Important: thunderbird

Issue Overview:

A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes the issue of when receiving an HTML email that contained an iframe element, which used a srcdoc attribute to define the internal HTML document, remote objects specified in the nested document (for example, images or videos), were not blocked. Rather, the network was accessed, and the objects were loaded and displayed. (CVE-2022-3032)

A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes the issue of a Thunderbird user replying to a crafted HTML email containing a meta tag, with the meta tag having the http-equiv=‘refresh’ attribute and the content attribute specifying an URL. Thunderbird started a network request to that URL, regardless of the configuration, to block remote content. In combination with certain other HTML elements and attributes in the email, it was possible to execute JavaScript code included in the message in the context of the message compose document. The JavaScript code was able to perform actions including, but probably not limited to, reading and modifying the contents of the message compose document, including the quoted original message, which could potentially contain the decrypted plaintext of encrypted data in the crafted email. The contents could then be transmitted to the network, either to the URL specified in the META refresh tag or to a different URL, as the JavaScript code could modify the URL specified in the document. This bug doesn’t affect users who have changed the default Message Body display setting to ‘simple html’ or ‘plain text.’ (CVE-2022-3033)

A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes the issue of sending a request to the remote document when receiving an HTML email that specified to load an iframe element from a remote location. However, Thunderbird didn’t display the document. (CVE-2022-3034)

A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes the issue of Thunderbird users who use the Matrix chat protocol being vulnerable to a denial of service attack. An adversary sharing a room with a user could attack affected clients, making it not show all of a user’s rooms or spaces and causing minor temporary corruption. (CVE-2022-36059)

A flaw was found in Mozilla. According to the Mozilla Foundation Security Advisory, Thunderbird users who use the Matrix chat protocol are vulnerable to a data corruption issue. An attacker could potentially cause data integrity issues by sending specially crafted messages. (CVE-2022-39236)

A flaw was found in Mozilla. According to the Mozilla Foundation Security Advisory, Thunderbird users who use the Matrix chat protocol are vulnerable to an impersonation attack. A malicious server administrator could fake encrypted messages to look as if they were sent from another user on that server. (CVE-2022-39249)

A flaw was found in Mozilla. According to the Mozilla Foundation Security Advisory, Thunderbird users who use the Matrix chat protocol are vulnerable to an impersonation attack. A malicious server administrator could interfere with cross-device verification to authenticate their own device. (CVE-2022-39250)

A flaw was found in Mozilla. According to the Mozilla Foundation Security Advisory, Thunderbird users who use the Matrix chat protocol are vulnerable to an impersonation attack. An attacker could spoof historical messages from other users, and use a malicious key backup to the user’s account under specific conditions in order to exfiltrate message keys. (CVE-2022-39251)

A vulnerability was found in expat. With this flaw, it is possible to create a situation in which parsing is suspended while substituting in an internal entity so that XML_ResumeParser directly uses the internalEntityProcessor as its processor. If the subsequent parse includes some unclosed tags, this will return without calling storeRawNames to ensure that the raw versions of the tag names are stored in memory other than the parse buffer itself. Issues occur if the parse buffer is changed or reallocated (for example, if processing a file line by line), problems occur. Using this vulnerability in the doContent function allows an attacker to triage a denial of service or potentially arbitrary code execution. (CVE-2022-40674)

A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes the issue that when injecting an HTML base element; some requests would ignore the CSP’s base-uri settings and accept the injected element’s base instead. (CVE-2022-40956)

A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes the issue of inconsistent data in the instruction and data cache when creating wasm code, which could lead to a potentially exploitable
crash. (CVE-2022-40957)

A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes the issue that by injecting a cookie with certain special characters, an attacker on a shared subdomain, which is not a secure context,
could set and overwrite cookies from a secure context, leading to session fixation and other attacks. (CVE-2022-40958)

A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes the issue that certain pages did not have their FeaturePolicy fully initialized during iframe navigation, leading to a bypass that leak
ed device permissions into untrusted subdocuments. (CVE-2022-40959)

A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes the issue that concurrent use of the URL parser with non-UTF-8 data was not thread-safe, leading to a use-after-free problem and causin
g a potentially exploitable crash. (CVE-2022-40960)

A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes the issue of Mozilla developers Nika Layzell, Timothy Nikkel, Jeff Muizelaar, Sebastian Hengst, Andreas Pehrson, and the Mozilla Fuzzin
g Team reporting memory safety bugs present in Firefox 104 and Firefox ESR 102.2. Some of these bugs showed evidence of memory corruption and the presumption that with enough effort, some have been exploited to run arbitrary code. (CVE-2022-40962)

No description is available for this CVE. (CVE-2022-42927)

No description is available for this CVE. (CVE-2022-42928)

A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes the issue of a website called window.print() causing a denial of service of the browser, which may persist beyond browser restart depending on the user’s session restore settings. (CVE-2022-42929)

A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes the issue of Mozilla developers Ashley Hale and the Mozilla Fuzzing Team, reporting memory safety bugs present in Firefox 105 and Firefox ESR 102.3. Some of these bugs showed evidence of memory corruption and, with enough effort, exploited to run arbitrary code. (CVE-2022-42932)

Affected Packages:

thunderbird

Note:

This advisory is applicable to Amazon Linux 2 (AL2) Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras advisories.

Issue Correction:
Run yum update thunderbird to update your system.

New Packages:

aarch64:  
    thunderbird-102.4.0-1.amzn2.0.1.aarch64  
    thunderbird-debuginfo-102.4.0-1.amzn2.0.1.aarch64  
  
src:  
    thunderbird-102.4.0-1.amzn2.0.1.src  
  
x86_64:  
    thunderbird-102.4.0-1.amzn2.0.1.x86_64  
    thunderbird-debuginfo-102.4.0-1.amzn2.0.1.x86_64  

Additional References

Red Hat: CVE-2022-3032, CVE-2022-3033, CVE-2022-3034, CVE-2022-36059, CVE-2022-39236, CVE-2022-39249, CVE-2022-39250, CVE-2022-39251, CVE-2022-40674, CVE-2022-40956, CVE-2022-40957, CVE-2022-40958, CVE-2022-40959, CVE-2022-40960, CVE-2022-40962, CVE-2022-42927, CVE-2022-42928, CVE-2022-42929, CVE-2022-42932

Mitre: CVE-2022-3032, CVE-2022-3033, CVE-2022-3034, CVE-2022-36059, CVE-2022-39236, CVE-2022-39249, CVE-2022-39250, CVE-2022-39251, CVE-2022-40674, CVE-2022-40956, CVE-2022-40957, CVE-2022-40958, CVE-2022-40959, CVE-2022-40960, CVE-2022-40962, CVE-2022-42927, CVE-2022-42928, CVE-2022-42929, CVE-2022-42932