RHSA-2022:1301: Red Hat Security Advisory: thunderbird security update

Skip to navigation Skip to main content

Utilities

• Subscriptions
• Downloads
• Containers
• Support Cases

Infrastructure and Management

• Red Hat Enterprise Linux
• Red Hat Virtualization
• Red Hat Identity Management
• Red Hat Directory Server
• Red Hat Certificate System
• Red Hat Satellite
• Red Hat Subscription Management
• Red Hat Update Infrastructure
• Red Hat Insights
• Red Hat Ansible Automation Platform

Cloud Computing

• Red Hat OpenShift
• Red Hat CloudForms
• Red Hat OpenStack Platform
• Red Hat OpenShift Container Platform
• Red Hat OpenShift Data Science
• Red Hat OpenShift Online
• Red Hat OpenShift Dedicated
• Red Hat Advanced Cluster Security for Kubernetes
• Red Hat Advanced Cluster Management for Kubernetes
• Red Hat Quay
• Red Hat CodeReady Workspaces
• Red Hat OpenShift Service on AWS

Storage

• Red Hat Gluster Storage
• Red Hat Hyperconverged Infrastructure
• Red Hat Ceph Storage
• Red Hat OpenShift Data Foundation

Runtimes

• Red Hat Runtimes
• Red Hat JBoss Enterprise Application Platform
• Red Hat Data Grid
• Red Hat JBoss Web Server
• Red Hat Single Sign On
• Red Hat support for Spring Boot
• Red Hat build of Node.js
• Red Hat build of Thorntail
• Red Hat build of Eclipse Vert.x
• Red Hat build of OpenJDK
• Red Hat build of Quarkus

Integration and Automation

• Red Hat Process Automation
• Red Hat Process Automation Manager
• Red Hat Decision Manager

All Products

Issued:

2022-04-11

Updated:

2022-04-11

RHSA-2022:1301 - Security Advisory

• Overview
• Updated Packages

Synopsis

Important: thunderbird security update

Type/Severity

Security Advisory: Important

Red Hat Insights patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

An update for thunderbird is now available for Red Hat Enterprise Linux 8.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Mozilla Thunderbird is a standalone mail and newsgroup client.

This update upgrades Thunderbird to version 91.8.0.

Security Fix(es):

• Mozilla: Use-after-free in NSSToken objects (CVE-2022-1097)
• Mozilla: Out of bounds write due to unexpected WebAuthN Extensions (CVE-2022-28281)
• Mozilla: Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8 (CVE-2022-28289)
• Mozilla: Use-after-free after VR Process destruction (CVE-2022-1196)
• Mozilla: OpenPGP revocation information was ignored (CVE-2022-1197)
• Mozilla: Use-after-free in DocumentL10n::TranslateDocument (CVE-2022-28282)
• Mozilla: Incorrect AliasSet used in JIT Codegen (CVE-2022-28285)
• Mozilla: Denial of Service via complex regular expressions (CVE-2022-24713)
• Mozilla: iframe contents could be rendered outside the border (CVE-2022-28286)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

All running instances of Thunderbird must be restarted for the update to take effect.

Affected Products

• Red Hat Enterprise Linux for x86_64 8 x86_64
• Red Hat Enterprise Linux for IBM z Systems 8 s390x
• Red Hat Enterprise Linux for Power, little endian 8 ppc64le
• Red Hat Enterprise Linux for ARM 64 8 aarch64

Fixes

• BZ - 2072559 - CVE-2022-1097 Mozilla: Use-after-free in NSSToken objects
• BZ - 2072560 - CVE-2022-28281 Mozilla: Out of bounds write due to unexpected WebAuthN Extensions
• BZ - 2072561 - CVE-2022-1196 Mozilla: Use-after-free after VR Process destruction
• BZ - 2072562 - CVE-2022-28282 Mozilla: Use-after-free in DocumentL10n::TranslateDocument
• BZ - 2072563 - CVE-2022-28285 Mozilla: Incorrect AliasSet used in JIT Codegen
• BZ - 2072564 - CVE-2022-28286 Mozilla: iframe contents could be rendered outside the border
• BZ - 2072565 - CVE-2022-24713 Mozilla: Denial of Service via complex regular expressions
• BZ - 2072566 - CVE-2022-28289 Mozilla: Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8
• BZ - 2072963 - CVE-2022-1197 Mozilla: OpenPGP revocation information was ignored

