{"id":"CVE-2022-1197","aliases":["ALPINE-CVE-2022-1197","ALSA-2022:1301","DEBIAN-CVE-2022-1197","DLA-2978-1","DSA-5118-1","EUVD-2022-24537","GHSA-h922-mv7w-mhm4","MGASA-2022-0157","RHSA-2022:1301","RHSA-2022:1302","RHSA-2022:1303","RHSA-2022:1305","RHSA-2022:1326","RLSA-2022:1301","SUSE-SU-2022:1176-1","UBUNTU-CVE-2022-1197","USN-5393-1"],"status":"published","title":"When importing a revoked key that specified key compromise as the revocation reason, Thunderbird...","description":"When importing a revoked key that specified key compromise as the revocation reason, Thunderbird did not update the existing copy of the key that was not yet revoked, and the existing key was kept as non-revoked. Revocation statements that used another revocation reason, or that didn't specify a revocation reason, were unaffected. This vulnerability affects Thunderbird \u003c 91.8.","severity":{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.00397,"percentile":0.34296,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-295"],"published":"2022-04-07T00:00:00Z","modified":"2026-11-03T08:01:58Z","fixes":[{"ecosystem":"Alpine:v3.16","package":"thunderbird","fixed_in":["91.8.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"thunderbird","fixed_in":["91.8.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"thunderbird","fixed_in":["91.8.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"thunderbird","fixed_in":["91.8.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"thunderbird","fixed_in":["91.8.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"thunderbird","fixed_in":["91.8.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"thunderbird","fixed_in":["91.8.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"thunderbird","fixed_in":["91.8.0-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"thunderbird","fixed_in":["1:91.8.0-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"thunderbird","fixed_in":["1:91.8.0-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"thunderbird","fixed_in":["1:91.8.0-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"thunderbird","fixed_in":["1:91.8.1+build1-0ubuntu0.18.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"thunderbird","fixed_in":["1:91.8.1+build1-0ubuntu0.20.04.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.16","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"91.8.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"91.8.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"91.8.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"91.8.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"91.8.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"91.8.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"91.8.