{"id":"CVE-2022-0566","aliases":["ALPINE-CVE-2022-0566","ALSA-2022:0845","DEBIAN-CVE-2022-0566","DLA-2930-1","DSA-5086-1","EUVD-2022-15684","GHSA-3jgp-624h-phx4","MGASA-2022-0072","RHSA-2022:0843","RHSA-2022:0845","RHSA-2022:0847","RHSA-2022:0850","RHSA-2022:0853","RLSA-2022:0845","SUSE-SU-2022:0559-1","UBUNTU-CVE-2022-0566","USN-5345-1","openSUSE-SU-2022:0559-1","openSUSE-SU-2024:11856-1"],"status":"published","title":"It may be possible for an attacker to craft an email message that causes Thunderbird to perform...","description":"It may be possible for an attacker to craft an email message that causes Thunderbird to perform an out-of-bounds write of one byte when processing the message. This vulnerability affects Thunderbird \u003c 91.6.1.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.00735,"percentile":0.54884,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-787"],"published":"2022-02-18T00:00:00Z","modified":"2026-11-03T08:00:04Z","fixes":[{"ecosystem":"Alpine:v3.16","package":"thunderbird","fixed_in":["91.6.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"thunderbird","fixed_in":["91.6.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"thunderbird","fixed_in":["91.6.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"thunderbird","fixed_in":["91.6.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"thunderbird","fixed_in":["91.6.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"thunderbird","fixed_in":["91.6.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"thunderbird","fixed_in":["91.6.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"thunderbird","fixed_in":["91.6.2-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"thunderbird","fixed_in":["1:91.6.1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"thunderbird","fixed_in":["1:91.6.1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"thunderbird","fixed_in":["1:91.6.1-1"],"sources":["osv"]},{"ecosystem":"Debian:9","package":"thunderbird","fixed_in":["1:91.6.1-1~deb9u1"],"sources":["osv"]},{"ecosystem":"Debian:10","package":"thunderbird","fixed_in":["1:91.6.1-1~deb10u1"],"sources":["osv"]},{"ecosystem":"Debian:11","package":"thunderbird","fixed_in":["1:91.6.1-1~deb11u1"],"sources":["osv"]},{"ecosystem":"Mageia:8","package":"thunderbird","fixed_in":["91.6.1-1.mga8"],"sources":["osv"]},{"ecosystem":"Mageia:8","package":"thunderbird-l10n","fixed_in":["91.6.1-1.mga8"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"thunderbird","fixed_in":["1:91.7.0+build2-0ubuntu0.18.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"thunderbird","fixed_in":["1:91.7.0+build2-0ubuntu0.20.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"thunderbird","fixed_in":["1:91.6.1+build1-0ubuntu1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"MozillaThunderbird","fixed_in":["91.6.1-1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.16","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"91.6.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"91.6.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"91.6.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"91.6.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"91.6.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"91.6.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"91.6.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"91.6.2-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"91.7.0-2.el8_5.alma"}]}],"bundled":11},{"source":"osv","ecosystem":"AlmaLinux:8","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"91.7.0-2.el8_5.alma.plus"}]}],"bundled":11},{"source":"osv","ecosystem":"Debian:12","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:91.6.1-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:91.6.1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:91.6.1-1"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:91.6.1-1~deb9u1"}]}],"versions":["1.5-4","1.5.0.2-1","1.5.0.2-2","1.5.0.2-3","1.5.0.4-1","1.5.0.4-2","1.5.0.4-3","1.5.0.5-1","1.5.0.7-1","1.5.0.7-2","1:52.4.0-1","1:52.4.0-1~deb7u1","1:52.4.0-1~deb8u1","1:52.4.0-1~deb9u1","1:52.4.0-2~exp1","1:52.5.0-1","1:52.5.0-1~deb7u1","1:52.5.0-1~deb8u1","1:52.5.0-1~deb9u1","1:52.5.2-1","1:52.5.2-1~deb7u1","1:52.5.2-2","1:52.5.2-2~deb8u1","1:52.5.2-2~deb9u1","1:52.6.0-1","1:52.6.0-1+alpha.1","1:52.6.0-1+alpha.2","1:52.6.0-1~deb7u1","1:52.6.0-1~deb8u1","1:52.6.0-1~deb9u1","1:52.7.0-1","1:52.7.0-1~deb7u1","1:52.7.0-1~deb8u1","1:52.7.0-1~deb9u1","1:52.8.0-1","1:52.8.0-1~deb7u1","1:52.8.0-1~deb8u1","1:52.8.0-1~deb9u1","1:52.9.0-1","1:52.9.1-1","1:52.9.1-1~deb8u1","1:52.9.1-1~deb9u1","1:58.0~b3-1","1:60.0-1","1:60.0-2","1:60.0-2~deb9u1","1:60.0-3","1:60.0-3~deb9u1","1:60.0~b10-1","1:60.0~b2-1","1:60.0~b3-1","1:60.0~b4-1","1:60.0~b5-1","1:60.0~b6-1","1:60.0~b9-1","1:60.0~b9-2","1:60.2.1-1","1:60.2.1-2~deb9u1","1:60.3.0-1","1:60.3.0-1~deb8u1","1:60.3.0-1~deb9u1","1:60.3.1-1","1:60.4.0-1","1:60.4.0-1~deb8u1","1:60.4.0-1~deb9u1","1:60.5.0-1","1:60.5.0-2","1:60.5.0-3","1:60.5.1-1","1:60.5.1-1~deb8u1","1:60.5.1-1~deb9u1","1:60.6.1-1","1:60.6.1-1~deb8u1","1:60.6.1-1~deb9