DeutschIn der Originalsprache angezeigt — eine vollständige Übersetzung ist für eine zukünftige Version geplant.
Mozilla Thunderbird: Mehrere Schwachstellen
Advisory ansehen veröffentlicht 2022-05-04
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Mozilla Thunderbird ausnutzen, um Sicherheitsvorkehrungen zu umgehen, vertrauliche Informationen offenzulegen und beliebigen Code auszuführen.
01
beschreibt (8)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2022-29917US | critical9.8 | — | ||
Mozilla developers Andrew McCreight, Gabriele Svelto, Tom Ritter and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 99 and Firefox ESR 91.8. Some of these… | ||||
| CVE-2022-29916US | medium6.5 | — | ||
Firefox behaved slightly differently for already known resources when loading CSS resources involving CSS variables. This could have been used to probe the browser history. This vu… | ||||
| CVE-2022-29914US | medium6.5 | — | ||
When reusing existing popups Firefox would have allowed them to cover the fullscreen notification UI, which could have enabled browser spoofing attacks. This vulnerability affects… | ||||
| CVE-2022-29913US | medium6.5 | — | ||
The parent process would not properly check whether the Speech Synthesis feature is enabled, when receiving instructions from a child process. This vulnerability affects Thunderbir… | ||||
| CVE-2022-29912US | medium6.1 | — | ||
Requests initiated through reader mode did not properly omit cookies with a SameSite attribute. This vulnerability affects Thunderbird < 91.9, Firefox ESR < 91.9, and Firefox < 100… | ||||
| CVE-2022-29911US | medium6.1 | — | ||
An improper implementation of the new iframe sandbox keyword <code>allow-top-navigation-by-user-activation</code> could lead to script execution without <code>allow-scripts</code>… | ||||
| CVE-2022-29909US | high8.8OT erhöht | — | ||
Documents in deeply-nested cross-origin browsing contexts could have obtained permissions granted to the top-level origin, bypassing the existing prompt and wrongfully inheriting t… | ||||
| CVE-2022-1520US | medium4.3 | — | ||
When viewing an email message A, which contains an attached message B, where B is encrypted or digitally signed or both, Thunderbird may show an incorrect encryption or signature s… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- Oracle Linux Security Advisory ELSA-2022-1725 vom 2022-05-06external
- Oracle Linux Security Advisory ELSA-2022-1730 vom 2022-05-06external
- Oracle Linux Security Advisory ELSA-2022-4589 vom 2022-07-01external
- Mozilla Foundation Security Advisory vom 2022-05-04external
- Red Hat Security Advisory RHSA-2022:1724 vom 2022-05-05external
- Red Hat Security Advisory RHSA-2022:1725 vom 2022-05-05external
- Red Hat Security Advisory RHSA-2022:1726 vom 2022-05-05external
- Red Hat Security Advisory RHSA-2022:1727 vom 2022-05-05external
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan