CVE-2022-29913

The parent process would not properly check whether the Speech Synthesis feature is enabled, when receiving instructions from a child process. This vulnerability affects Thunderbird < 91.9.

Mozilla Thunderbird is a standalone mail and newsgroup client.

This update upgrades Thunderbird to version 91.9.0.

Security Fix(es):

• Mozilla: Bypassing permission prompt in nested browsing contexts (CVE-2022-29909)

• Mozilla: iframe Sandbox bypass (CVE-2022-29911)

• Mozilla: Fullscreen notification bypass using popups (CVE-2022-29914)

• Mozilla: Leaking browser history with CSS variables (CVE-2022-29916)

• Mozilla: Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9 (CVE-2022-29917)

• Mozilla: Reader mode bypassed SameSite cookies (CVE-2022-29912)

• Mozilla: Speech Synthesis feature not properly disabled (CVE-2022-29913)

• Mozilla: Incorrect security status shown after viewing an attached email (CVE-2022-1520)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The parent process would not properly check whether the Speech Synthesis feature is enabled, when receiving instructions from a child process. This vulnerability affects Thunderbird < 91.9.

Mozilla Thunderbird is a standalone mail and newsgroup client.

This update upgrades Thunderbird to version 91.9.0.

Security Fix(es):

• Mozilla: Bypassing permission prompt in nested browsing contexts (CVE-2022-29909)

• Mozilla: iframe Sandbox bypass (CVE-2022-29911)

• Mozilla: Fullscreen notification bypass using popups (CVE-2022-29914)

• Mozilla: Leaking browser history with CSS variables (CVE-2022-29916)

• Mozilla: Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9 (CVE-2022-29917)

• Mozilla: Reader mode bypassed SameSite cookies (CVE-2022-29912)

• Mozilla: Speech Synthesis feature not properly disabled (CVE-2022-29913)

• Mozilla: Incorrect security status shown after viewing an attached email (CVE-2022-1520)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Incorrect security status shown after viewing an attached email. (CVE-2022-1520) Fullscreen notification bypass using popups. (CVE-2022-29914) Bypassing permission prompt in nested browsing contexts. (CVE-2022-29909) Leaking browser history with CSS variables. (CVE-2022-29916) iframe sandbox bypass. (CVE-2022-29911) Reader mode bypassed SameSite cookies. (CVE-2022-29912) Speech Synthesis feature not properly disabled. (CVE-2022-29913) Memory safety bugs fixed in Thunderbird 91.9. (CVE-2022-29917)

These are all security issues fixed in the MozillaThunderbird-91.9.0-1.1 package on the GA media of openSUSE Tumbleweed.

This update for MozillaThunderbird fixes the following issues:

Various security fixes MFSA 2022-18 (bsc#1198970):

• CVE-2022-1520: Incorrect security status shown after viewing an attached email (bmo#1745019).
• CVE-2022-29914: Fullscreen notification bypass using popups (bmo#1746448).
• CVE-2022-29909: Bypassing permission prompt in nested browsing contexts (bmo#1755081).
• CVE-2022-29916: Leaking browser history with CSS variables (bmo#1760674).
• CVE-2022-29911: iframe sandbox bypass (bmo#1761981).
• CVE-2022-29912: Reader mode bypassed SameSite cookies (bmo#1692655).
• CVE-2022-29913: Speech Synthesis feature not properly disabled (bmo#1764778).
• CVE-2022-29917: Memory safety bugs fixed in Thunderbird 91.9 (bmo#1684739, bmo#1706441, bmo#1753298, bmo#1762614, bmo#1762620).

Multiple security issues were discovered in Thunderbird. If a user were tricked into opening a specially crafted website in a browsing context, an attacker could potentially exploit these to cause a denial of service, bypass permission prompts, obtain sensitive information, bypass security restrictions, cause user confusion, or execute arbitrary code. (CVE-2022-29909, CVE-2022-29911, CVE-2022-29912, CVE-2022-29913, CVE-2022-29914, CVE-2022-29916, CVE-2022-29917)

It was discovered that Thunderbird would show the wrong security status after viewing an attached message that is signed or encrypted. An attacker could potentially exploit this by tricking the user into trusting the authenticity of a message. (CVE-2022-1520)

It was discovered that the methods of an Array object could be corrupted as a result of prototype pollution by sending a message to the parent process. If a user were tricked into opening a specially crafted website in a browsing context, an attacker could exploit this to execute JavaScript in a privileged context. (CVE-2022-1529, CVE-2022-1802)