Oracle Linux 9 : thunderbird (ELSA-2022-7178)

The remote Oracle Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2022-7178 advisory. 102.4.0-1 - Update to 102.4.0 build1 Tenable has extracted the preceding description block directly from the Oracle Linux security advisory. Note that...

Oracle Linux 7 : thunderbird (ELSA-2022-7184)

The remote Oracle Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2022-7184 advisory. - Fix for expat CVE-2022-40674 Tenable has extracted the preceding description block directly from the Oracle Linux security advisory. Note that Nessus...

matrix-react-sdk (>=3.48.0-rc.1, <=3.55.0) potentially affected by CVE-2022-39250 via matrix-js-sdk (>=19.0.0-rc.1, <=19.6.0)

matrix-js-sdk NPM version =19.0.0-rc.1, =3.48.0-rc.1, =3.55.0 Source cves: CVE-2022-39250 Source advisory: GHSA-5W8R-8PGJ-5JMF...

matrix-react-sdk (>=3.48.0-rc.1, <=3.55.0) potentially affected by CVE-2022-39250 via matrix-js-sdk (>=19.0.0-rc.1, <=19.6.0)

matrix-js-sdk NPM version =19.0.0-rc.1, =3.48.0-rc.1, =3.55.0 Source cves: CVE-2022-39250 Source advisory: OSV:GHSA-5W8R-8PGJ-5JMF...

Authentication Bypass

matrix-js-sdk is vulnerable to authentication bypass. A malicious server admin is able to break emoji-based verification when cross-signing is in use, authenticating themselves instead of the target user being verified. The vulnerability is possible because the library confuses device IDs and...

matrix-react-sdk (>=3.48.0-rc.1, <=3.55.0) potentially affected by CVE-2022-39251 via matrix-js-sdk (>=19.0.0-rc.1, <=19.6.0)

matrix-js-sdk NPM version =19.0.0-rc.1, =3.48.0-rc.1, =3.55.0 Source cves: CVE-2022-39251 Source advisory: GHSA-R48R-J8FX-MQ2C...

matrix-react-sdk (>=3.48.0-rc.1, <=3.55.0) potentially affected by CVE-2022-39251 via matrix-js-sdk (>=19.0.0-rc.1, <=19.6.0)

matrix-js-sdk NPM version =19.0.0-rc.1, =3.48.0-rc.1, =3.55.0 Source cves: CVE-2022-39251 Source advisory: OSV:GHSA-R48R-J8FX-MQ2C...

matrix-react-sdk (>=3.48.0-rc.1, <=3.55.0) potentially affected by CVE-2022-39249 via matrix-js-sdk (>=19.0.0-rc.1, <=19.6.0)

matrix-js-sdk NPM version =19.0.0-rc.1, =3.48.0-rc.1, =3.55.0 Source cves: CVE-2022-39249 Source advisory: GHSA-6263-X97C-C4GG...

matrix-react-sdk (>=3.48.0-rc.1, <=3.55.0) potentially affected by CVE-2022-39249 via matrix-js-sdk (>=19.0.0-rc.1, <=19.6.0)

matrix-js-sdk NPM version =19.0.0-rc.1, =3.48.0-rc.1, =3.55.0 Source cves: CVE-2022-39249 Source advisory: OSV:GHSA-6263-X97C-C4GG...

@syncpoint/odrix (>=1.2.0, <=1.3.4), matrix-react-sdk (>=3.48.0-rc.1, <=3.55.0) +1 more potentially affected by CVE-2022-39236 via matrix-js-sdk (>=17.2.0, <=19.6.0)

matrix-js-sdk NPM version =17.2.0, =1.2.0, =3.48.0-rc.1, =2.2.0, =3.1.0 Source cves: CVE-2022-39236 Source advisory: OSV:GHSA-HVV8-5V86-R45X...

