Mozilla developers and community members Nika Layzell, Andrew McCreight, Gabriele Svelto, and the Mozilla Fuzzing Team reported memory safety bugs present in Thunderbird 91.7. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Thunderbird < 91.8, Firefox < 99, and Firefox ESR < 91.8.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade thunderbirdUpgrade firefox | May 4, 2022 | Apr 11, 2022 |
| Alpine Linux | — | Upgrade firefoxUpgrade thunderbirdUpgrade librewolfUpgrade firefox-esr | Aug 22, 2024 | Dec 22, 2022 |
| Amazon Linux Ami 2 | — | Upgrade thunderbirdUpgrade thunderbird-debuginfo | Jul 4, 2022 | Jul 4, 2022 |
| Centos_linux | — | Upgrade firefoxUpgrade firefox-debugsourceUpgrade thunderbird-debugsourceUpgrade thunderbirdUpgrade thunderbird-debuginfoUpgrade firefox-debuginfo | Apr 11, 2022 | Apr 8, 2022 |
| Debian | — | Upgrade thunderbirdUpgrade firefox-esr | Apr 8, 2022 | Apr 8, 2022 |
| Gentoo Linux | — | Upgrade mail-client/thunderbird-bin.Upgrade mail-client/thunderbird.Upgrade www-client/firefox-bin.Upgrade www-client/firefox. | Aug 11, 2022 | Aug 10, 2022 |
| Mfsa2022 13 | — | Upgrade to Mozilla Firefox version 99.0 | Apr 6, 2022 | Apr 5, 2022 |
| Mfsa2022 14 | — | Upgrade to Mozilla Firefox ESR version 91.8 | Apr 6, 2022 | Apr 5, 2022 |
| Mozilla Thunderbird | — | Upgrade to Mozilla Thunderbird version 91.8 | Apr 7, 2022 | Apr 5, 2022 |
| Oracle_linux | — | Upgrade firefoxUpgrade thunderbird | Apr 9, 2022 | Apr 5, 2022 |
| Redhat_linux | — | Upgrade thunderbird-debuginfoUpgrade firefoxNo solution existsUpgrade thunderbirdUpgrade firefox-debuginfoUpgrade thunderbird-debugsourceUpgrade firefox-debugsource | Apr 11, 2022 | Apr 8, 2022 |
| Rocky_linux | — | Upgrade firefox-debuginfoUpgrade firefoxUpgrade thunderbird-debuginfoUpgrade thunderbirdUpgrade thunderbird-debugsourceUpgrade firefox-debugsource | Mar 5, 2024 | Dec 22, 2022 |
| Suse | — | Upgrade MozillaFirefox-translations-commonUpgrade mozillafirefox-branding-upstreamUpgrade MozillaThunderbirdUpgrade MozillaFirefox-translations-otherUpgrade MozillaThunderbird-translations-commonUpgrade MozillaFirefox-develUpgrade MozillaFirefoxUpgrade MozillaThunderbird-translations-other | Oct 26, 2022 | Apr 7, 2022 |
| Ubuntu | — | Upgrade thunderbirdUpgrade firefox | Apr 8, 2022 | Apr 6, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub