Skip to content

CVE-2022-2226

An OpenPGP digital signature includes information about the date when the signature was created....

6.5 MediumFix available

An OpenPGP digital signature includes information about the date when the signature was created. When displaying an email that contains a digital signature, the email's date will be shown. If the dates were different, then Thunderbird didn't report the email as having an invalid signature. If an attacker performed a replay attack, in which an old email with old contents are resent at a later time, it could lead the victim to believe that the statements in the email are current. Fixed versions of Thunderbird will require that the signature's date roughly matches the displayed date of the email. This vulnerability affects Thunderbird < 102 and Thunderbird < 91.11.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: Required

What an attacker can affect

Confidentiality: None
Integrity: High
Availability: None

Exploit likelihood

0.44%Down 0.4 points since Dec 23, 2022

What each source reports

NVD Score used 6.5

An OpenPGP digital signature includes information about the date when the signature was created. When displaying an email that contains a digital signature, the email's date will be shown. If the dates were different, then Thunderbird didn't report the email as having an invalid signature. If an attacker performed a replay attack, in which an old email with old contents are resent at a later time, it could lead the victim to believe that the statements in the email are current. Fixed versions of Thunderbird will require that the signature's date roughly matches the displayed date of the email. This vulnerability affects Thunderbird < 102 and Thunderbird < 91.11.

Record: CVE-2022-2226
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Weakness: CWE-294
Updated: 2026-11-02

CVE List 6.5

An OpenPGP digital signature includes information about the date when the signature was created. When displaying an email that contains a digital signature, the email's date will be shown. If the dates were different, then Thunderbird didn't report the email as having an invalid signature. If an attacker performed a replay attack, in which an old email with old contents are resent at a later time, it could lead the victim to believe that the statements in the email are current. Fixed versions of Thunderbird will require that the signature's date roughly matches the displayed date of the email. This vulnerability affects Thunderbird < 102 and Thunderbird < 91.11.

Record: CVE-2022-2226
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Weakness: CWE-294
Updated: 2026-11-02

EUVDEUVD-2022-34506 6.5

An OpenPGP digital signature includes information about the date when the signature was created. When displaying an email that contains a digital signature, the email's date will be shown. If the dates were different, then Thunderbird didn't report the email as having an invalid signature. If an attacker performed a replay attack, in which an old email with old contents are resent at a later time, it could lead the victim to believe that the statements in the email are current. Fixed versions of Thunderbird will require that the signature's date roughly matches the displayed date of the email. This vulnerability affects Thunderbird < 102 and Thunderbird < 91.11.

Record: EUVD-2022-34506
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Updated: 2026-11-02

GitHub AdvisoriesGHSA-g426-wcxv-272f 6.5

An OpenPGP digital signature includes information about the date when the signature was created....

An OpenPGP digital signature includes information about the date when the signature was created. When displaying an email that contains a digital signature, the email's date will be shown. If the dates were different, then Thunderbird didn't report the email as having an invalid signature. If an attacker performed a replay attack, in which an old email with old contents are resent at a later time, it could lead the victim to believe that the statements in the email are current. Fixed versions of Thunderbird will require that the signature's date roughly matches the displayed date of the email. This vulnerability affects Thunderbird < 102 and Thunderbird < 91.11.

Record: GHSA-g426-wcxv-272f
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Weakness: CWE-294
Updated: 2026-11-02

OSVALPINE-CVE-2022-2226 6.5

An OpenPGP digital signature includes information about the date when the signature was created. When displaying an email that contains a digital signature, the email's date will be shown. If the dates were different, then Thunderbird didn't report the email as having an invalid signature. If an attacker performed a replay attack, in which an old email with old contents are resent at a later time, it could lead the victim to believe that the statements in the email are current. Fixed versions of Thunderbird will require that the signature's date roughly matches the displayed date of the email. This vulnerability affects Thunderbird < 102 and Thunderbird < 91.11.

Record: ALPINE-CVE-2022-2226
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Updated: 2026-11-03

OSV 6.5

An OpenPGP digital signature includes information about the date when the signature was created. When displaying an email that contains a digital signature, the email's date will be shown. If the dates were different, then Thunderbird didn't report the email as having an invalid signature. If an attacker performed a replay attack, in which an old email with old contents are resent at a later time, it could lead the victim to believe that the statements in the email are current. Fixed versions of Thunderbird will require that the signature's date roughly matches the displayed date of the email. This vulnerability affects Thunderbird < 102 and Thunderbird < 91.11.

Record: CVE-2022-2226
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Updated: 2026-11-02

Show 15 moreShow less

OSVDEBIAN-CVE-2022-2226 6.5

An OpenPGP digital signature includes information about the date when the signature was created. When displaying an email that contains a digital signature, the email's date will be shown. If the dates were different, then Thunderbird didn't report the email as having an invalid signature. If an attacker performed a replay attack, in which an old email with old contents are resent at a later time, it could lead the victim to believe that the statements in the email are current. Fixed versions of Thunderbird will require that the signature's date roughly matches the displayed date of the email. This vulnerability affects Thunderbird < 102 and Thunderbird < 91.11.

Record: DEBIAN-CVE-2022-2226
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Updated: 2026-11-03

OSVRHSA-2022:5470 9.8

Red Hat Security Advisory: thunderbird security update

Record: RHSA-2022:5470
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2022:5473 9.8

Red Hat Security Advisory: thunderbird security update

Record: RHSA-2022:5473
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2022:5475 9.8

Red Hat Security Advisory: thunderbird security update

Record: RHSA-2022:5475
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2022:5478 9.8

Red Hat Security Advisory: thunderbird security update

Record: RHSA-2022:5478
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2022:5480 9.8

Red Hat Security Advisory: thunderbird security update

Record: RHSA-2022:5480
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2022:5482 9.8

Red Hat Security Advisory: thunderbird security update

Record: RHSA-2022:5482
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRLSA-2022:5470 9.8

Important: thunderbird security update

Mozilla Thunderbird is a standalone mail and newsgroup client.

This update upgrades Thunderbird to version 91.11.

Security Fix(es):

Mozilla: CSP sandbox header without allow-scripts can be bypassed via retargeted javascript: URI (CVE-2022-34468)
Mozilla: Use-after-free in nsSHistory (CVE-2022-34470)
Mozilla: A popup window could be resized in a way to overlay the address bar with web content (CVE-2022-34479)
Mozilla: Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11 (CVE-2022-34484)
Mozilla: Undesired attributes could be set as part of prototype pollution (CVE-2022-2200)
Mozilla: An email with a mismatching OpenPGP signature date was accepted as valid (CVE-2022-2226)
Mozilla: CSP bypass enabling stylesheet injection (CVE-2022-31744)
Mozilla: Unavailable PAC file resulted in OCSP requests being blocked (CVE-2022-34472)
Mozilla: Potential integer overflow in ReplaceElementsAt (CVE-2022-34481)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: RLSA-2022:5470
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2022-2226 6.5

An OpenPGP digital signature includes information about the date when the signature was created. When displaying an email that contains a digital signature, the email's date will be shown. If the dates were different, then Thunderbird didn't report the email as having an invalid signature. If an attacker performed a replay attack, in which an old email with old contents are resent at a later time, it could lead the victim to believe that the statements in the email are current. Fixed versions of Thunderbird will require that the signature's date roughly matches the displayed date of the email. This vulnerability affects Thunderbird < 102 and Thunderbird < 91.11.

Record: UBUNTU-CVE-2022-2226
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Updated: 2026-11-02

OSVALSA-2022:5482 No score

Important: thunderbird security update

Mozilla Thunderbird is a standalone mail and newsgroup client. This update upgrades Thunderbird to version 91.11. Security Fix(es):

Mozilla: CSP sandbox header without allow-scripts can be bypassed via retargeted javascript: URI (CVE-2022-34468)
Mozilla: Use-after-free in nsSHistory (CVE-2022-34470)
Mozilla: A popup window could be resized in a way to overlay the address bar with web content (CVE-2022-34479)
Mozilla: Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11 (CVE-2022-34484)
Mozilla: Undesired attributes could be set as part of prototype pollution (CVE-2022-2200)
Mozilla: An email with a mismatching OpenPGP signature date was accepted as valid (CVE-2022-2226)
Mozilla: CSP bypass enabling stylesheet injection (CVE-2022-31744)
Mozilla: Unavailable PAC file resulted in OCSP requests being blocked (CVE-2022-34472)
Mozilla: Potential integer overflow in ReplaceElementsAt (CVE-2022-34481) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: ALSA-2022:5482
Updated: 2026-11-02

