to a use-after-free and potentially exploitable crash.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "Mozilla: Use-after-free in WebGL",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.4.0.Z.EUS:thunderbird-0:102.6.0-2.el8_4.aarch64",
          "AppStream-8.4.0.Z.EUS:thunderbird-0:102.6.0-2.el8_4.ppc64le",
          "AppStream-8.4.0.Z.EUS:thunderbird-0:102.6.0-2.el8_4.s390x",
          "AppStream-8.4.0.Z.EUS:thunderbird-0:102.6.0-2.el8_4.src",
          "AppStream-8.4.0.Z.EUS:thunderbird-0:102.6.0-2.el8_4.x86_64",
          "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.6.0-2.el8_4.aarch64",
          "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.6.0-2.el8_4.ppc64le",
          "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.6.0-2.el8_4.s390x",
          "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.6.0-2.el8_4.x86_64",
          "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.6.0-2.el8_4.aarch64",
          "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.6.0-2.el8_4.ppc64le",
          "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.6.0-2.el8_4.s390x",
          "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.6.0-2.el8_4.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2022-46880"
        },
        {
          "category": "external",
          "summary": "RHBZ#2153463",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2153463"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2022-46880",
          "url": "https://www.cve.org/CVERecord?id=CVE-2022-46880"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-46880",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-46880"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2022-52/#CVE-2022-46880",
          "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2022-52/#CVE-2022-46880"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2022-53/#CVE-2022-46880",
          "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2022-53/#CVE-2022-46880"
        }
      ],
      "release_date": "2022-12-13T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.",
          "product_ids": [
            "AppStream-8.4.0.Z.EUS:thunderbird-0:102.6.0-2.el8_4.aarch64",
            "AppStream-8.4.0.Z.EUS:thunderbird-0:102.6.0-2.el8_4.ppc64le",
            "AppStream-8.4.0.Z.EUS:thunderbird-0:102.6.0-2.el8_4.s390x",
            "AppStream-8.4.0.Z.EUS:thunderbird-0:102.6.0-2.el8_4.src",
            "AppStream-8.4.0.Z.EUS:thunderbird-0:102.6.0-2.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.6.0-2.el8_4.aarch64",
            "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.6.0-2.el8_4.ppc64le",
            "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.6.0-2.el8_4.s390x",
            "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.6.0-2.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.6.0-2.el8_4.aarch64",
            "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.6.0-2.el8_4.ppc64le",
            "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.6.0-2.el8_4.s390x",
            "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.6.0-2.el8_4.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2022:9075"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.4.0.Z.EUS:thunderbird-0:102.6.0-2.el8_4.aarch64",
            "AppStream-8.4.0.Z.EUS:thunderbird-0:102.6.0-2.el8_4.ppc64le",
            "AppStream-8.4.0.Z.EUS:thunderbird-0:102.6.0-2.el8_4.s390x",
            "AppStream-8.4.0.Z.EUS:thunderbird-0:102.6.0-2.el8_4.src",
            "AppStream-8.4.0.Z.EUS:thunderbird-0:102.6.0-2.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.6.0-2.el8_4.aarch64",
            "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.6.0-2.el8_4.ppc64le",
            "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.6.0-2.el8_4.s390x",
            "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.6.0-2.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.6.0-2.el8_4.aarch64",
            "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.6.0-2.el8_4.ppc64le",
            "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.6.0-2.el8_4.s390x",
            "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.6.0-2.el8_4.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "Mozilla: Use-after-free in WebGL"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "the Mozilla project"
          ]
        },
        {
          "names": [
            "Karl and an Anonymous ASAN Nightly User"
          ],
          "summary": "Acknowledged by upstream."
        }
      ],
      "cve": "CVE-2022-46881",
      "cwe": {
        "id": "CWE-119",
        "name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