u1","1:60.7.0-1","1:60.7.0-1~deb8u1","1:60.7.0-1~deb9u1","1:60.7.1-1","1:60.7.1-1~deb8u1","1:60.7.1-1~deb9u1","1:60.7.2-1","1:60.7.2-1~deb8u1","1:60.7.2-1~deb9u1","1:60.8.0-1","1:60.8.0-1~deb10u1","1:60.8.0-1~deb8u1","1:60.8.0-1~deb9u1","1:60.8.0-2","1:60.9.0-1","1:60.9.0-1~deb10u1","1:60.9.0-1~deb8u1","1:60.9.0-1~deb9u1","1:65.0~b1-1","1:66.0~b1-1","1:67.0~b3-1","1:68.0~b1-1","1:68.1.1-1~exp1","1:68.1.2-1~exp1","1:68.10.0-1","1:68.10.0-1~deb10u1","1:68.10.0-1~deb9u1","1:68.11.0-1","1:68.11.0-1~deb10u1","1:68.11.0-1~deb9u1","1:68.11.0-2","1:68.11.0-3","1:68.12.0-1","1:68.12.0-1~deb10u1","1:68.12.0-1~deb9u1","1:68.12.0-1~deb9u2","1:68.2.1-1","1:68.2.2-1","1:68.2.2-1~deb10u1","1:68.2.2-1~deb8u1","1:68.2.2-1~deb9u1","1:68.3.0-1","1:68.3.0-2","1:68.3.0-2~deb10u1","1:68.3.0-2~deb8u1","1:68.3.0-2~deb9u1","1:68.3.1-1","1:68.4.1-1","1:68.4.1-1~deb10u1","1:68.4.1-1~deb8u1","1:68.4.1-1~deb9u1","1:68.4.2-1","1:68.5.0-1","1:68.5.0-1~deb10u1","1:68.5.0-1~deb8u1","1:68.5.0-1~deb9u1","1:68.6.0-1","1:68.6.0-1~deb10u1","1:68.6.0-1~deb8u1","1:68.6.0-1~deb9u1","1:68.7.0-1","1:68.7.0-1~deb10u1","1:68.7.0-1~deb8u1","1:68.7.0-1~deb9u1","1:68.8.0-1","1:68.8.0-1~deb10u1","1:68.8.0-1~deb8u1","1:68.8.0-1~deb9u1","1:68.8.1-1","1:68.9.0-1","1:68.9.0-1~deb10u1","1:68.9.0-1~deb8u1","1:68.9.0-1~deb8u2","1:68.9.0-1~deb9u1","1:76.0~b1-1","1:76.0~b2-1","1:77.0~b1-1","1:77.0~b2-1","1:77.0~b3-1","1:78.0-1","1:78.0.1-1","1:78.0~b1-1","1:78.0~b2-1","1:78.1.0-1","1:78.1.1-1","1:78.10.0-1","1:78.10.0-1~deb10u1","1:78.10.0-1~deb9u1","1:78.10.2-1","1:78.11.0-1","1:78.11.0-1~deb10u1","1:78.11.0-1~deb9u1","1:78.11.0-2","1:78.12.0-1","1:78.12.0-1~deb10u1","1:78.12.0-1~deb9u1","1:78.13.0-1","1:78.13.0-1~deb10u1","1:78.13.0-1~deb11u1","1:78.13.0-1~deb9u1","1:78.14.0-1","1:78.14.0-1~deb10u1","1:78.14.0-1~deb11u1","1:78.14.0-1~deb9u1","1:78.2.0-1","1:78.2.1-1","1:78.2.2-1","1:78.3.1-1","1:78.3.1-2","1:78.3.1-2~deb10u1","1:78.3.1-2~deb10u2","1:78.3.1-2~deb9u1","1:78.3.2-1","1:78.3.3-1","1:78.4.0-1","1:78.4.0-1~deb10u1","1:78.4.0-1~deb9u1","1:78.4.1-1","1:78.4.2-1","1:78.4.2-1~deb10u1","1:78.4.2-1~deb9u1","1:78.5.0-1","1:78.5.0-1~deb10u1","1:78.5.0-1~deb9u1","1:78.5.1-1","1:78.5.1-1~deb10u1","1:78.5.1-1~deb9u1","1:78.6.0-1","1:78.6.0-1~deb10u1","1:78.6.0-1~deb9u1","1:78.6.1-1","1:78.7.0-1","1:78.7.0-1~deb10u1","1:78.7.0-1~deb9u1","1:78.7.1-1","1:78.8.0-1","1:78.8.0-1~deb10u1","1:78.8.0-1~deb9u1","1:78.9.0-1","1:78.9.0-1~deb10u1","1:78.9.0-1~deb9u1","1:84.0~b3-1","1:85.0~b3-1","1:86.0~b3-1","1:88.0~b2-1","1:89.0~b2-1","1:90.0~b2-1","1:91.0-1","1:91.0.2-1","1:91.0~b1-1","1:91.0~b3-1","1:91.0~b5-1","1:91.1.0-1","1:91.1.1-1","1:91.2.0-1","1:91.2.1-1","1:91.3.0-1","1:91.3.2-1","1:91.4.0-1","1:91.4.1-1","1:91.4.1-1~deb10u1","1:91.4.1-1~deb11u1","1:91.4.1-1~deb9u1","1:91.5.0-1","1:91.5.0-1~deb9u1","1:91.5.0-2","1:91.5.0-2~deb10u1","1:91.5.0-2~deb11u1","1:91.5.1-1","1:91.6.0-1","1:91.6.0-1~deb10u1","1:91.6.0-1~deb11u1","1:91.6.0-1~deb9u1"]},{"source":"osv","ecosystem":"Debian:10","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:91.6.1-1~deb10u1"}]}],"versions":["1:60.7.2-1","1:60.8.0-1","1:60.8.0-1~deb10u1","1:60.8.0-1~deb8u1","1:60.8.0-1~deb9u1","1:60.8.0-2","1:60.9.0-1","1:60.9.0-1~deb10u1","1:60.9.0-1~deb8u1","1:60.9.0-1~deb9u1","1:65.0~b1-1","1:66.0~b1-1","1:67.0~b3-1","1:68.0~b1-1","1:68.1.1-1~exp1","1:68.1.2-1~exp1","1:68.10.0-1","1:68.10.0-1~deb10u1","1:68.10.0-1~deb9u1","1:68.11.0-1","1:68.11.0-1~deb10u1","1:68.11.0-1~deb9u1","1:68.11.0-2","1:68.11.0-3","1:68.12.0-1","1:68.12.0-1~deb10u1","1:68.12.0-1~deb9u1","1:68.12.0-1~deb9u2","1:68.2.1-1","1:68.2.2-1","1:68.2.2-1~deb10u1","1:68.2.2-1~deb8u1","1:68.2.2-1~deb9u1","1:68.3.0-1","1:68.3.0-2","1:68.3.0-2~deb10u1","1:68.3.0-2~deb8u1","1:68.3.0-2~deb9u1","1:68.3.1-1","1:68.4.1-1","1:68.4.1-1~deb10u1","1:68.4.1-1~deb8u1","1:68.4.1-1~deb9u1","1:68.4.2-1","1:68.5.0-1","1:68.5.0-1~deb10u1","1:68.5.0-1~deb8u1","1:68.5.0-1~deb9u1","1:68.6.0-1","1:68.6.0-1~deb10u1","1:68.6.0-1~deb8u1","1:68.6.0-1~deb9u1","1:68.7.0-1","1:68.7.0-1~deb10u1","1:68.7.0-1~deb8u1","1:68.7.0-1~deb9u1","1:68.8.0-1","1:68.8.0-1~deb10u1","1:68.8.0-1~deb8u1","1:68.8.0-1~deb9u1","1:68.8.1-1","1:68.9.0-1","1:68.9.0-1~deb10u1","1:68.9.0-1~deb8u1","1:68.9.0-1~deb8u2","1:68.9.0-1~deb9u1","1:76.0~b1-1","1:76.0~b2-1","1:77.0~b1-1","1:77.0~b2-1","1:77.0~b3-1","1:78.0-1","1:78.0.1-1","1:78.0~b1-1","1:78.0~b2-1","1:78.1.0-1","1:78.1.1-1","1:78.10.0-1","1:78.10.0-1~deb10u1","1:78.10.0-1~deb9u1","1:78.10.2-1","1:78.11.0-1","1:78.11.0-1~deb10u1","1:78.11.0-1~deb9u1","1:78.11.0-2","1:78.12.0-1","1:78.12.0-1~deb10u1","1:78.12.0-1~deb9u1","1:78.13.0-1","1:78.13.0-1~deb10u1","1:78.13.0-1~deb11u1","1:78.13.0-1~deb9u1","1:78.14.0-1","1:78.14.0-1~deb10u1","1:78.14.0-1~deb11u1","1:78.14.0-1~deb9u1","1:78.2.0-1","1:78.2.1-1","1:78.2.2-1","1:78.3.1-1","1:78.3.1-2","1:78.3.1-2~deb10u1","1:78.3.1-2~deb10u2","1:78.3.1-2~deb9u1","1:78.3.2-1","1:78.3.3-1","1:78.4.0-1","1:78.4.0-1~deb10u1","1:78.4.0-1~deb9u1","1:78.4.1-1","1:78.4.2-1","1:78.4.2-1~deb10u1","1:78.4.2-1~deb9u1","1:78.5.0-1","1:78.5.0-1~deb10u1","1:78.5.0-1~deb9u1","1:78.5.1-1","1:78.5.