OSVMGASA-2022-0253 No score

Updated thunderbird packages fix security vulnerability

A popup window could be resized in a way to overlay the address bar with web content. (CVE-2022-34479)

Use-after-free in nsSHistory. (CVE-2022-34470)

CSP sandbox header without allow-scripts can be bypassed via retargeted javascript: URI. (CVE-2022-34468)

An email with a mismatching OpenPGP signature date was accepted as valid. (CVE-2022-2226)

Potential integer overflow in ReplaceElementsAt. (CVE-2022-34481)

CSP bypass enabling stylesheet injection. (CVE-2022-31744)

Unavailable PAC file resulted in OCSP requests being blocked. (CVE-2022-34472)

Undesired attributes could be set as part of prototype pollution. (CVE-2022-2200)

Memory safety bugs fixed in Thunderbird 91.11 and Thunderbird 102. (CVE-2022-34484)

Record: MGASA-2022-0253
Updated: 2026-11-02

OSVopenSUSE-SU-2024:12161-1 No score

MozillaThunderbird-91.11.0-1.1 on GA media

These are all security issues fixed in the MozillaThunderbird-91.11.0-1.1 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2024:12161-1
Updated: 2026-11-02

OSVSUSE-SU-2022:2320-1 No score

Security update for MozillaThunderbird

This update for MozillaThunderbird fixes the following issues:

CVE-2022-2200: Undesired attributes could be set as part of prototype pollution (bmo#1771381)
CVE-2022-2226: An email with a mismatching OpenPGP signature date was accepted as valid (bmo#1775441)
CVE-2022-31744: CSP bypass enabling stylesheet injection (bmo#1757604)
CVE-2022-34468: CSP sandbox header without allow-scripts can be bypassed via retargeted javascript: URI (bmo#1768537)
CVE-2022-34470: Use-after-free in nsSHistory (bmo#1765951)
CVE-2022-34472: Unavailable PAC file resulted in OCSP requests being blocked (bmo#1770123)
CVE-2022-34478: Microsoft protocols can be attacked if a user accepts a prompt (bmo#1773717)
CVE-2022-34479: A popup window could be resized in a way to overlay the address bar with web content (bmo#1745595)
CVE-2022-34481: Potential integer overflow in ReplaceElementsAt (bmo#1497246)
CVE-2022-34484: Memory safety bugs fixed in Thunderbird 91.11 and Thunderbird 102 (bmo#1763634, bmo#1772651)

Record: SUSE-SU-2022:2320-1
Updated: 2026-11-02

OSVSUSE-SU-2022:3281-1 No score

Security update for MozillaThunderbird

This update for MozillaThunderbird fixes the following issues:

Updated to Mozilla Thunderbird 102.2.2:

CVE-2022-3033: Fixed leaking of sensitive information when composing a response to an HTML email with a META refresh tag (bsc#1203007).
CVE-2022-3032: Fixed missing blocking of remote content specified in an HTML document that was nested inside an iframe's srcdoc attribute (bsc#1203007).
CVE-2022-3034: Fixed issue where iframe element in an HTML email could trigger a network request (bsc#1203007).
CVE-2022-36059: Fixed DoS in Matrix SDK bundled with Thunderbird service attack (bsc#1203007).
CVE-2022-38472: Fixed Address bar spoofing via XSLT error handling (bsc#1202645).
CVE-2022-38473: Fixed cross-origin XSLT Documents inheriting the parent's permissions (bsc#1202645).
CVE-2022-38476: Fixed data race and potential use-after-free in PK11_ChangePW (bsc#1202645).
CVE-2022-38477: Fixed memory safety bugs (bsc#1202645).
CVE-2022-38478: Fixed memory safety bugs (bsc#1202645).
CVE-2022-36319: Fixed mouse position spoofing with CSS transforms (bsc#1201758).
CVE-2022-36318: Fixed directory indexes for bundled resources reflected URL parameters (bsc#1201758).
CVE-2022-36314: Fixed unexpected network loads when opening local .lnk files (bsc#1201758).
CVE-2022-2505: Fixed memory safety bugs (bsc#1201758).
CVE-2022-34479: Fixed vulnerability which could overlay the address bar with web content (bsc#1200793).
CVE-2022-34470: Fixed use-after-free in nsSHistory (bsc#1200793).
CVE-2022-34468: Fixed CSP sandbox header without allow-scripts bypass via retargeted javascript (bsc#1200793).
CVE-2022-2226: Fixed emails with a mismatching OpenPGP signature date incorrectly accepted as valid (bsc#1200793).
CVE-2022-34481: Fixed integer overflow in ReplaceElementsAt (bsc#1200793).
CVE-2022-31744: Fixed CSP bypass enabling stylesheet injection (bsc#1200793).
CVE-2022-34472: Fixed unavailable PAC file resulting in OCSP requests being blocked (bsc#1200793).
CVE-2022-34478: Fixed Microsoft protocols attacks if a user accepts a prompt (bsc#1200793).
CVE-2022-2200: Fixed vulnerability where undesired attributes could be set as part of prototype pollution (bsc#1200793).
CVE-2022-34484: Fixed memory safety bugs (bsc#1200793).