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"91.8.0-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"91.8.0-1.el8_5.alma"}]}],"bundled":9},{"source":"osv","ecosystem":"AlmaLinux:8","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"91.8.0-1.el8_5.alma.plus"}]}],"bundled":9},{"source":"osv","ecosystem":"Debian:12","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:91.8.0-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:91.8.0-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:91.8.0-1"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:91.8.0-1~deb9u1"}]}],"versions":["1.5-4","1.5.0.2-1","1.5.0.2-2","1.5.0.2-3","1.5.0.4-1","1.5.0.4-2","1.5.0.4-3","1.5.0.5-1","1.5.0.7-1","1.5.0.7-2","1:52.4.0-1","1:52.4.0-1~deb7u1","1:52.4.0-1~deb8u1","1:52.4.0-1~deb9u1","1:52.4.0-2~exp1","1:52.5.0-1","1:52.5.0-1~deb7u1","1:52.5.0-1~deb8u1","1:52.5.0-1~deb9u1","1:52.5.2-1","1:52.5.2-1~deb7u1","1:52.5.2-2","1:52.5.2-2~deb8u1","1:52.5.2-2~deb9u1","1:52.6.0-1","1:52.6.0-1+alpha.1","1:52.6.0-1+alpha.2","1:52.6.0-1~deb7u1","1:52.6.0-1~deb8u1","1:52.6.0-1~deb9u1","1:52.7.0-1","1:52.7.0-1~deb7u1","1:52.7.0-1~deb8u1","1:52.7.0-1~deb9u1","1:52.8.0-1","1:52.8.0-1~deb7u1","1:52.8.0-1~deb8u1","1:52.8.0-1~deb9u1","1:52.9.0-1","1:52.9.1-1","1:52.9.1-1~deb8u1","1:52.9.1-1~deb9u1","1:58.0~b3-1","1:60.0-1","1:60.0-2","1:60.0-2~deb9u1","1:60.0-3","1:60.0-3~deb9u1","1:60.0~b10-1","1:60.0~b2-1","1:60.0~b3-1","1:60.0~b4-1","1:60.0~b5-1","1:60.0~b6-1","1:60.0~b9-1","1:60.0~b9-2","1:60.2.1-1","1:60.2.1-2~deb9u1","1:60.3.0-1","1:60.3.0-1~deb8u1","1:60.3.0-1~deb9u1","1:60.3.1-1","1:60.4.0-1","1:60.4.0-1~deb8u1","1:60.4.0-1~deb9u1","1:60.5.0-1","1:60.5.0-2","1:60.5.0-3","1:60.5.1-1","1:60.5.1-1~deb8u1","1:60.5.1-1~deb9u1","1:60.6.1-1","1:60.6.1-1~deb8u1","1:60.6.1-1~deb9u1","1:60.7.0-1","1:60.7.0-1~deb8u1","1:60.7.0-1~deb9u1","1:60.7.1-1","1:60.7.1-1~deb8u1","1:60.7.1-1~deb9u1","1:60.7.2-1","1:60.7.2-1~deb8u1","1:60.7.2-1~deb9u1","1:60.8.0-1","1:60.8.0-1~deb10u1","1:60.8.0-1~deb8u1","1:60.8.0-1~deb9u1","1:60.8.0-2","1:60.9.0-1","1:60.9.0-1~deb10u1","1:60.9.0-1~deb8u1","1:60.9.0-1~deb9u1","1:65.0~b1-1","1:66.0~b1-1","1:67.0~b3-1","1:68.0~b1-1","1:68.1.1-1~exp1","1:68.1.2-1~exp1","1:68.10.0-1","1:68.10.0-1~deb10u1","1:68.10.0-1~deb9u1","1:68.11.0-1","1:68.11.0-1~deb10u1","1:68.11.0-1~deb9u1","1:68.11.0-2","1:68.11.0-3","1:68.12.0-1","1:68.12.0-1~deb10u1","1:68.12.0-1~deb9u1","1:68.12.0-1~deb9u2","1:68.2.1-1","1:68.2.2-1","1:68.2.2-1~deb10u1","1:68.2.2-1~deb8u1","1:68.2.2-1~deb9u1","1:68.3.0-1","1:68.3.0-2","1:68.3.0-2~deb10u1","1:68.3.0-2~deb8u1","1:68.3.0-2~deb9u1","1:68.3.1-1","1:68.4.1-1","1:68.4.1-1~deb10u1","1:68.4.1-1~deb8u1","1:68.4.1-1~deb9u1","1:68.4.2-1","1:68.5.0-1","1:68.5.0-1~deb10u1","1:68.5.0-1~deb8u1","1:68.5.0-1~deb9u1","1:68.6.0-1","1:68.6.0-1~deb10u1","1:68.6.0-1~deb8u1","1:68.6.0-1~deb9u1","1:68.7.0-1","1:68.7.0-1~deb10u1","1:68.7.0-1~deb8u1","1:68.7.0-1~deb9u1","1:68.8.0-1","1:68.8.0-1~deb10u1","1:68.8.0-1~deb8u1","1:68.8.0-1~deb9u1","1:68.8.1-1","1:68.9.0-1","1:68.9.0