Linux · Security advisory · March 14, 2022
ELSA-2022-0845: thunderbird security update
ELSA-2022-0845, released March 14, 2022, fixes 11 CVEs in thunderbird (version 0:91.7.0-2.0.1.el8_5). 2 of them are being exploited (CVE-2022-26485); 2 on CISA KEV. Patch Radar priority: Patch now.
Patch now2 on CISA KEV
CVEs closed
11
7 rated Critical
Exploited
2
CVE-2022-26485
Exploitation more likely
0
Vendor assessment
Highest EPSS
0.3527
98th percentile
Priority of the 11 CVEs
Patch now 2
Urgent 5
High 4
Routine 0
Fixed package versions
| Product | Release | Fixed in |
|---|---|---|
| thunderbird | ol 8 | 0:91.7.0-2.0.1.el8_5 |
CVEs this fix closes
| Priority | CVE | Title | Impact | CVSS | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| Patch now | CVE-2022-26485 | Mozilla Firefox Use-After-Free Vulnerability | 9.8 | 0.1426 | KEVExploited | |
| Patch now | CVE-2022-26486 | Mozilla Firefox Use-After-Free Vulnerability | 9.8 | 0.0236 | KEVExploited | |
| Urgent | CVE-2022-26384 | Mozilla Thunderbird and 4 others: Protection Mechanism Failure | 9.8 | 0.0097 | None reported | |
| Urgent | CVE-2022-26381 | Mozilla Thunderbird and 4 others: Use After Free | 9.8 | 0.0087 | None reported | |
| Urgent | CVE-2022-26386 | firefox: Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. This... | 9.8 | 0.0071 | None reported | |
| Urgent | CVE-2022-26383 | Mozilla Thunderbird and 4 others: User Interface (UI) Misrepresentation of Critical Information | 9.8 | 0.0070 | None reported | |
| Urgent | CVE-2022-26387 | Mozilla Thunderbird and 4 others: Time-of-check Time-of-use (TOCTOU) Race Condition | 9.8 | 0.0066 | None reported | |
| High | CVE-2022-25236 | libxmltok1: xmlparse.c in Expat (aka libexpat) before 2.4.5 allows attackers to insert namespace-separator characters into namesp... | 9.8 | 0.3527 | None reported | |
| High | CVE-2022-25235 | libxmltok1: xmltok_impl.c in Expat (aka libexpat) before 2.4.5 lacks certain validation of encoding, such as checks for whether a... | 9.8 | 0.0496 | None reported | |
| High | CVE-2022-25315 | expat: In Expat (aka libexpat) before 2.4.5, there is an integer overflow in storeRawNames. | 9.8 | 0.0482 | None reported | |
| High | CVE-2022-0566 | Mozilla Thunderbird and 1 other: Out-of-bounds Write | 9.8 | 0.0074 | None reported |
Showing 1 to 11 of 11
1