openSUSE-SU-2022:0559-1

    Dashboard / Vulnerabilities / openSUSE-SU-2022:0559-1

    openSUSE-SU-2022:0559-1

    Published: 23 Feb 2022Last Modified: 4 Feb 2026

    Summary: Security update for MozillaThunderbird

    Details: This update for MozillaThunderbird fixes the following issues: - Mozilla Thunderbird 91.6.1 / MFSA 2022-07 (bsc#1196072) * CVE-2022-0566 (bmo#1753094) Crafted email could trigger an out-of-bounds write - Mozilla Thunderbird 91.6 / MFSA 2022-06 (bsc#1195682) * CVE-2022-22753 (bmo#1732435) Privilege Escalation to SYSTEM on Windows via Maintenance Service * CVE-2022-22754 (bmo#1750565) Extensions could have bypassed permission confirmation during update * CVE-2022-22756 (bmo#1317873) Drag and dropping an image could have resulted in the dropped object being an executable * CVE-2022-22759 (bmo#1739957) Sandboxed iframes could have executed script if the parent appended elements * CVE-2022-22760 (bmo#1740985, bmo#1748503) Cross-Origin responses could be distinguished between script and non-script content-types * CVE-2022-22761 (bmo#1745566) frame-ancestors Content Security Policy directive was not enforced for framed extension pages * CVE-2022-22763 (bmo#1740534) Script Execution during invalid object state * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545, bmo#1748210, bmo#1748279) Memory safety bugs fixed in Thunderbird 91.6

    References: https://lists.opensuse.org/archives/list/[email protected]/thread/GSM3MOVKIHQAE33NLCNX7MUULCOLEADF/, https://bugzilla.suse.com/1195682, https://bugzilla.suse.com/1196072, https://www.suse.com/security/cve/CVE-2022-0566, https://www.suse.com/security/cve/CVE-2022-22753, https://www.suse.com/security/cve/CVE-2022-22754, https://www.suse.com/security/cve/CVE-2022-22756, https://www.suse.com/security/cve/CVE-2022-22759, https://www.suse.com/security/cve/CVE-2022-22760, https://www.suse.com/security/cve/CVE-2022-22761, https://www.suse.com/security/cve/CVE-2022-22763, https://www.suse.com/security/cve/CVE-2022-22764

    Affected packages

    Package

    Name: MozillaThunderbird

    Purl: pkg:rpm/opensuse/MozillaThunderbird&distro=openSUSE%20Leap%2015.3

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -91.6.1-8.54.1

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    openSUSE-SU-2022:0559-1 | CVE-DB