1-1~deb10u1","1:78.5.1-1~deb9u1","1:78.6.0-1","1:78.6.0-1~deb10u1","1:78.6.0-1~deb9u1","1:78.6.1-1","1:78.7.0-1","1:78.7.0-1~deb10u1","1:78.7.0-1~deb9u1","1:78.7.1-1","1:78.8.0-1","1:78.8.0-1~deb10u1","1:78.8.0-1~deb9u1","1:78.9.0-1","1:78.9.0-1~deb10u1","1:78.9.0-1~deb9u1","1:84.0~b3-1","1:85.0~b3-1","1:86.0~b3-1","1:88.0~b2-1","1:89.0~b2-1","1:90.0~b2-1","1:91.0-1","1:91.0.2-1","1:91.0~b1-1","1:91.0~b3-1","1:91.0~b5-1","1:91.1.0-1","1:91.1.1-1","1:91.2.0-1","1:91.2.1-1","1:91.3.0-1","1:91.3.2-1","1:91.4.0-1","1:91.4.1-1","1:91.4.1-1~deb10u1","1:91.4.1-1~deb11u1","1:91.4.1-1~deb9u1","1:91.5.0-1","1:91.5.0-1~deb9u1","1:91.5.0-2","1:91.5.0-2~deb10u1","1:91.5.0-2~deb11u1","1:91.5.1-1","1:91.6.0-1","1:91.6.0-1~deb10u1","1:91.6.0-1~deb11u1","1:91.6.0-1~deb9u1","1:91.6.1-1~deb9u1"]},{"source":"osv","ecosystem":"Debian:11","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:91.6.1-1~deb11u1"}]}],"versions":["1:78.12.0-1","1:78.13.0-1","1:78.13.0-1~deb10u1","1:78.13.0-1~deb11u1","1:78.13.0-1~deb9u1","1:78.14.0-1","1:78.14.0-1~deb10u1","1:78.14.0-1~deb11u1","1:78.14.0-1~deb9u1","1:84.0~b3-1","1:85.0~b3-1","1:86.0~b3-1","1:88.0~b2-1","1:89.0~b2-1","1:90.0~b2-1","1:91.0-1","1:91.0.2-1","1:91.0~b1-1","1:91.0~b3-1","1:91.0~b5-1","1:91.1.0-1","1:91.1.1-1","1:91.2.0-1","1:91.2.1-1","1:91.3.0-1","1:91.3.2-1","1:91.4.0-1","1:91.4.1-1","1:91.4.1-1~deb10u1","1:91.4.1-1~deb11u1","1:91.4.1-1~deb9u1","1:91.5.0-1","1:91.5.0-1~deb9u1","1:91.5.0-2","1:91.5.0-2~deb10u1","1:91.5.0-2~deb11u1","1:91.5.1-1","1:91.6.0-1","1:91.6.0-1~deb10u1","1:91.6.0-1~deb11u1","1:91.6.0-1~deb9u1","1:91.6.1-1~deb10u1","1:91.6.1-1~deb9u1"]},{"source":"osv","ecosystem":"Mageia:8","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"91.6.1-1.mga8"}]}]},{"source":"osv","ecosystem":"Mageia:8","package":"thunderbird-l10n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"91.6.1-1.mga8"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::appstream","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:91.7.0-2.el8_2"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::appstream","package":"thunderbird-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:91.7.0-2.el8_2"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::appstream","package":"thunderbird-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:91.7.0-2.el8_2"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:91.7.0-2.el8_5"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"thunderbird-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:91.7.0-2.el8_5"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"thunderbird-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:91.7.0-2.el8_5"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.1::appstream","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:91.7.0-2.el8_1"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.1::appstream","package":"thunderbird-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:91.7.0-2.el8_1"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.1::appstream","package":"thunderbird-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:91.7.0-2.el8_1"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:91.7.0-2.el7_9"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"thunderbird-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:91.7.0-2.el7_9"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:91.7.0-2.el7_9"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"thunderbird-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:91.7.0-2.el7_9"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:91.7.0-2.el7_9"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"thunderbird-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:91.7.0-2.el7_9"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::appstream","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:91.7.0-2.el8_4"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::appstream","package":"thunderbird-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:91.7.0-2.el8_4"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::appstream","package":"thunderbird-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:91.7.0-2.el8_4"}]}],"bundled":11},{"source":"osv","ecosystem":"Rocky Linux:8","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:91.7.0-2.el8_5"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP3","package":"MozillaThunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"91.6.1-8.54.1"}]}],"bundled":9},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:91.7.0+build2-0ubuntu0.18.04.1"}]}],"versions":["1:52.4.0+build1-0ubuntu2","1:52.6.0+build1-0ubuntu1","1:52.7.0+build1-0ubuntu1","1:52.8.0+build1-0ubuntu0.18.04.1","1:52.9.1+build3-0ubuntu0.18.04.1","1:60.2.1+build1-0ubuntu0.18.04.2","1:60.4.0+build2-0ubuntu0.18.04.1","1:60.5.1+build2-0ubuntu0.18.04.1","1:60.6.1+build2-0ubuntu0.18.04.1","1:60.7.0+build1-0ubuntu0.18.04.1","1:60.7.1+build1-0ubuntu0.18.04.1","1:60.7.2+build2-0ubuntu0.18.04.1","1:60.8.0+build1-0ubuntu0.18.04.1","1:60.9.0+build1-0ubuntu0.18.04.1","1:68.2.1+build1-0ubuntu0.18.04