Record: SUSE-SU-2022:3281-1
Updated: 2026-11-02

OSVUSN-5512-1 No score

thunderbird vulnerabilities

Multiple security issues were discovered in Thunderbird. If a user were tricked into opening a specially crafted website in a browsing context, an attacker could potentially exploit these to cause a denial of service, obtain sensitive information, spoof the UI, bypass CSP restrictions, or execute arbitrary code. (CVE-2022-2200, CVE-2022-31736, CVE-2022-31737, CVE-2022-31738, CVE-2022-31740, CVE-2022-31741, CVE-2022-31742, CVE-2022-31744, CVE-2022-31747, CVE-2022-34468, CVE-2022-34470, CVE-2022-34479, CVE-2022-34481, CVE-2022-34484)

It was discovered that an unavailable PAC file caused OCSP requests to be blocked, resulting in incorrect error pages being displayed. (CVE-2022-34472)

It was discovered that the Braille space character could be used to cause Thunderbird to display the wrong sender address for signed messages. An attacker could potentially exploit this to trick the user into believing a message had been sent from somebody they trusted. (CVE-2022-1834)

It was discovered that Thunderbird would consider an email with a mismatched OpenPGP signature date as valid. An attacker could potentially exploit this by replaying an older message in order to trick the user into believing that the statements in the message are current. (CVE-2022-2226)

Record: USN-5512-1
Updated: 2026-11-02

Affected products

mozilla thunderbird

Affected packages

Affected packages
Package	Affected	Fixed
`thunderbird` Alpine:v3.16	before 91.11.0-r0	91.11.0-r0
`thunderbird` Alpine:v3.17	before 102.0-r0	102.0-r0102.1.0-r0
`thunderbird` Alpine:v3.18	before 102.0-r0	102.0-r0102.1.0-r0
`thunderbird` Alpine:v3.19	before 102.0-r0	102.0-r0102.1.0-r0
`thunderbird` Alpine:v3.20	before 102.0-r0	102.0-r0102.1.0-r0
`thunderbird` Alpine:v3.21	before 102.0-r0	102.0-r0102.1.0-r0
`thunderbird` Alpine:v3.22	before 102.0-r0	102.0-r0102.1.0-r0
`thunderbird` Alpine:v3.23	before 102.0-r0	102.0-r0102.1.0-r0
`thunderbird` AlmaLinux:9	before 91.11.0-2.el9_0.alma	91.11.0-2.el9_0.alma
`thunderbird` Debian:12	before 1:91.11.0-1	1:91.11.0-1