@syncpoint/odrix (>=1.2.0, <=1.3.4), matrix-react-sdk (>=3.48.0-rc.1, <=3.55.0) +1 more potentially affected by CVE-2022-39236 via matrix-js-sdk (>=17.2.0, <=19.6.0)

matrix-js-sdk NPM version =17.2.0, =1.2.0, =3.48.0-rc.1, =2.2.0, =3.1.0 Source cves: CVE-2022-39236 Source advisory: GHSA-HVV8-5V86-R45X...

Improper beacon events in matrix-js-sdk can result in availability issues

Impact Improperly formed beacon events from MSC3488 can disrupt or impede the matrix-js-sdk from functioning properly, potentially impacting the consumer's ability to process data safely. Note that the matrix-js-sdk can appear to be operating normally but be excluding or corrupting runtime data...

GHSA-HVV8-5V86-R45X Improper beacon events in matrix-js-sdk can result in availability issues

Impact Improperly formed beacon events from MSC3488 can disrupt or impede the matrix-js-sdk from functioning properly, potentially impacting the consumer's ability to process data safely. Note that the matrix-js-sdk can appear to be operating normally but be excluding or corrupting runtime data...

Denial Of Service (DoS)

matrix-js-sdk is vulnerable to denial of service attacks. The vulnerability exists in the senderKey parameter inmegolm.js due to improperly formed beacon events which allows an attacker to craft a malicious event and crash the system...

@airgap/beacon-sdk (>=0.0.1-beta.0, <=0.3.0), @caelum-tech/lorena-matrix-client (>=1.3.0, <=2.1.2) +53 more potentially affected by CVE-2022-39250 via matrix-js-sdk (>=0.0.4, <=19.6.0)

matrix-js-sdk NPM version =0.0.4, =0.0.1-beta.0, =1.3.0, =1.0.0, =2.5.0, =0.0.1, =0.0.14, =0.0.1, =2.10.1, =4.0.1, =1.2.0, =6.3.0-wallet.0, =0.1.14, =0.1.18, =0.2.4 and more Source cves: CVE-2022-39250 Source advisory: MEND:CVE-2022-39250...

CVE-2022-39250

Removed by vendor...

@airgap/beacon-sdk (>=0.0.1-beta.0, <=0.3.0), @caelum-tech/lorena-matrix-client (>=1.3.0, <=2.1.2) +53 more potentially affected by CVE-2022-39249 via matrix-js-sdk (>=0.0.4, <=19.6.0)

matrix-js-sdk NPM version =0.0.4, =0.0.1-beta.0, =1.3.0, =1.0.0, =2.5.0, =0.0.1, =0.0.14, =0.0.1, =2.10.1, =4.0.1, =1.2.0, =6.3.0-wallet.0, =0.1.14, =0.1.18, =0.2.4 and more Source cves: CVE-2022-39249 Source advisory: MEND:CVE-2022-39249...

CVE-2022-39236: Improper Input Validation

Matrix Javascript SDK is the Matrix Client-Server SDK for JavaScript. Starting with version 17.1.0-rc.1, improperly formed beacon events can disrupt or impede the matrix-js-sdk from functioning properly, potentially impacting the consumer's ability to process data safely. Note that the...

@syncpoint/odrix (>=1.2.0, <=1.3.4), matrix-react-sdk (>=3.48.0-rc.1, <=3.55.0) +1 more potentially affected by CVE-2022-39236 via matrix-js-sdk (>=17.2.0, <=19.6.0)

matrix-js-sdk NPM version =17.2.0, =1.2.0, =3.48.0-rc.1, =2.2.0, =3.1.0 Source cves: CVE-2022-39236 Source advisory: MEND:CVE-2022-39236...

CVE-2022-39249: Key Exchange without Entity Authentication

Matrix Javascript SDK is the Matrix Client-Server SDK for JavaScript. Prior to version 19.7.0, an attacker cooperating with a malicious homeserver can construct messages appearing to have come from another person. Such messages will be marked with a grey shield on some platforms, but this may be...