.1","1:68.2.2+build1-0ubuntu0.18.04.1","1:68.4.1+build1-0ubuntu0.18.04.1","1:68.7.0+build1-0ubuntu0.18.04.1","1:68.8.0+build2-0ubuntu0.18.04.2","1:68.10.0+build1-0ubuntu0.18.04.1","1:78.8.1+build1-0ubuntu0.18.04.1","1:78.11.0+build1-0ubuntu0.18.04.2","1:78.13.0+build1-0ubuntu0.18.04.1","1:78.14.0+build1-0ubuntu0.18.04.1","1:78.14.0+build1-0ubuntu0.18.04.2","1:91.5.0+build1-0ubuntu0.18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:91.7.0+build2-0ubuntu0.20.04.1"}]}],"versions":["1:68.1.2+build1-0ubuntu1","1:68.1.2+build1-0ubuntu2","1:68.2.1+build1-0ubuntu1","1:68.2.2+build1-0ubuntu1","1:68.3.0+build2-0ubuntu1","1:68.3.1+build1-0ubuntu2","1:68.4.1+build1-0ubuntu1","1:68.4.2+build2-0ubuntu1","1:68.5.0+build1-0ubuntu1","1:68.6.0+build2-0ubuntu1","1:68.7.0+build1-0ubuntu1","1:68.7.0+build1-0ubuntu2","1:68.8.0+build2-0ubuntu0.20.04.2","1:68.10.0+build1-0ubuntu0.20.04.1","1:78.7.1+build1-0ubuntu0.20.04.1","1:78.8.1+build1-0ubuntu0.20.04.1","1:78.11.0+build1-0ubuntu0.20.04.2","1:78.13.0+build1-0ubuntu0.20.04.2","1:78.14.0+build1-0ubuntu0.20.04.1","1:78.14.0+build1-0ubuntu0.20.04.2","1:91.5.0+build1-0ubuntu0.20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:91.6.1+build1-0ubuntu1"}]}],"versions":["1:91.1.2+build1-0ubuntu1","1:91.3.0+build2-0ubuntu1","1:91.3.1+build1-0ubuntu1","1:91.3.2+build1-0ubuntu1","1:91.4.0+build1.1-0ubuntu1","1:91.4.0+build2-0ubuntu1","1:91.5.0+build1-0ubuntu1","1:91.5.1+build1-0ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:91.7.0+build2-0ubuntu0.18.04.1"}]}],"versions":["1:52.4.0+build1-0ubuntu2","1:52.6.0+build1-0ubuntu1","1:52.7.0+build1-0ubuntu1","1:52.8.0+build1-0ubuntu0.18.04.1","1:52.9.1+build3-0ubuntu0.18.04.1","1:60.2.1+build1-0ubuntu0.18.04.2","1:60.4.0+build2-0ubuntu0.18.04.1","1:60.5.1+build2-0ubuntu0.18.04.1","1:60.6.1+build2-0ubuntu0.18.04.1","1:60.7.0+build1-0ubuntu0.18.04.1","1:60.7.1+build1-0ubuntu0.18.04.1","1:60.7.2+build2-0ubuntu0.18.04.1","1:60.8.0+build1-0ubuntu0.18.04.1","1:60.9.0+build1-0ubuntu0.18.04.1","1:68.2.1+build1-0ubuntu0.18.04.1","1:68.2.2+build1-0ubuntu0.18.04.1","1:68.4.1+build1-0ubuntu0.18.04.1","1:68.7.0+build1-0ubuntu0.18.04.1","1:68.8.0+build2-0ubuntu0.18.04.2","1:68.10.0+build1-0ubuntu0.18.04.1","1:78.8.1+build1-0ubuntu0.18.04.1","1:78.11.0+build1-0ubuntu0.18.04.2","1:78.13.0+build1-0ubuntu0.18.04.1","1:78.14.0+build1-0ubuntu0.18.04.1","1:78.14.0+build1-0ubuntu0.18.04.2","1:91.5.0+build1-0ubuntu0.18.04.1"],"bundled":13},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:91.7.0+build2-0ubuntu0.20.04.1"}]}],"versions":["1:68.1.2+build1-0ubuntu1","1:68.1.2+build1-0ubuntu2","1:68.2.1+build1-0ubuntu1","1:68.2.2+build1-0ubuntu1","1:68.3.0+build2-0ubuntu1","1:68.3.1+build1-0ubuntu2","1:68.4.1+build1-0ubuntu1","1:68.4.2+build2-0ubuntu1","1:68.5.0+build1-0ubuntu1","1:68.6.0+build2-0ubuntu1","1:68.7.0+build1-0ubuntu1","1:68.7.0+build1-0ubuntu2","1:68.8.0+build2-0ubuntu0.20.04.2","1:68.10.0+build1-0ubuntu0.20.04.1","1:78.7.1+build1-0ubuntu0.20.04.1","1:78.8.1+build1-0ubuntu0.20.04.1","1:78.11.0+build1-0ubuntu0.20.04.2","1:78.13.0+build1-0ubuntu0.20.04.2","1:78.14.0+build1-0ubuntu0.20.04.1","1:78.14.0+build1-0ubuntu0.20.04.2","1:91.5.0+build1-0ubuntu0.20.04.1"],"bundled":13},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"MozillaThunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"91.6.1-8.54.1"}]}],"bundled":9},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"MozillaThunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"91.6.1-1.1"}]}]}],"products":[{"vendor":"mozilla","product":"thunderbird"}],"references":[{"url":"https://www.mozilla.org/security/advisories/mfsa2022-07/","tags":["x_transferred","Vendor Advisory","advisory"]},{"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=1753094","tags":["x_transferred","Issue Tracking","Permissions Required","Vendor Advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-0566","tags":["advisory"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2022-07"},{"url":"https://github.com/advisories/GHSA-3jgp-624h-phx4"},{"url":"https://security.alpinelinux.org/vuln/CVE-2022-0566","tags":["advisory"]},{"url":"https://vulners.com/cve/CVE-2022-0566","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2022-25235","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2022-25236","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2022-25315","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2022-26381","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2022-26383","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2022-26384","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2022-26386","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2022-26387","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2022-26485","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2022-26486","tags":["report"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-0566","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2022-0072.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=30055","tags":["report"]},{"url":"https://www.thunderbird.net/en-US/thunderbird/91.6.1/releasenotes/","tags":["web"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2022-07/","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2022:0843","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2055591","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2056363","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2056366","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2056370","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2061735","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2061736","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2062220","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2062221","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2062222","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2062223","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2062224","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_0843.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-0566","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-0566","tags":["advisory","report"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2022-07/#CVE-2022-0566","tags":["article","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-25235","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-25235","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-25235","tags":["advisory"]},{"url":"https://blog.hartwork.org/posts/expat-2-4-5-released/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-25236","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-25236","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-25236","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-25315","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-25315","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-25315","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-26381","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-26381","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-26381","tags":["advisory"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2022-11/#CVE-2022-26381","tags":["article"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2022-12/#CVE-2022-26381","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-26383","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-26383","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-26383","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-26384","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-26384","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-26384","tags":["advisory"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2022-11/#CVE-2022-26384","tags":["article"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2022-12/#CVE-2022-26384","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-26386","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-26386","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-26386","tags":["advisory"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2022-11/#CVE-2022-26386","tags":["article"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2022-12/#CVE-2022-26386","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-26387","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-26387","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-26387","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-26485","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-26485","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-26485","tags":["advisory"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2022-09/#CVE-2022-26485","tags":["article"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-26486","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-26486","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-26486","tags":["advisory"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2022-09/#CVE-2022-26486","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2022:0845","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_0845.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-22822","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2044457","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-22822","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-22822","tags":["advisory"]},{"url":"https://github.com/libexpat/libexpat/pull/539","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-22823","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2044464","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-22823","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-22823","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-22824","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2044467","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-22824","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-22824","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2022:0847","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_0847.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2022:0850","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_0850.