Linux · Security advisory · January 12, 2022
RHSA-2022:0129: thunderbird security update
RHSA-2022:0129, released January 12, 2022, fixes 12 CVEs in thunderbird (version 0:91.5.0-1.el8_5). None of them is reported as exploited. Patch Radar priority: High.
High
CVEs closed
12
None rated Critical
Exploited
0
None reported
Exploitation more likely
0
Vendor assessment
Highest EPSS
0.0141
72nd percentile
Priority of the 12 CVEs
Patch now 0
Urgent 0
High 12
Routine 0
Fixed package versions
| Product | Release | Fixed in |
|---|---|---|
| thunderbird | RHEL 8 | 0:91.5.0-1.el8_5 |
CVEs this fix closes
| Priority | CVE | Title | Impact | CVSS | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| High | CVE-2021-4140 | Mozilla Firefox ESR and 3 others: XML Injection (aka Blind XPath Injection) | 10.0 | 0.0141 | None reported | |
| High | CVE-2022-22738 | Mozilla Firefox ESR and 3 others: Out-of-bounds Write | 9.6 | 0.0104 | None reported | |
| High | CVE-2022-22740 | Mozilla Firefox ESR and 3 others: Use After Free | 9.6 | 0.0101 | None reported | |
| High | CVE-2022-22751 | Mozilla Firefox ESR and 3 others: Out-of-bounds Write | 9.6 | 0.0092 | None reported | |
| High | CVE-2022-22742 | Mozilla Firefox ESR and 3 others: Out-of-bounds Read | 9.6 | 0.0085 | None reported | |
| High | CVE-2022-22737 | Mozilla Firefox ESR and 3 others: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') | 9.6 | 0.0078 | None reported | |
| High | CVE-2022-22748 | Mozilla Firefox ESR and 3 others: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | 9.6 | 0.0077 | None reported | |
| High | CVE-2022-22739 | Mozilla Firefox ESR and 3 others: Malicious websites could have tricked users into accepting launching a program to handle an external… | 9.6 | 0.0071 | None reported | |
| High | CVE-2022-22741 | Mozilla Firefox ESR and 3 others: When resizing a popup while requesting fullscreen access, the popup would have become unable to leave… | 9.6 | 0.0070 | None reported | |
| High | CVE-2022-22743 | Mozilla Firefox ESR and 3 others: When navigating from inside an iframe while requesting fullscreen access, an attacker-controlled tab… | 9.6 | 0.0069 | None reported | |
| High | CVE-2022-22745 | Mozilla Firefox ESR and 3 others: Exposure of Sensitive Information to an Unauthorized Actor | 9.6 | 0.0068 | None reported | |
| High | CVE-2022-22747 | Mozilla Firefox ESR and 3 others: Improper Certificate Validation | 9.6 | 0.0067 | None reported |
Showing 1 to 12 of 12
1