Show 44 moreShow less

Affected packages
Package	Affected	Fixed
`thunderbird` Debian:13	before 1:91.11.0-1	1:91.11.0-1
`thunderbird` Debian:14	before 1:91.11.0-1	1:91.11.0-1
`thunderbird` Debian:10	before 1:91.11.0-1~deb10u1, plus listed versions 1:60.7.2-11:60.8.0-11:60.8.0-1~deb10u11:60.8.0-1~deb8u11:60.8.0-1~deb9u1 Show 45 moreShow less 1:60.8.0-21:60.9.0-11:60.9.0-1~deb10u11:60.9.0-1~deb8u11:60.9.0-1~deb9u11:65.0~b1-11:66.0~b1-11:67.0~b3-11:68.0~b1-11:68.1.1-1~exp11:68.1.2-1~exp11:68.10.0-11:68.10.0-1~deb10u11:68.10.0-1~deb9u11:68.11.0-11:68.11.0-1~deb10u11:68.11.0-1~deb9u11:68.11.0-21:68.11.0-31:68.12.0-11:68.12.0-1~deb10u11:68.12.0-1~deb9u11:68.12.0-1~deb9u21:68.2.1-11:68.2.2-11:68.2.2-1~deb10u11:68.2.2-1~deb8u11:68.2.2-1~deb9u11:68.3.0-11:68.3.0-21:68.3.0-2~deb10u11:68.3.0-2~deb8u11:68.3.0-2~deb9u11:68.3.1-11:68.4.1-11:68.4.1-1~deb10u11:68.4.1-1~deb8u11:68.4.1-1~deb9u11:68.4.2-11:68.5.0-11:68.5.0-1~deb10u11:68.5.0-1~deb8u11:68.5.0-1~deb9u11:68.6.0-11:68.6.0-1~deb10u1	1:91.11.0-1~deb10u1
`thunderbird` Debian:11	before 1:91.11.0-1~deb11u1, plus listed versions 1:78.12.0-11:78.13.0-11:78.13.0-1~deb10u11:78.13.0-1~deb11u11:78.13.0-1~deb9u1 Show 45 moreShow less 1:78.14.0-11:78.14.0-1~deb10u11:78.14.0-1~deb11u11:78.14.0-1~deb9u11:84.0~b3-11:85.0~b3-11:86.0~b3-11:88.0~b2-11:89.0~b2-11:90.0~b2-11:91.0-11:91.0.2-11:91.0~b1-11:91.0~b3-11:91.0~b5-11:91.1.0-11:91.1.1-11:91.10.0-11:91.10.0-1~deb10u11:91.10.0-1~deb11u11:91.10.0-1~deb9u11:91.11.0-1~deb10u11:91.2.0-11:91.2.1-11:91.3.0-11:91.3.2-11:91.4.0-11:91.4.1-11:91.4.1-1~deb10u11:91.4.1-1~deb11u11:91.4.1-1~deb9u11:91.5.0-11:91.5.0-1~deb9u11:91.5.0-21:91.5.0-2~deb10u11:91.5.0-2~deb11u11:91.5.1-11:91.6.0-11:91.6.0-1~deb10u11:91.6.0-1~deb11u11:91.6.0-1~deb9u11:91.6.1-11:91.6.1-1~deb10u11:91.6.1-1~deb11u11:91.6.1-1~deb9u1	1:91.11.0-1~deb11u1
`thunderbird` Mageia:8	before 91.11.0-1.mga8	91.11.0-1.mga8
`thunderbird-l10n` Mageia:8	before 91.11.0-1.mga8	91.11.0-1.mga8
`thunderbird` Red Hat:enterprise_linux:8::appstream	before 0:91.11.0-2.el8_6	0:91.11.0-2.el8_6
`thunderbird-debuginfo` Red Hat:enterprise_linux:8::appstream	before 0:91.11.0-2.el8_6	0:91.11.0-2.el8_6
`thunderbird-debugsource` Red Hat:enterprise_linux:8::appstream	before 0:91.11.0-2.el8_6	0:91.11.0-2.el8_6
`thunderbird` Red Hat:rhel_eus:8.4::appstream	before 0:91.11.0-2.el8_4	0:91.11.0-2.el8_4
`thunderbird-debuginfo` Red Hat:rhel_eus:8.4::appstream	before 0:91.11.0-2.el8_4	0:91.11.0-2.el8_4
`thunderbird-debugsource` Red Hat:rhel_eus:8.4::appstream	before 0:91.11.0-2.el8_4	0:91.11.0-2.el8_4
`thunderbird` Red Hat:rhel_eus:8.2::appstream	before 0:91.11.0-2.el8_2	0:91.11.0-2.el8_2
`thunderbird-debuginfo` Red Hat:rhel_eus:8.2::appstream	before 0:91.11.0-2.el8_2	0:91.11.0-2.el8_2
`thunderbird-debugsource` Red Hat:rhel_eus:8.2::appstream	before 0:91.11.0-2.el8_2	0:91.11.0-2.el8_2
`thunderbird` Red Hat:rhel_e4s:8.1::appstream	before 0:91.11.0-2.el8_1	0:91.11.0-2.el8_1
`thunderbird-debuginfo` Red Hat:rhel_e4s:8.1::appstream	before 0:91.11.0-2.el8_1	0:91.11.0-2.el8_1
`thunderbird-debugsource` Red Hat:rhel_e4s:8.1::appstream	before 0:91.11.0-2.el8_1	0:91.11.0-2.el8_1
`thunderbird` Red Hat:enterprise_linux:7::client	before 0:91.11.0-2.el7_9	0:91.11.0-2.el7_9
`thunderbird-debuginfo` Red Hat:enterprise_linux:7::client	before 0:91.11.0-2.el7_9	0:91.11.0-2.el7_9
`thunderbird` Red Hat:enterprise_linux:7::server	before 0:91.11.0-2.el7_9	0:91.11.0-2.el7_9
`thunderbird-debuginfo` Red Hat:enterprise_linux:7::server	before 0:91.11.0-2.el7_9	0:91.11.0-2.el7_9
`thunderbird` Red Hat:enterprise_linux:7::workstation	before 0:91.11.0-2.el7_9	0:91.11.0-2.el7_9
`thunderbird-debuginfo` Red Hat:enterprise_linux:7::workstation	before 0:91.11.0-2.el7_9	0:91.11.0-2.el7_9
`thunderbird` Red Hat:enterprise_linux:9::appstream	before 0:91.11.0-2.el9_0	0:91.11.0-2.el9_0
`thunderbird-debuginfo` Red Hat:enterprise_linux:9::appstream	before 0:91.11.0-2.el9_0	0:91.11.0-2.el9_0
`thunderbird-debugsource` Red Hat:enterprise_linux:9::appstream	before 0:91.11.0-2.el9_0	0:91.11.0-2.el9_0
`thunderbird` Rocky Linux:8	before 0:91.11.0-2.el8_6	0:91.11.0-2.el8_6
`MozillaThunderbird` SUSE:Linux Enterprise Module for Package Hub 15 SP3	before 91.11.0-150200.8.76.1	91.11.0-150200.8.76.1
`MozillaThunderbird` SUSE:Linux Enterprise Module for Package Hub 15 SP4	before 91.11.0-150200.8.76.1	91.11.0-150200.8.76.1
`MozillaThunderbird` SUSE:Linux Enterprise Workstation Extension 15 SP3	before 91.11.0-150200.8.76.1	91.11.0-150200.8.76.1
`MozillaThunderbird` SUSE:Linux Enterprise Workstation Extension 15 SP4	before 91.11.0-150200.8.76.1	91.11.0-150200.8.76.1
`MozillaThunderbird` openSUSE:Leap 15.3	before 91.11.0-150200.8.76.1	91.11.0-150200.8.76.1
`MozillaThunderbird` openSUSE:Leap 15.4	before 91.11.0-150200.8.76.1	91.11.0-150200.8.76.1
`MozillaThunderbird` SUSE:Linux Enterprise Module for Package Hub 15 SP3	before 102.2.2-150200.8.82.1	102.2.2-150200.8.82.1
`MozillaThunderbird` SUSE:Linux Enterprise Module for Package Hub 15 SP4	before 102.2.2-150200.8.82.1	102.2.2-150200.8.82.1
`MozillaThunderbird` SUSE:Linux Enterprise Workstation Extension 15 SP3	before 102.2.2-150200.8.82.1	102.2.2-150200.8.82.1
`MozillaThunderbird` SUSE:Linux Enterprise Workstation Extension 15 SP4	before 102.2.2-150200.8.82.1	102.2.2-150200.8.82.1
`MozillaThunderbird` openSUSE:Leap 15.3	before 102.2.2-150200.8.82.1	102.2.2-150200.8.82.1
`MozillaThunderbird` openSUSE:Leap 15.4	before 102.2.2-150200.8.82.1	102.2.2-150200.8.82.1
`thunderbird` Ubuntu:18.04:LTS	before 1:91.11.0+build2-0ubuntu0.18.04.1, plus listed versions 1:52.4.0+build1-0ubuntu21:52.6.0+build1-0ubuntu11:52.7.0+build1-0ubuntu11:52.8.0+build1-0ubuntu0.18.04.11:52.9.1+build3-0ubuntu0.18.04.1 Show 24 moreShow less 1:60.2.1+build1-0ubuntu0.18.04.21:60.4.0+build2-0ubuntu0.18.04.11:60.5.1+build2-0ubuntu0.18.04.11:60.6.1+build2-0ubuntu0.18.04.11:60.7.0+build1-0ubuntu0.18.04.11:60.7.1+build1-0ubuntu0.18.04.11:60.7.2+build2-0ubuntu0.18.04.11:60.8.0+build1-0ubuntu0.18.04.11:60.9.0+build1-0ubuntu0.18.04.11:68.2.1+build1-0ubuntu0.18.04.11:68.2.2+build1-0ubuntu0.18.04.11:68.4.1+build1-0ubuntu0.18.04.11:68.7.0+build1-0ubuntu0.18.04.11:68.8.0+build2-0ubuntu0.18.04.21:68.10.0+build1-0ubuntu0.18.04.11:78.8.1+build1-0ubuntu0.18.04.11:78.11.0+build1-0ubuntu0.18.04.21:78.13.0+build1-0ubuntu0.18.04.11:78.14.0+build1-0ubuntu0.18.04.11:78.14.0+build1-0ubuntu0.18.04.21:91.5.0+build1-0ubuntu0.18.04.11:91.7.0+build2-0ubuntu0.18.04.11:91.8.1+build1-0ubuntu0.18.04.11:91.9.1+build1-0ubuntu0.18.04.1	1:91.11.0+build2-0ubuntu0.18.04.1
`thunderbird` Ubuntu:20.04:LTS	before 1:91.11.0+build2-0ubuntu0.20.04.1, plus listed versions 1:68.1.2+build1-0ubuntu11:68.1.2+build1-0ubuntu21:68.2.1+build1-0ubuntu11:68.2.2+build1-0ubuntu11:68.3.0+build2-0ubuntu1 Show 19 moreShow less 1:68.3.1+build1-0ubuntu21:68.4.1+build1-0ubuntu11:68.4.2+build2-0ubuntu11:68.5.0+build1-0ubuntu11:68.6.0+build2-0ubuntu11:68.7.0+build1-0ubuntu11:68.7.0+build1-0ubuntu21:68.8.0+build2-0ubuntu0.20.04.21:68.10.0+build1-0ubuntu0.20.04.11:78.7.1+build1-0ubuntu0.20.04.11:78.8.1+build1-0ubuntu0.20.04.11:78.11.0+build1-0ubuntu0.20.04.21:78.13.0+build1-0ubuntu0.20.04.21:78.14.0+build1-0ubuntu0.20.04.11:78.14.0+build1-0ubuntu0.20.04.21:91.5.0+build1-0ubuntu0.20.04.11:91.7.0+build2-0ubuntu0.20.04.11:91.8.1+build1-0ubuntu0.20.04.11:91.9.1+build1-0ubuntu0.20.04.1	1:91.11.0+build2-0ubuntu0.20.04.1
`thunderbird` Ubuntu:22.04:LTS	before 1:91.11.0+build2-0ubuntu0.22.04.1, plus listed versions 1:91.1.2+build1-0ubuntu11:91.3.0+build2-0ubuntu11:91.3.1+build1-0ubuntu11:91.3.2+build1-0ubuntu11:91.4.0+build1.1-0ubuntu1 Show 8 moreShow less 1:91.4.0+build2-0ubuntu11:91.5.0+build1-0ubuntu11:91.5.1+build1-0ubuntu11:91.6.1+build1-0ubuntu11:91.7.0+build1-0ubuntu11:91.7.0+build2-0ubuntu11:91.8.0+build2-0ubuntu11:91.9.1+build1-0ubuntu0.22.04.1	1:91.11.0+build2-0ubuntu0.22.04.1
`MozillaThunderbird` openSUSE:Tumbleweed	before 91.11.0-1.1	91.11.0-1.1

History

History
Recorded	Changed	Sources
Nov 3, 2026	affected, aliases, references	OSV
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2022-2226 is a medium vulnerability (CVSS 6.5) in Mozilla Thunderbird, published June 30, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.44%, the 38th percentile. Fixed in thunderbird 91.11.0-r0.

References

Show 111 moreShow less

This page doesn't list everything

Left out here: 159 versions. The JSON record has them.