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2022:0853","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_0853.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2022:0845","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20220559-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1195682","tags":["report"]},{"url":"https://bugzilla.suse.com/1196072","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-0566","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-22753","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-22754","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-22756","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-22759","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-22760","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-22761","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-22763","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-22764","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2022-0566","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5345-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2022-22754","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-22756","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-22759","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-22760","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-22761","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-22763","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-22764","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-26381","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-26383","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-26384","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-26386","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-26387","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/GSM3MOVKIHQAE33NLCNX7MUULCOLEADF/","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2022-0566","description":"It may be possible for an attacker to craft an email message that causes Thunderbird to perform an out-of-bounds write of one byte when processing the message. This vulnerability affects Thunderbird \u003c 91.6.1.","status":"published","published":"2022-12-22T00:00:00Z","modified":"2025-04-16T15:37:00.847Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:34:41.69911Z"}],"euvd":[{"id":"EUVD-2022-15684","description":"It may be possible for an attacker to craft an email message that causes Thunderbird to perform an out-of-bounds write of one byte when processing the message. This vulnerability affects Thunderbird \u003c 91.6.1.","status":"published","published":"2022-12-22T00:00:00Z","modified":"2025-04-16T15:37:00Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T20:52:25.343198Z"}],"ghsa":[{"id":"GHSA-3jgp-624h-phx4","title":"It may be possible for an attacker to craft an email message that causes Thunderbird to perform...","description":"It may be possible for an attacker to craft an email message that causes Thunderbird to perform an out-of-bounds write of one byte when processing the message. This vulnerability affects Thunderbird \u003c 91.6.1.","status":"published","published":"2022-12-22T21:30:31Z","modified":"2025-04-16T18:32:40Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T15:01:35.927372Z"}],"nvd":[{"id":"CVE-2022-0566","description":"It may be possible for an attacker to craft an email message that causes Thunderbird to perform an out-of-bounds write of one byte when processing the message. This vulnerability affects Thunderbird \u003c 91.6.1.","status":"published","published":"2022-12-22T20:15:12.647Z","modified":"2026-06-17T04:20:51.43Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:07:34.388163Z"}],"osv":[{"id":"ALPINE-CVE-2022-0566","description":"It may be possible for an attacker to craft an email message that causes Thunderbird to perform an out-of-bounds write of one byte when processing the message. This vulnerability affects Thunderbird \u003c 91.6.1.","status":"published","published":"2022-12-22T20:15:12.647Z","modified":"2026-11-03T07:30:23.255194213Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T07:50:38.973973Z"},{"id":"CVE-2022-0566","description":"It may be possible for an attacker to craft an email message that causes Thunderbird to perform an out-of-bounds write of one byte when processing the message. This vulnerability affects Thunderbird \u003c 91.6.1.","status":"published","published":"2022-12-22T20:15:12.647Z","modified":"2026-04-16T04:31:19.013393236Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:22.824781Z"},{"id":"DEBIAN-CVE-2022-0566","description":"It may be possible for an attacker to craft an email message that causes Thunderbird to perform an out-of-bounds write of one byte when processing the message. This vulnerability affects Thunderbird \u003c 91.6.1.","status":"published","published":"2022-12-22T20:15:12.647Z","modified":"2026-11-03T08:00:04.868498601Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T08:25:15.646766Z"},{"id":"RHSA-2022:0843","title":"Red Hat Security Advisory: thunderbird security update","status":"published","published":"2024-09-17T01:16:35Z","modified":"2026-10-15T10:02:20Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:09.077222Z"},{"id":"RHSA-2022:0845","title":"Red Hat Security Advisory: thunderbird security update","status":"published","published":"2024-09-17T01:16:51Z","modified":"2026-10-15T10:02:21Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:09.077222Z"},{"id":"RHSA-2022:0847","title":"Red Hat Security Advisory: thunderbird security update","status":"published","published":"2024-09-17T01:17:00Z","modified":"2026-10-15T10:02:22Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:09.077222Z"},{"id":"RHSA-2022:0850","title":"Red Hat Security Advisory: thunderbird security update","status":"published","published":"2024-09-17T01:16:43Z","modified":"2026-10-15T10:02:22Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:09.077222Z"},{"id":"RHSA-2022:0853","title":"Red Hat Security Advisory: thunderbird security update","status":"published","published":"2024-09-17T01:16:27Z","modified":"2026-10-15T10:02:23Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:09.077222Z"},{"id":"RLSA-2022:0845","title":"Important: thunderbird security update","description":"Mozilla Thunderbird is a standalone mail and newsgroup client.\n\nThis update upgrades Thunderbird to version 91.7.0.\n\nSecurity Fix(es):\n\n* Mozilla: Use-after-free in XSLT parameter processing (CVE-2022-26485)\n\n* Mozilla: Use-after-free in WebGPU IPC Framework (CVE-2022-26486)\n\n* expat: Malformed 2- and 3-byte UTF-8 sequences can lead to arbitrary code execution (CVE-2022-25235)\n\n* expat: Namespace-separator characters in \"xmlns[:prefix]\" attribute values can lead to arbitrary code execution (CVE-2022-25236)\n\n* expat: Integer overflow in storeRawNames() (CVE-2022-25315)\n\n* Mozilla: Use-after-free in text reflows (CVE-2022-26381)\n\n* Mozilla: Browser window spoof using fullscreen mode (CVE-2022-26383)\n\n* Mozilla: iframe allow-scripts sandbox bypass (CVE-2022-26384)\n\n* Mozilla: Time-of-check time-of-use bug when verifying add-on signatures (CVE-2022-26387)\n\n* thunderbird: Crafted email could trigger an out-of-bounds write (CVE-2022-0566)\n\n* Mozilla: Temporary files downloaded to /tmp and accessible by other local users (CVE-2022-26386)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2022-03-14T09:49:10Z","modified":"2026-02-04T11:15:10.449754Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:24.322216Z"},{"id":"UBUNTU-CVE-2022-0566","description":"It may be possible for an attacker to craft an email message that causes Thunderbird to perform an out-of-bounds write of one byte when processing the message. This vulnerability affects Thunderbird \u003c 91.6.1.","status":"published","published":"2022-02-18T00:00:00Z","modified":"2026-04-22T13:11:33.627277Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:53:51.630172Z"},{"id":"ALSA-2022:0845","title":"Important: thunderbird security update","description":"Mozilla Thunderbird is a standalone mail and newsgroup client.\n\nThis update upgrades Thunderbird to version 91.7.0.\n\nSecurity Fix(es):\n\n* Mozilla: Use-after-free in XSLT parameter processing (CVE-2022-26485)\n\n* Mozilla: Use-after-free in WebGPU IPC Framework (CVE-2022-26486)\n\n* expat: Malformed 2- and 3-byte UTF-8 sequences can lead to arbitrary code execution (CVE-2022-25235)\n\n* expat: Namespace-separator characters in \"xmlns[:prefix]\" attribute values can lead to arbitrary code execution (CVE-2022-25236)\n\n* expat: Integer overflow in storeRawNames() (CVE-2022-25315)\n\n* Mozilla: Use-after-free in text reflows (CVE-2022-26381)\n\n* Mozilla: Browser window spoof using fullscreen mode (CVE-2022-26383)\n\n* Mozilla: iframe allow-scripts sandbox bypass (CVE-2022-26384)\n\n* Mozilla: Time-of-check time-of-use bug when verifying add-on signatures (CVE-2022-26387)\n\n* thunderbird: Crafted email could trigger an out-of-bounds write (CVE-2022-0566)\n\n* Mozilla: Temporary files downloaded to /tmp and accessible by other local users (CVE-2022-26386)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2022-03-14T09:49:10Z","modified":"2026-10-29T11:01:14.240360201Z","updated_at":"2026-11-02T15:27:51.196609Z"},{"id":"DLA-2930-1","title":"thunderbird - security update","status":"published","published":"2022-03-01T00:00:00Z","modified":"2026-03-09T01:23:11.625615Z","updated_at":"2026-11-02T15:46:11.189256Z"},{"id":"DSA-5086-1","title":"thunderbird - security update","status":"published","published":"2022-02-23T00:00:00Z","modified":"2026-03-09T02:10:56.676035Z","updated_at":"2026-11-02T15:46:17.543497Z"},{"id":"MGASA-2022-0072","title":"Updated thunderbird packages fix security vulnerability","description":"Crafted email could trigger an out-of-bounds write. (CVE-2022-0566)\n","status":"published","published":"2022-02-18T00:14:24Z","modified":"2026-04-16T04:43:48.03763051Z","updated_at":"2026-11-02T15:49:41.849028Z"},{"id":"openSUSE-SU-2022:0559-1","title":"Security update for MozillaThunderbird","description":"This update for MozillaThunderbird