CVEs

• CVE-2022-1097
• CVE-2022-1196
• CVE-2022-1197
• CVE-2022-24713
• CVE-2022-28281
• CVE-2022-28282
• CVE-2022-28285
• CVE-2022-28286
• CVE-2022-28289

Red Hat Enterprise Linux for x86_64 8

SRPM

thunderbird-91.8.0-1.el8_5.src.rpm

SHA-256: f48af225d135e55a10f7209501c0a11c941898c289e0f3afc5dc38c08315d9b5

x86_64

thunderbird-91.8.0-1.el8_5.x86_64.rpm

SHA-256: 232dcc4770a3c2da33146eee6aa536c29bc49d9d8947ab797105846d1ddfddbc

thunderbird-debuginfo-91.8.0-1.el8_5.x86_64.rpm

SHA-256: b4afc1501c96b138a0eaff059b8756bf22a219402ef1726b233922eb4c0206b9

thunderbird-debugsource-91.8.0-1.el8_5.x86_64.rpm

SHA-256: fa3432850e03ea0f6bf8ffad6636ff3e78cf41c92fb75f6f36735fb0177080f6

Red Hat Enterprise Linux for IBM z Systems 8

SRPM

thunderbird-91.8.0-1.el8_5.src.rpm

SHA-256: f48af225d135e55a10f7209501c0a11c941898c289e0f3afc5dc38c08315d9b5

s390x

thunderbird-91.8.0-1.el8_5.s390x.rpm

SHA-256: 849447d8215b7c72f8e107c196e0a3d4f2de6c535ade7d3d256fd6d7e9d8925b

thunderbird-debuginfo-91.8.0-1.el8_5.s390x.rpm

SHA-256: 6e99e85468c4fa18ca89882649d91b150bbfad3db3defd2102b735e40a7b4794

thunderbird-debugsource-91.8.0-1.el8_5.s390x.rpm

SHA-256: 86bb64782912a84a9744a32748bdaed21445c94158d2ed49cefce17f7c29021e

Red Hat Enterprise Linux for Power, little endian 8

SRPM

thunderbird-91.8.0-1.el8_5.src.rpm

SHA-256: f48af225d135e55a10f7209501c0a11c941898c289e0f3afc5dc38c08315d9b5

ppc64le

thunderbird-91.8.0-1.el8_5.ppc64le.rpm

SHA-256: bfa245e356ce0517378772a414ccf4bcc5c3dc15d9bef6775bfc5f4d8baa6ed0

thunderbird-debuginfo-91.8.0-1.el8_5.ppc64le.rpm

SHA-256: c954b672e8fe9f9c58c998b34e601f12683cbdf374057378fb0400e0ab81916d

thunderbird-debugsource-91.8.0-1.el8_5.ppc64le.rpm

SHA-256: 99a979e33d9a466abaa0b5651d29a5e07bdd55c2d375b73613652d9902a452ea

Red Hat Enterprise Linux for ARM 64 8

SRPM

thunderbird-91.8.0-1.el8_5.src.rpm

SHA-256: f48af225d135e55a10f7209501c0a11c941898c289e0f3afc5dc38c08315d9b5

aarch64

thunderbird-91.8.0-1.el8_5.aarch64.rpm

SHA-256: fe7321294bf5d11f0d18b84df5bb8291f71d8f0bbdbe6cceb0939c8917b33de0

thunderbird-debuginfo-91.8.0-1.el8_5.aarch64.rpm

SHA-256: 4ea4d21c0842db25440d0317e73f22e04106e5bab11cdb92de30f3b3426885f0

thunderbird-debugsource-91.8.0-1.el8_5.aarch64.rpm

SHA-256: fe4ae8b2b1858d193276652be2daaa57b11d0ee703db3a2c30311a84219fc7f2

The Red Hat security contact is [email protected]. More contact details at https://access.redhat.com/security/team/contact/.