Linux · Security advisory · December 9, 2021
RHSA-2021:5045: thunderbird security update
RHSA-2021:5045, released December 9, 2021, fixes 11 CVEs in thunderbird (version 0:91.4.0-2.el8_5). None of them is reported as exploited. Patch Radar priority: High.
High
CVEs closed
11
None rated Critical
Exploited
0
None reported
Exploitation more likely
0
Vendor assessment
Highest EPSS
0.0217
82nd percentile
Priority of the 11 CVEs
Patch now 0
Urgent 0
High 11
Routine 0
Fixed package versions
| Product | Release | Fixed in |
|---|---|---|
| thunderbird | RHEL 8 | 0:91.4.0-2.el8_5 |
CVEs this fix closes
| Priority | CVE | Title | Impact | CVSS | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| High | CVE-2021-43537 | Mozilla Firefox ESR and 3 others: An incorrect type conversion of sizes from 64bit to 32bit integers allowed an attacker to corrupt memory… | 9.8 | 0.0217 | None reported | |
| High | CVE-2021-43542 | Mozilla Firefox ESR and 3 others: Using XMLHttpRequest, an attacker could have identified installed applications by probing error messages… | 9.8 | 0.0183 | None reported | |
| High | CVE-2021-43536 | Mozilla Firefox ESR and 3 others: Under certain circumstances, asynchronous functions could have caused a navigation to fail but expose… | 9.8 | 0.0181 | None reported | |
| High | CVE-2021-43539 | Mozilla Firefox ESR and 3 others: Failure to correctly record the location of live pointers across wasm instance calls resulted in a GC… | 9.8 | 0.0173 | None reported | |
| High | CVE-2021-43545 | Mozilla Firefox ESR and 3 others: Using the Location API in a loop could have caused severe application hangs and crashes. | 9.8 | 0.0172 | None reported | |
| High | CVE-2021-43541 | Mozilla Firefox ESR and 3 others: When invoking protocol handlers for external protocols, a supplied parameter URL containing spaces was… | 9.8 | 0.0169 | None reported | |
| High | CVE-2021-43546 | Mozilla Firefox ESR and 3 others: It was possible to recreate previous cursor spoofing attacks against users with a zoomed native cursor. | 9.8 | 0.0151 | None reported | |
| High | CVE-2021-43543 | Mozilla Firefox ESR and 3 others: Documents loaded with the CSP sandbox directive could have escaped the sandbox's script restriction by… | 9.8 | 0.0145 | None reported | |
| High | CVE-2021-43528 | Mozilla Thunderbird and 1 other: Thunderbird unexpectedly enabled JavaScript in the composition area. | 9.8 | 0.0131 | None reported | |
| High | CVE-2021-43538 | Mozilla Firefox ESR and 3 others: By misusing a race in our notification code, an attacker could have forcefully hidden the notification… | 9.8 | 0.0125 | None reported | |
| High | CVE-2021-4129 | Mozilla Firefox ESR and 3 others: Out-of-bounds Write | 9.8 | 0.0106 | None reported |
Showing 1 to 11 of 11
1