fixes the following issues:\n\n- Mozilla Thunderbird 91.6.1 / MFSA 2022-07 (bsc#1196072)\n  * CVE-2022-0566 (bmo#1753094)\n    Crafted email could trigger an out-of-bounds write\n\n- Mozilla Thunderbird 91.6 / MFSA 2022-06 (bsc#1195682)\n  * CVE-2022-22753 (bmo#1732435)\n    Privilege Escalation to SYSTEM on Windows via Maintenance\n    Service\n  * CVE-2022-22754 (bmo#1750565)\n    Extensions could have bypassed permission confirmation during\n    update\n  * CVE-2022-22756 (bmo#1317873)\n    Drag and dropping an image could have resulted in the dropped\n    object being an executable\n  * CVE-2022-22759 (bmo#1739957)\n    Sandboxed iframes could have executed script if the parent\n    appended elements\n  * CVE-2022-22760 (bmo#1740985, bmo#1748503)\n    Cross-Origin responses could be distinguished between script\n    and non-script content-types\n  * CVE-2022-22761 (bmo#1745566)\n    frame-ancestors Content Security Policy directive was not\n    enforced for framed extension pages\n  * CVE-2022-22763 (bmo#1740534)\n    Script Execution during invalid object state\n  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,\n    bmo#1748210, bmo#1748279)\n    Memory safety bugs fixed in Thunderbird 91.6\n","status":"published","published":"2022-02-23T14:04:58Z","modified":"2026-02-04T02:33:10.635726Z","updated_at":"2026-11-02T16:58:32.653274Z"},{"id":"openSUSE-SU-2024:11856-1","title":"MozillaThunderbird-91.6.1-1.1 on GA media","description":"These are all security issues fixed in the MozillaThunderbird-91.6.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:29:45.124866Z","updated_at":"2026-11-02T16:58:35.485255Z"},{"id":"SUSE-SU-2022:0559-1","title":"Security update for MozillaThunderbird","description":"This update for MozillaThunderbird fixes the following issues:\n\n- Mozilla Thunderbird 91.6.1 / MFSA 2022-07 (bsc#1196072)\n  * CVE-2022-0566 (bmo#1753094)\n    Crafted email could trigger an out-of-bounds write\n\n- Mozilla Thunderbird 91.6 / MFSA 2022-06 (bsc#1195682)\n  * CVE-2022-22753 (bmo#1732435)\n    Privilege Escalation to SYSTEM on Windows via Maintenance\n    Service\n  * CVE-2022-22754 (bmo#1750565)\n    Extensions could have bypassed permission confirmation during\n    update\n  * CVE-2022-22756 (bmo#1317873)\n    Drag and dropping an image could have resulted in the dropped\n    object being an executable\n  * CVE-2022-22759 (bmo#1739957)\n    Sandboxed iframes could have executed script if the parent\n    appended elements\n  * CVE-2022-22760 (bmo#1740985, bmo#1748503)\n    Cross-Origin responses could be distinguished between script\n    and non-script content-types\n  * CVE-2022-22761 (bmo#1745566)\n    frame-ancestors Content Security Policy directive was not\n    enforced for framed extension pages\n  * CVE-2022-22763 (bmo#1740534)\n    Script Execution during invalid object state\n  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,\n    bmo#1748210, bmo#1748279)\n    Memory safety bugs fixed in Thunderbird 91.6\n","status":"published","published":"2022-02-23T14:04:57Z","modified":"2026-02-04T03:55:37.972188Z","updated_at":"2026-11-02T15:53:50.066806Z"},{"id":"USN-5345-1","title":"thunderbird vulnerabilities","description":"Multiple security issues were discovered in Thunderbird. If a user were\ntricked into opening a specially crafted website in a browsing context,\nan attacker could potentially exploit these to cause a denial of service,\nbypass security restrictions, obtain sensitive information, cause\nundefined behaviour, spoof the browser UI, or execute arbitrary code.\n(CVE-2022-22759, CVE-2022-22760, CVE-2022-22761, CVE-2022-22763,\nCVE-2022-22764, CVE-2022-26381, CVE-2022-26383, CVE-2022-26384)\n\nIt was discovered that extensions of a particular type could auto-update\nthemselves and bypass the prompt that requests permissions. If a user\nwere tricked into installing a specially crafted extension, an attacker\ncould potentially exploit this to bypass security restrictions.\n(CVE-2022-22754)\n\nIt was discovered that dragging and dropping an image into a folder could\nresult in it being marked as executable. If a user were tricked into\ndragging and dropping a specially crafted image, an attacker could\npotentially exploit this to execute arbitrary code. (CVE-2022-22756)\n\nIt was discovered that files downloaded to /tmp were accessible to other\nusers. A local attacker could exploit this to obtain sensitive\ninformation. (CVE-2022-26386)\n\nA TOCTOU bug was discovered when verifying addon signatures during\ninstall. A local attacker could potentially exploit this to trick a\nuser into installing an addon with an invalid signature.\n(CVE-2022-26387)\n\nAn out-of-bounds write by one byte was discovered when processing\nmessages in some circumstances. If a user were tricked into opening a\nspecially crafted message, an attacker could potentially exploit this\nto cause a denial of service. (CVE-2022-0566)\n","status":"published","published":"2022-03-23T22:44:15Z","modified":"2026-04-22T10:22:34.372969Z","updated_at":"2026-11-02T16:58:15.683829Z"}]}}