CVE-2022-0566

It may be possible for an attacker to craft an email message that causes Thunderbird to perform an out-of-bounds write of one byte when processing the message. This vulnerability affects Thunderbird < 91.6.1.

Mozilla Thunderbird is a standalone mail and newsgroup client.

This update upgrades Thunderbird to version 91.7.0.

Security Fix(es):

• Mozilla: Use-after-free in XSLT parameter processing (CVE-2022-26485)

• Mozilla: Use-after-free in WebGPU IPC Framework (CVE-2022-26486)

• expat: Malformed 2- and 3-byte UTF-8 sequences can lead to arbitrary code execution (CVE-2022-25235)

• expat: Namespace-separator characters in "xmlns[:prefix]" attribute values can lead to arbitrary code execution (CVE-2022-25236)

• expat: Integer overflow in storeRawNames() (CVE-2022-25315)

• Mozilla: Use-after-free in text reflows (CVE-2022-26381)

• Mozilla: Browser window spoof using fullscreen mode (CVE-2022-26383)

• Mozilla: iframe allow-scripts sandbox bypass (CVE-2022-26384)

• Mozilla: Time-of-check time-of-use bug when verifying add-on signatures (CVE-2022-26387)

• thunderbird: Crafted email could trigger an out-of-bounds write (CVE-2022-0566)

• Mozilla: Temporary files downloaded to /tmp and accessible by other local users (CVE-2022-26386)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

It may be possible for an attacker to craft an email message that causes Thunderbird to perform an out-of-bounds write of one byte when processing the message. This vulnerability affects Thunderbird < 91.6.1.

Mozilla Thunderbird is a standalone mail and newsgroup client.

This update upgrades Thunderbird to version 91.7.0.

Security Fix(es):

• Mozilla: Use-after-free in XSLT parameter processing (CVE-2022-26485)

• Mozilla: Use-after-free in WebGPU IPC Framework (CVE-2022-26486)

• expat: Malformed 2- and 3-byte UTF-8 sequences can lead to arbitrary code execution (CVE-2022-25235)

• expat: Namespace-separator characters in "xmlns[:prefix]" attribute values can lead to arbitrary code execution (CVE-2022-25236)

• expat: Integer overflow in storeRawNames() (CVE-2022-25315)

• Mozilla: Use-after-free in text reflows (CVE-2022-26381)

• Mozilla: Browser window spoof using fullscreen mode (CVE-2022-26383)

• Mozilla: iframe allow-scripts sandbox bypass (CVE-2022-26384)

• Mozilla: Time-of-check time-of-use bug when verifying add-on signatures (CVE-2022-26387)

• thunderbird: Crafted email could trigger an out-of-bounds write (CVE-2022-0566)

• Mozilla: Temporary files downloaded to /tmp and accessible by other local users (CVE-2022-26386)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Crafted email could trigger an out-of-bounds write. (CVE-2022-0566)

This update for MozillaThunderbird fixes the following issues:

• Mozilla Thunderbird 91.6.1 / MFSA 2022-07 (bsc#1196072)

  • CVE-2022-0566 (bmo#1753094) Crafted email could trigger an out-of-bounds write

• Mozilla Thunderbird 91.6 / MFSA 2022-06 (bsc#1195682)

  • CVE-2022-22753 (bmo#1732435) Privilege Escalation to SYSTEM on Windows via Maintenance Service
  • CVE-2022-22754 (bmo#1750565) Extensions could have bypassed permission confirmation during update
  • CVE-2022-22756 (bmo#1317873) Drag and dropping an image could have resulted in the dropped object being an executable
  • CVE-2022-22759 (bmo#1739957) Sandboxed iframes could have executed script if the parent appended elements
  • CVE-2022-22760 (bmo#1740985, bmo#1748503) Cross-Origin responses could be distinguished between script and non-script content-types
  • CVE-2022-22761 (bmo#1745566) frame-ancestors Content Security Policy directive was not enforced for framed extension pages
  • CVE-2022-22763 (bmo#1740534) Script Execution during invalid object state
  • CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545, bmo#1748210, bmo#1748279) Memory safety bugs fixed in Thunderbird 91.6

These are all security issues fixed in the MozillaThunderbird-91.6.1-1.1 package on the GA media of openSUSE Tumbleweed.

This update for MozillaThunderbird fixes the following issues:

• Mozilla Thunderbird 91.6.1 / MFSA 2022-07 (bsc#1196072)

  • CVE-2022-0566 (bmo#1753094) Crafted email could trigger an out-of-bounds write

• Mozilla Thunderbird 91.6 / MFSA 2022-06 (bsc#1195682)

  • CVE-2022-22753 (bmo#1732435) Privilege Escalation to SYSTEM on Windows via Maintenance Service
  • CVE-2022-22754 (bmo#1750565) Extensions could have bypassed permission confirmation during update
  • CVE-2022-22756 (bmo#1317873) Drag and dropping an image could have resulted in the dropped object being an executable
  • CVE-2022-22759 (bmo#1739957) Sandboxed iframes could have executed script if the parent appended elements
  • CVE-2022-22760 (bmo#1740985, bmo#1748503) Cross-Origin responses could be distinguished between script and non-script content-types
  • CVE-2022-22761 (bmo#1745566) frame-ancestors Content Security Policy directive was not enforced for framed extension pages
  • CVE-2022-22763 (bmo#1740534) Script Execution during invalid object state
  • CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545, bmo#1748210, bmo#1748279) Memory safety bugs fixed in Thunderbird 91.6

Multiple security issues were discovered in Thunderbird. If a user were tricked into opening a specially crafted website in a browsing context, an attacker could potentially exploit these to cause a denial of service, bypass security restrictions, obtain sensitive information, cause undefined behaviour, spoof the browser UI, or execute arbitrary code. (CVE-2022-22759, CVE-2022-22760, CVE-2022-22761, CVE-2022-22763, CVE-2022-22764, CVE-2022-26381, CVE-2022-26383, CVE-2022-26384)

It was discovered that extensions of a particular type could auto-update themselves and bypass the prompt that requests permissions. If a user were tricked into installing a specially crafted extension, an attacker could potentially exploit this to bypass security restrictions. (CVE-2022-22754)

It was discovered that dragging and dropping an image into a folder could result in it being marked as executable. If a user were tricked into dragging and dropping a specially crafted image, an attacker could potentially exploit this to execute arbitrary code. (CVE-2022-22756)

It was discovered that files downloaded to /tmp were accessible to other users. A local attacker could exploit this to obtain sensitive information. (CVE-2022-26386)

A TOCTOU bug was discovered when verifying addon signatures during install. A local attacker could potentially exploit this to trick a user into installing an addon with an invalid signature. (CVE-2022-26387)

An out-of-bounds write by one byte was discovered when processing messages in some circumstances. If a user were tricked into opening a specially crafted message, an attacker could potentially exploit this to cause a denial of service. (CVE-2022-0566)