      },
      "discovery_date": "2022-12-13T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2153466"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nAn optimization in WebGL was incorrect in some cases, and could have led to memory corruption and a potentially exploitable crash.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "Mozilla: Memory corruption in WebGL",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.4.0.Z.EUS:thunderbird-0:102.6.0-2.el8_4.aarch64",
          "AppStream-8.4.0.Z.EUS:thunderbird-0:102.6.0-2.el8_4.ppc64le",
          "AppStream-8.4.0.Z.EUS:thunderbird-0:102.6.0-2.el8_4.s390x",
          "AppStream-8.4.0.Z.EUS:thunderbird-0:102.6.0-2.el8_4.src",
          "AppStream-8.4.0.Z.EUS:thunderbird-0:102.6.0-2.el8_4.x86_64",
          "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.6.0-2.el8_4.aarch64",
          "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.6.0-2.el8_4.ppc64le",
          "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.6.0-2.el8_4.s390x",
          "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.6.0-2.el8_4.x86_64",
          "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.6.0-2.el8_4.aarch64",
          "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.6.0-2.el8_4.ppc64le",
          "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.6.0-2.el8_4.s390x",
          "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.6.0-2.el8_4.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2022-46881"
        },
        {
          "category": "external",
          "summary": "RHBZ#2153466",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2153466"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2022-46881",
          "url": "https://www.cve.org/CVERecord?id=CVE-2022-46881"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-46881",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-46881"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2022-52/#CVE-2022-46881",
          "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2022-52/#CVE-2022-46881"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2022-53/#CVE-2022-46881",
          "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2022-53/#CVE-2022-46881"
        }
      ],
      "release_date": "2022-12-13T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.",
          "product_ids": [
            "AppStream-8.4.0.Z.EUS:thunderbird-0:102.6.0-2.el8_4.aarch64",
            "AppStream-8.4.0.Z.EUS:thunderbird-0:102.6.0-2.el8_4.ppc64le",
            "AppStream-8.4.0.Z.EUS:thunderbird-0:102.6.0-2.el8_4.s390x",
            "AppStream-8.4.0.Z.EUS:thunderbird-0:102.6.0-2.el8_4.src",
            "AppStream-8.4.0.Z.EUS:thunderbird-0:102.6.0-2.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.6.0-2.el8_4.aarch64",
            "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.6.0-2.el8_4.ppc64le",
            "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.6.0-2.el8_4.s390x",
            "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.6.0-2.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.6.0-2.el8_4.aarch64",
            "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.6.0-2.el8_4.ppc64le",
            "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.6.0-2.el8_4.s390x",
            "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.6.0-2.el8_4.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2022:9075"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.4.0.Z.EUS:thunderbird-0:102.6.0-2.el8_4.aarch64",
            "AppStream-8.4.0.Z.EUS:thunderbird-0:102.6.0-2.el8_4.ppc64le",
            "AppStream-8.4.0.Z.EUS:thunderbird-0:102.6.0-2.el8_4.s390x",
            "AppStream-8.4.0.Z.EUS:thunderbird-0:102.6.0-2.el8_4.src",
            "AppStream-8.4.0.Z.EUS:thunderbird-0:102.6.0-2.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.6.0-2.el8_4.aarch64",
            "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.6.0-2.el8_4.ppc64le",
            "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.6.0-2.el8_4.s390x",
            "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.6.0-2.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.6.0-2.el8_4.aarch64",
            "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.6.0-2.el8_4.ppc64le",
            "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.6.0-2.el8_4.s390x",
            "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.6.0-2.el8_4.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "Mozilla: Memory corruption in WebGL"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "the Mozilla project"
          ]
        },
        {
          "names": [
            "Irvan Kurniawan"
          ],
          "summary": "Acknowledged by upstream."
        }
      ],
      "cve": "CVE-2022-46882",
      "cwe": {
        "id": "CWE-416",
        "name": "Use After Free"
      },
      "discovery_date": "2022-12-13T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2153467"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nA use-after-free in WebGL extensions could have led to a potentially exploitable crash.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "Mozilla: Use-after-free in WebGL",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.4.0.Z.EUS:thunderbird-0:102.6.0-2.el8_4.aarch64",
          "AppStream-8.4.0.Z.EUS:thunderbird-0:102.6.0-2.el8_4.ppc64le",
          "AppStream-8.4.0.Z.EUS:thunderbird-0:102.6.0-2.el8_4.s390x",
          "AppStream-8.4.0.Z.EUS:thunderbird-0:102.6.0-2.el8_4.src",
          "AppStream-8.4.0.Z.EUS:thunderbird-0:102.6.0-2.el8_4.x86_64",
          "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.6.0-2.el8_4.aarch64",
          "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.6.0-2.el8_4.ppc64le",
          "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.6.0-2.el8_4.s390x",
          "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.6.0-2.el8_4.x86_64",
          "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.6.0-2.el8_4.aarch64",
          "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.6.0-2.el8_4.ppc64le",
          "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.6.0-2.el8_4.s390x",
          "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.6.0-2.el8_4.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2022-46882"
        },
        {
          "category": "external",
          "summary": "RHBZ#2153467",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2153467"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2022-46882",
          "url": "https://www.cve.org/CVERecord?id=CVE-2022-46882"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-46882",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-46882"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2022-52/#CVE-2022-46882",
          "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2022-52/#CVE-2022-46882"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2022-53/#CVE-2022-46882",
          "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2022-53/#CVE-2022-46882"
        }
      ],
      "release_date": "2022-12-13T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.",
          "product_ids": [
            "AppStream-8.4.0.Z.EUS:thunderbird-0:102.6.0-2.el8_4.aarch64",
            "AppStream-8.4.0.Z.EUS:thunderbird-0:102.6.0-2.el8_4.ppc64le",
            "AppStream-8.4.0.Z.EUS:thunderbird-0:102.6.0-2.el8_4.s390x",
            "AppStream-8.4.0.Z.EUS:thunderbird-0:102.6.0-2.el8_4.src",
            "AppStream-8.4.0.Z.EUS:thunderbird-0:102.6.0-2.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.6.0-2.el8_4.aarch64",
            "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.6.0-2.el8_4.ppc64le",
            "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.6.0-2.el8_4.s390x",
            "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.6.0-2.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.6.0-2.el8_4.aarch64",
            "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.6.0-2.el8_4.ppc64le",
            "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.6.0-2.el8_4.s390x",
            "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.6.0-2.el8_4.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2022:9075"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.4.0.Z.EUS:thunderbird-0:102.6.0-2.el8_4.aarch64",
            "AppStream-8.4.0.Z.EUS:thunderbird-0:102.6.0-2.el8_4.ppc64le",
            "AppStream-8.4.0.Z.EUS:thunderbird-0:102.6.0-2.el8_4.s390x",
            "AppStream-8.4.0.Z.EUS:thunderbird-0:102.6.0-2.el8_4.src",
            "AppStream-8.4.0.Z.EUS:thunderbird-0:102.6.0-2.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.6.0-2.el8_4.aarch64",
            "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.6.0-2.el8_4.ppc64le",
            "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.6.0-2.el8_4.s390x",
            "AppStream-8.4.0.Z.EUS:thunderbird-debuginfo-0:102.6.0-2.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.6.0-2.el8_4.aarch64",
            "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.6.0-2.el8_4.ppc64le",
            "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.6.0-2.el8_4.s390x",
            "AppStream-8.4.0.Z.EUS:thunderbird-debugsource-0:102.6.0-2.el8_4.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "Mozilla: Use-after-free in WebGL"
    }
  ]
}

cve-2022-45414

Vulnerability from cvelistv5

Published

2022-12-22 00:00

Modified

2024-08-03 14:09

Severity

Summary

If a Thunderbird user quoted from an HTML email, for example by replying to the email, and the email contained either a VIDEO tag with the POSTER attribute or an OBJECT tag with a DATA attribute, a network request to the referenced remote URL was performed, regardless of a configuration to block remote content. An image loaded from the POSTER attribute was shown in the composer window. These issues could have given an attacker additional capabilities when targetting releases that did not yet have a fix for CVE-2022-3033 which was reported around three months ago. This vulnerability affects Thunderbird < 102.5.1.

References

URL	Tags
https://www.mozilla.org/security/advisories/mfsa2022-50/
https://bugzilla.mozilla.org/show_bug.cgi?id=1788096

Impacted products

Vendor	Product
Mozilla	Thunderbird

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T14:09:57.041Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.mozilla.org/security/advisories/mfsa2022-50/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1788096"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThan": "102.5.1",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "If a Thunderbird user quoted from an HTML email, for example by replying to the email, and the email contained either a VIDEO tag with the POSTER attribute or an OBJECT tag with a DATA attribute, a network request to the referenced remote URL was performed, regardless of a configuration to block remote content. An image loaded from the POSTER attribute was shown in the composer window. These issues could have given an attacker additional capabilities when targetting releases that did not yet have a fix for CVE-2022-3033 which was reported around three months ago. This vulnerability affects Thunderbird \u003c 102.5.1."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Quoting from an HTML email with certain tags will trigger network requests and load remote content, regardless of a configuration to block remote content",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-12-22T00:00:00",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2022-50/"
        },
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1788096"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2022-45414",
    "datePublished": "2022-12-22T00:00:00",
    "dateReserved": "2022-11-14T00:00:00",
    "dateUpdated": "2024-08-03T14:09:57.041Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

cve-2022-46878

Vulnerability from cvelistv5

Published

2022-12-22 00:00

Modified

2024-08-03 14:39

Severity

Summary

Mozilla developers Randell Jesup, Valentin Gosu, Olli Pettay, and the Mozilla Fuzzing Team reported memory safety bugs present in Thunderbird 102.5. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 108, Firefox ESR < 102.6, and Thunderbird < 102.6.

References

URL	Tags
https://www.mozilla.org/security/advisories/mfsa2022-52/
https://www.mozilla.org/security/advisories/mfsa2022-53/
https://www.mozilla.org/security/advisories/mfsa2022-51/
https://bugzilla.mozilla.org/buglist.cgi?bug_id=1782219%2C1797370%2C1797685%2C1801102%2C1801315%2C1802395
https://security.gentoo.org/glsa/202305-06	vendor-advisory
https://security.gentoo.org/glsa/202305-13	vendor-advisory

Impacted products

Vendor	Product
Mozilla	Firefox
Mozilla	Firefox ESR
Mozilla	Thunderbird

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T14:39:39.118Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.mozilla.org/security/advisories/mfsa2022-52/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.mozilla.org/security/advisories/mfsa2022-53/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.mozilla.org/security/advisories/mfsa2022-51/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://bugzilla.mozilla.org/buglist.cgi?bug_id=1782219%2C1797370%2C1797685%2C1801102%2C1801315%2C1802395"
          },
          {
            "name": "GLSA-202305-06",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202305-06"
          },
          {
            "name": "GLSA-202305-13",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202305-13"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThan": "108",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Firefox ESR",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThan": "102.6",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThan": "102.6",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Mozilla developers Randell Jesup, Valentin Gosu, Olli Pettay, and the Mozilla Fuzzing Team reported memory safety bugs present in Thunderbird 102.5. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox \u003c 108, Firefox ESR \u003c 102.6, and Thunderbird \u003c 102.6."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Memory safety bugs fixed in Thunderbird 102.6",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-05-03T00:00:00",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2022-52/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2022-53/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2022-51/"
        },
        {
          "url": "https://bugzilla.mozilla.org/buglist.cgi?bug_id=1782219%2C1797370%2C1797685%2C1801102%2C1801315%2C1802395"
        },
        {
          "name": "GLSA-202305-06",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://security.gentoo.org/glsa/202305-06"
        },
        {
          "name": "GLSA-202305-13",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://security.gentoo.org/glsa/202305-13"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2022-46878",
    "datePublished": "2022-12-22T00:00:00",
    "dateReserved": "2022-12-09T00:00:00",
    "dateUpdated": "2024-08-03T14:39:39.118Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

cve-2022-46882

Vulnerability from cvelistv5

Published

2022-12-22 00:00

Modified

2024-08-03 14:39

Severity

Summary

A use-after-free in WebGL extensions could have led to a potentially exploitable crash. This vulnerability affects Firefox < 107, Firefox ESR < 102.6, and Thunderbird < 102.6.

References

URL	Tags
https://www.mozilla.org/security/advisories/mfsa2022-47/
https://www.mozilla.org/security/advisories/mfsa2022-52/
https://www.mozilla.org/security/advisories/mfsa2022-53/
https://bugzilla.mozilla.org/show_bug.cgi?id=1789371
https://security.gentoo.org/glsa/202305-06	vendor-advisory
https://security.gentoo.org/glsa/202305-13	vendor-advisory

Impacted products

Vendor	Product
Mozilla	Firefox
Mozilla	Firefox ESR
Mozilla	Thunderbird

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T14:39:39.130Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.mozilla.org/security/advisories/mfsa2022-47/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.mozilla.org/security/advisories/mfsa2022-52/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.mozilla.org/security/advisories/mfsa2022-53/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1789371"
          },
          {
            "name": "GLSA-202305-06",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202305-06"
          },
          {
            "name": "GLSA-202305-13",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202305-13"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThan": "107",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Firefox ESR",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThan": "102.6",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThan": "102.6",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A use-after-free in WebGL extensions could have led to a potentially exploitable crash. This vulnerability affects Firefox \u003c 107, Firefox ESR \u003c 102.6, and Thunderbird \u003c 102.6."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Use-after-free in WebGL",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-05-03T00:00:00",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2022-47/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2022-52/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2022-53/"
        },
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1789371"
        },
        {
          "name": "GLSA-202305-06",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://security.gentoo.org/glsa/202305-06"
        },
        {
          "name": "GLSA-202305-13",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://security.gentoo.org/glsa/202305-13"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2022-46882",
    "datePublished": "2022-12-22T00:00:00",
    "dateReserved": "2022-12-09T00:00:00",
    "dateUpdated": "2024-08-03T14:39:39.130Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

cve-2022-46881

Vulnerability from cvelistv5

Published

2022-12-22 00:00

Modified

2024-08-03 14:39

Severity

Summary

An optimization in WebGL was incorrect in some cases, and could have led to memory corruption and a potentially exploitable crash. *Note*: This advisory was added on December 13th, 2022 after we better understood the impact of the issue. The fix was included in the original release of Firefox 106. This vulnerability affects Firefox < 106, Firefox ESR < 102.6, and Thunderbird < 102.6.

References

URL	Tags
https://bugzilla.mozilla.org/show_bug.cgi?id=1770930
https://security.gentoo.org/glsa/202305-06	vendor-advisory
https://security.gentoo.org/glsa/202305-13	vendor-advisory
https://www.mozilla.org/security/advisories/mfsa2022-44/
https://www.mozilla.org/security/advisories/mfsa2022-52/
https://www.mozilla.org/security/advisories/mfsa2022-53/

Impacted products

Vendor	Product
Mozilla	Firefox
Mozilla	Firefox ESR
Mozilla	Thunderbird

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T14:39:38.732Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1770930"
          },
          {
            "name": "GLSA-202305-06",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202305-06"
          },
          {
            "name": "GLSA-202305-13",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202305-13"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.mozilla.org/security/advisories/mfsa2022-44/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.mozilla.org/security/advisories/mfsa2022-52/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.mozilla.org/security/advisories/mfsa2022-53/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThan": "106",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Firefox ESR",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThan": "102.6",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThan": "102.6",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Karl and an Anonymous ASAN Nightly User"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "An optimization in WebGL was incorrect in some cases, and could have led to memory corruption and a potentially exploitable crash.\u003cbr /\u003e*Note*: This advisory was added on December 13th, 2022 after we better understood the impact of the issue. The fix was included in the original release of Firefox 106. This vulnerability affects Firefox \u003c 106, Firefox ESR \u003c 102.6, and Thunderbird \u003c 102.6."
            }
          ],
          "value": "An optimization in WebGL was incorrect in some cases, and could have led to memory corruption and a potentially exploitable crash.\n*Note*: This advisory was added on December 13th, 2022 after we better understood the impact of the issue. The fix was included in the original release of Firefox 106. This vulnerability affects Firefox \u003c 106, Firefox ESR \u003c 102.6, and Thunderbird \u003c 102.6."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Memory corruption in WebGL",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-09-13T10:36:40.873Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1770930"
        },
        {
          "name": "GLSA-202305-06",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://security.gentoo.org/glsa/202305-06"
        },
        {
          "name": "GLSA-202305-13",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://security.gentoo.org/glsa/202305-13"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2022-44/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2022-52/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2022-53/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2022-46881",
    "datePublished": "2022-12-22T00:00:00",
    "dateReserved": "2022-12-09T00:00:00",
    "dateUpdated": "2024-08-03T14:39:38.732Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

cve-2022-46880

Vulnerability from cvelistv5

Published

2022-12-22 00:00

Modified

2024-08-03 14:39

Severity

Summary

A missing check related to tex units could have led to a use-after-free and potentially exploitable crash.<br />*Note*: This advisory was added on December 13th, 2022 after we better understood the impact of the issue. The fix was included in the original release of Firefox 105. This vulnerability affects Firefox ESR < 102.6, Firefox < 105, and Thunderbird < 102.6.

References

URL	Tags
https://www.mozilla.org/security/advisories/mfsa2022-52/
https://www.mozilla.org/security/advisories/mfsa2022-53/
https://www.mozilla.org/security/advisories/mfsa2022-40/
https://bugzilla.mozilla.org/show_bug.cgi?id=1749292
https://security.gentoo.org/glsa/202305-06	vendor-advisory
https://security.gentoo.org/glsa/202305-13	vendor-advisory

Impacted products

Vendor	Product
Mozilla	Firefox ESR
Mozilla	Firefox
Mozilla	Thunderbird

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T14:39:38.591Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.mozilla.org/security/advisories/mfsa2022-52/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.mozilla.org/security/advisories/mfsa2022-53/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.mozilla.org/security/advisories/mfsa2022-40/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1749292"
          },
          {
            "name": "GLSA-202305-06",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202305-06"
          },
          {
            "name": "GLSA-202305-13",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202305-13"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox ESR",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThan": "102.6",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThan": "105",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThan": "102.6",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A missing check related to tex units could have led to a use-after-free and potentially exploitable crash.\u003cbr /\u003e*Note*: This advisory was added on December 13th, 2022 after we better understood the impact of the issue. The fix was included in the original release of Firefox 105. This vulnerability affects Firefox ESR \u003c 102.6, Firefox \u003c 105, and Thunderbird \u003c 102.6."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Use-after-free in WebGL",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-05-03T00:00:00",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2022-52/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2022-53/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2022-40/"
        },
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1749292"
        },
        {
          "name": "GLSA-202305-06",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://security.gentoo.org/glsa/202305-06"
        },
        {
          "name": "GLSA-202305-13",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://security.gentoo.org/glsa/202305-13"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2022-46880",
    "datePublished": "2022-12-22T00:00:00",
    "dateReserved": "2022-12-09T00:00:00",
    "dateUpdated": "2024-08-03T14:39:38.591Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

cve-2022-46874

Vulnerability from cvelistv5

Published

2022-12-22 00:00

Modified

2024-08-03 14:39

Severity

Summary

A file with a long filename could have had its filename truncated to remove the valid extension, leaving a malicious extension in its place. This could potentially led to user confusion and the execution of malicious code.<br/>*Note*: This issue was originally included in the advisories for Thunderbird 102.6, but a patch (specific to Thunderbird) was omitted, resulting in it actually being fixed in Thunderbird 102.6.1. This vulnerability affects Firefox < 108, Thunderbird < 102.6.1, Thunderbird < 102.6, and Firefox ESR < 102.6.

References

URL	Tags
https://www.mozilla.org/security/advisories/mfsa2022-52/
https://www.mozilla.org/security/advisories/mfsa2022-53/
https://www.mozilla.org/security/advisories/mfsa2022-51/
https://www.mozilla.org/security/advisories/mfsa2022-54/
https://bugzilla.mozilla.org/show_bug.cgi?id=1746139
https://security.gentoo.org/glsa/202305-06	vendor-advisory
https://security.gentoo.org/glsa/202305-13	vendor-advisory

Impacted products

Vendor	Product
Mozilla	Firefox
Mozilla	Thunderbird
Mozilla	Firefox ESR

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T14:39:38.960Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.mozilla.org/security/advisories/mfsa2022-52/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.mozilla.org/security/advisories/mfsa2022-53/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.mozilla.org/security/advisories/mfsa2022-51/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.mozilla.org/security/advisories/mfsa2022-54/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1746139"
          },
          {
            "name": "GLSA-202305-06",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202305-06"
          },
          {
            "name": "GLSA-202305-13",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202305-13"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThan": "108",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThan": "102.6.1",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            },
            {
              "lessThan": "102.6",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Firefox ESR",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThan": "102.6",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A file with a long filename could have had its filename truncated to remove the valid extension, leaving a malicious extension in its place. This could potentially led to user confusion and the execution of malicious code.\u003cbr/\u003e*Note*: This issue was originally included in the advisories for Thunderbird 102.6, but a patch (specific to Thunderbird) was omitted, resulting in it actually being fixed in Thunderbird 102.6.1. This vulnerability affects Firefox \u003c 108, Thunderbird \u003c 102.6.1, Thunderbird \u003c 102.6, and Firefox ESR \u003c 102.6."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Drag and Dropped Filenames could have been truncated to malicious extensions",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-05-03T00:00:00",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2022-52/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2022-53/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2022-51/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2022-54/"
        },
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1746139"
        },
        {
          "name": "GLSA-202305-06",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://security.gentoo.org/glsa/202305-06"
        },
        {
          "name": "GLSA-202305-13",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://security.gentoo.org/glsa/202305-13"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2022-46874",
    "datePublished": "2022-12-22T00:00:00",
    "dateReserved": "2022-12-09T00:00:00",
    "dateUpdated": "2024-08-03T14:39:38.960Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

cve-2022-46872

Vulnerability from cvelistv5

Published

2022-12-22 00:00

Modified

2024-08-03 14:39

Severity

Summary

An attacker who compromised a content process could have partially escaped the sandbox to read arbitrary files via clipboard-related IPC messages.<br>*This bug only affects Thunderbird for Linux. Other operating systems are unaffected.*. This vulnerability affects Firefox < 108, Firefox ESR < 102.6, and Thunderbird < 102.6.

References

URL	Tags
https://www.mozilla.org/security/advisories/mfsa2022-52/
https://www.mozilla.org/security/advisories/mfsa2022-53/
https://www.mozilla.org/security/advisories/mfsa2022-51/
https://bugzilla.mozilla.org/show_bug.cgi?id=1799156
https://security.gentoo.org/glsa/202305-06	vendor-advisory
https://security.gentoo.org/glsa/202305-13	vendor-advisory

Impacted products

Vendor	Product
Mozilla	Firefox
Mozilla	Firefox ESR
Mozilla	Thunderbird

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T14:39:39.119Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.mozilla.org/security/advisories/mfsa2022-52/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.mozilla.org/security/advisories/mfsa2022-53/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.mozilla.org/security/advisories/mfsa2022-51/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1799156"
          },
          {
            "name": "GLSA-202305-06",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202305-06"
          },
          {
            "name": "GLSA-202305-13",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202305-13"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThan": "108",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Firefox ESR",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThan": "102.6",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThan": "102.6",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "An attacker who compromised a content process could have partially escaped the sandbox to read arbitrary files via clipboard-related IPC messages.\u003cbr\u003e*This bug only affects Thunderbird for Linux. Other operating systems are unaffected.*. This vulnerability affects Firefox \u003c 108, Firefox ESR \u003c 102.6, and Thunderbird \u003c 102.6."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Arbitrary file read from a compromised content process",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-05-03T00:00:00",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2022-52/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2022-53/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2022-51/"
        },
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1799156"
        },
        {
          "name": "GLSA-202305-06",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://security.gentoo.org/glsa/202305-06"
        },
        {
          "name": "GLSA-202305-13",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://security.gentoo.org/glsa/202305-13"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2022-46872",
    "datePublished": "2022-12-22T00:00:00",
    "dateReserved": "2022-12-09T00:00:00",
    "dateUpdated": "2024-08-03T14:39:39.119Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Action not permitted

Vulnerability from csaf_redhat

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Tags