CVE-2022-1197

When importing a revoked key that specified key compromise as the revocation reason, Thunderbird did not update the existing copy of the key that was not yet revoked, and the existing key was kept as non-revoked. Revocation statements that used another revocation reason, or that didn't specify a revocation reason, were unaffected. This vulnerability affects Thunderbird < 91.8.

Mozilla Thunderbird is a standalone mail and newsgroup client.

This update upgrades Thunderbird to version 91.8.0.

Security Fix(es):

• Mozilla: Use-after-free in NSSToken objects (CVE-2022-1097)

• Mozilla: Out of bounds write due to unexpected WebAuthN Extensions (CVE-2022-28281)

• Mozilla: Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8 (CVE-2022-28289)

• Mozilla: Use-after-free after VR Process destruction (CVE-2022-1196)

• Mozilla: OpenPGP revocation information was ignored (CVE-2022-1197)

• Mozilla: Use-after-free in DocumentL10n::TranslateDocument (CVE-2022-28282)

• Mozilla: Incorrect AliasSet used in JIT Codegen (CVE-2022-28285)

• Mozilla: Denial of Service via complex regular expressions (CVE-2022-24713)

• Mozilla: iframe contents could be rendered outside the border (CVE-2022-28286)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

When importing a revoked key that specified key compromise as the revocation reason, Thunderbird did not update the existing copy of the key that was not yet revoked, and the existing key was kept as non-revoked. Revocation statements that used another revocation reason, or that didn't specify a revocation reason, were unaffected. This vulnerability affects Thunderbird < 91.8.

Mozilla Thunderbird is a standalone mail and newsgroup client.

This update upgrades Thunderbird to version 91.8.0.

Security Fix(es):

• Mozilla: Use-after-free in NSSToken objects (CVE-2022-1097)

• Mozilla: Out of bounds write due to unexpected WebAuthN Extensions (CVE-2022-28281)

• Mozilla: Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8 (CVE-2022-28289)

• Mozilla: Use-after-free after VR Process destruction (CVE-2022-1196)

• Mozilla: OpenPGP revocation information was ignored (CVE-2022-1197)

• Mozilla: Use-after-free in DocumentL10n::TranslateDocument (CVE-2022-28282)

• Mozilla: Incorrect AliasSet used in JIT Codegen (CVE-2022-28285)

• Mozilla: Denial of Service via complex regular expressions (CVE-2022-24713)

• Mozilla: iframe contents could be rendered outside the border (CVE-2022-28286)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The updated thunderbird packages fix security vulnerabilities:

Use-after-free in NSSToken objects (CVE-2022-1097).

Use-after-free after VR Process destruction (CVE-2022-1196).

OpenPGP revocation information was ignored (CVE-2022-1197).

Denial of Service via complex regular expressions (CVE-2022-24713).

xmltok_impl.c in Expat (aka libexpat) before 2.4.5 lacks certain validation of encoding, such as checks for whether a UTF-8 character is valid in a certain context (CVE-2022-25235).

xmlparse.c in Expat (aka libexpat) before 2.4.5 allows attackers to insert namespace-separator characters into namespace URIs (CVE-2022-25236).

In Expat (aka libexpat) before 2.4.5, there is an integer overflow in storeRawNames (CVE-2022-25315).

Out of bounds write due to unexpected WebAuthN Extensions (CVE-2022-28281).

Use-after-free in DocumentL10n::TranslateDocument (CVE-2022-28282).

Incorrect AliasSet used in JIT Codegen (CVE-2022-28285).

iframe contents could be rendered outside the border (CVE-2022-28286).

Memory safety bugs fixed in Thunderbird 91.8 (CVE-2022-28289).

This update for MozillaThunderbird fixes the following issues:

• Updated to version 91.8 (bsc#1197903):
  • CVE-2022-1097: Fixed a memory corruption issue with NSSToken objects.
  • CVE-2022-28281: Fixed a memory corruption issue due to unexpected WebAuthN Extensions.
  • CVE-2022-1197: Fixed an issue where OpenPGP revocation information was ignored.
  • CVE-2022-1196: Fixed a memory corruption issue after VR process destruction.
  • CVE-2022-28282: Fixed a memory corruption issue in document translation.
  • CVE-2022-28285: Fixed a memory corruption issue in JIT code generation.
  • CVE-2022-28286: Fixed an iframe layout issue that could have been exploited to stage spoofing attacks.
  • CVE-2022-24713: Fixed a potential denial of service via complex regular expressions.
  • CVE-2022-28289: Fixed multiple memory corruption issues.

Non-security fixes:

• Changed Google accounts using password authentication to use OAuth2.
• Fixed an issue where OpenPGP ECC keys created by Thunderbird could not be imported into GnuPG.
• Fixed an issue where exporting multiple public PGP keys from Thunderbird was not possible.
• Fixed an issue where replying to a newsgroup message erroneously displayed a 'No-reply' popup warning.
• Fixed an issue with opening older address books.
• Fixed an issue where LDAP directories would be lost when switching to 'Offline' mode.
• Fixed an issue when importing webcals.

Multiple security issues were discovered in Thunderbird. If a user were tricked into opening a specially crafted website in a browsing context, an attacker could potentially exploit these to cause a denial of service, conduct spoofing attacks, or execute arbitrary code. (CVE-2022-1097, CVE-2022-1196, CVE-2022-28281, CVE-2022-28282, CVE-2022-28285, CVE-2022-28286, CVE-2022-28289)

It was discovered that Thunderbird ignored OpenPGP revocation when importing a revoked key in some circumstances. An attacker could potentially exploit this by tricking the user into trusting the authenticity of a message or tricking them into use a revoked key to send an encrypted message. (CVE-2022-1197)