The vulnerability of the Thunderbird email client arises from the lack of correlation between the date of the OpenPGP digital signature and the date of the electronic email. This allows attackers to perform spamming attacks.

🗓️ 04 Jul 2022 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 4 Views

Thunderbird vulnerability where Open PGP signature date does not match email date, enabling remote spamming.

Reporter	Title	Published	Views	Family All 96
ALT Linux	Security fix for the ALT Linux 10 package thunderbird version 102.0-alt1	29 Jun 202200:00	–	altlinux
Tenable Nessus	Amazon Linux 2 : thunderbird (ALAS-2022-1828)	21 Jul 202200:00	–	nessus
Tenable Nessus	AlmaLinux 9 : thunderbird (ALSA-2022:5482)	16 Nov 202200:00	–	nessus
Tenable Nessus	CentOS 7 : thunderbird (RHSA-2022:5480)	2 Aug 202200:00	–	nessus
Tenable Nessus	Debian DSA-5175-1 : thunderbird - security update	5 Jul 202200:00	–	nessus
Tenable Nessus	GLSA-202208-14 : Mozilla Thunderbird: Multiple Vulnerabilities	10 Aug 202200:00	–	nessus
Tenable Nessus	Mozilla Thunderbird < 91.11	1 Jul 202200:00	–	nessus
Tenable Nessus	MiracleLinux 8 : thunderbird-91.11.0-2.el8.ML.1 (AXSA:2022-3748:10)	20 Jan 202600:00	–	nessus
Tenable Nessus	MiracleLinux 9 : thunderbird-91.11.0-2.el9.ML.1 (AXSA:2022-4028:19)	20 Jan 202600:00	–	nessus
Tenable Nessus	Mozilla Thunderbird < 91.11	1 Jul 202200:00	–	nessus

Vulners

Node

mozilla thunderbirdRange<102

OR

mozilla thunderbirdRange<91.11

OR

red_hat red_hat_enterprise_linuxMatch6

OR

red_hat red_hat_enterprise_linuxMatch7

OR

red_hat red_hat_enterprise_linuxMatch9

Source	Link
mozilla	www.mozilla.org/en-US/security/advisories/mfsa2022-26/
security-tracker	www.security-tracker.debian.org/tracker/CVE-2022-2226
access	www.access.redhat.com/security/cve/CVE-2022-2226
xn--80ahaefyxhn	www.xn--80ahaefyxhn.xn--j1afgaq.xn--p1ai/bin/view/%D0%9E%D0%A1%D0%BD%D0%BE%D0%B2%D0%B0/%D0%9E%D0%B1%D0%BD%D0%BE%D0%B2%D0%BB%D0%B5%D0%BD%D0%B8%D1%8F/2.5.1/
xn--80ahaefyxhn	www.xn--80ahaefyxhn.xn--j1afgaq.xn--p1ai/bin/view/%D0%9E%D0%A1%D0%BD%D0%BE%D0%B2%D0%B0/%D0%9E%D0%B1%D0%BD%D0%BE%D0%B2%D0%BB%D0%B5%D0%BD%D0%B8%D1%8F/2.6/
altsp	www.altsp.su/obnovleniya-bezopasnosti/
strelets	www.strelets.net/patchi-i-obnovleniya-bezopasnosti

21 Nov 2023 00:00Current

6.8Medium risk

Vulners AI Score6.8

CVSS 36.1

CVSS 26.4

EPSS0.00409

Thunderbird Open PGP signature email date signature date spamming attack remote attacker