-1~deb10u1","1:68.9.0-1~deb8u1","1:68.9.0-1~deb8u2","1:68.9.0-1~deb9u1","1:76.0~b1-1","1:76.0~b2-1","1:77.0~b1-1","1:77.0~b2-1","1:77.0~b3-1","1:78.0-1","1:78.0.1-1","1:78.0~b1-1","1:78.0~b2-1","1:78.1.0-1","1:78.1.1-1","1:78.10.0-1","1:78.10.0-1~deb10u1","1:78.10.0-1~deb9u1","1:78.10.2-1","1:78.11.0-1","1:78.11.0-1~deb10u1","1:78.11.0-1~deb9u1","1:78.11.0-2","1:78.12.0-1","1:78.12.0-1~deb10u1","1:78.12.0-1~deb9u1","1:78.13.0-1","1:78.13.0-1~deb10u1","1:78.13.0-1~deb11u1","1:78.13.0-1~deb9u1","1:78.14.0-1","1:78.14.0-1~deb10u1","1:78.14.0-1~deb11u1","1:78.14.0-1~deb9u1","1:78.2.0-1","1:78.2.1-1","1:78.2.2-1","1:78.3.1-1","1:78.3.1-2","1:78.3.1-2~deb10u1","1:78.3.1-2~deb10u2","1:78.3.1-2~deb9u1","1:78.3.2-1","1:78.3.3-1","1:78.4.0-1","1:78.4.0-1~deb10u1","1:78.4.0-1~deb9u1","1:78.4.1-1","1:78.4.2-1","1:78.4.2-1~deb10u1","1:78.4.2-1~deb9u1","1:78.5.0-1","1:78.5.0-1~deb10u1","1:78.5.0-1~deb9u1","1:78.5.1-1","1:78.5.1-1~deb10u1","1:78.5.1-1~deb9u1","1:78.6.0-1","1:78.6.0-1~deb10u1","1:78.6.0-1~deb9u1","1:78.6.1-1","1:78.7.0-1","1:78.7.0-1~deb10u1","1:78.7.0-1~deb9u1","1:78.7.1-1","1:78.8.0-1","1:78.8.0-1~deb10u1","1:78.8.0-1~deb9u1","1:78.9.0-1","1:78.9.0-1~deb10u1","1:78.9.0-1~deb9u1","1:84.0~b3-1","1:85.0~b3-1","1:86.0~b3-1","1:88.0~b2-1","1:89.0~b2-1","1:90.0~b2-1","1:91.0-1","1:91.0.2-1","1:91.0~b1-1","1:91.0~b3-1","1:91.0~b5-1","1:91.1.0-1","1:91.1.1-1","1:91.2.0-1","1:91.2.1-1","1:91.3.0-1","1:91.3.2-1","1:91.4.0-1","1:91.4.1-1","1:91.4.1-1~deb10u1","1:91.4.1-1~deb11u1","1:91.4.1-1~deb9u1","1:91.5.0-1","1:91.5.0-1~deb9u1","1:91.5.0-2","1:91.5.0-2~deb10u1","1:91.5.0-2~deb11u1","1:91.5.1-1","1:91.6.0-1","1:91.6.0-1~deb10u1","1:91.6.0-1~deb11u1","1:91.6.0-1~deb9u1","1:91.6.1-1","1:91.6.1-1~deb10u1","1:91.6.1-1~deb11u1","1:91.6.1-1~deb9u1","1:91.6.2-1","1:91.6.2-1~deb10u1","1:91.6.2-1~deb11u1","1:91.6.2-1~deb9u1","1:91.7.0-1","1:91.7.0-2","1:91.7.0-2~deb10u1","1:91.7.0-2~deb11u1","1:91.7.0-2~deb9u1"],"bundled":9},{"source":"osv","ecosystem":"Debian:10","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:91.8.0-1~deb10u1"}]}],"versions":["1:60.7.2-1","1:60.8.0-1","1:60.8.0-1~deb10u1","1:60.8.0-1~deb8u1","1:60.8.0-1~deb9u1","1:60.8.0-2","1:60.9.0-1","1:60.9.0-1~deb10u1","1:60.9.0-1~deb8u1","1:60.9.0-1~deb9u1","1:65.0~b1-1","1:66.0~b1-1","1:67.0~b3-1","1:68.0~b1-1","1:68.1.1-1~exp1","1:68.1.2-1~exp1","1:68.10.0-1","1:68.10.0-1~deb10u1","1:68.10.0-1~deb9u1","1:68.11.0-1","1:68.11.0-1~deb10u1","1:68.11.0-1~deb9u1","1:68.11.0-2","1:68.11.0-3","1:68.12.0-1","1:68.12.0-1~deb10u1","1:68.12.0-1~deb9u1","1:68.12.0-1~deb9u2","1:68.2.1-1","1:68.2.2-1","1:68.2.2-1~deb10u1","1:68.2.2-1~deb8u1","1:68.2.2-1~deb9u1","1:68.3.0-1","1:68.3.0-2","1:68.3.0-2~deb10u1","1:68.3.0-2~deb8u1","1:68.3.0-2~deb9u1","1:68.3.1-1","1:68.4.1-1","1:68.4.1-1~deb10u1","1:68.4.1-1~deb8u1","1:68.4.1-1~deb9u1","1:68.4.2-1","1:68.5.0-1","1:68.5.0-1~deb10u1","1:68.5.0-1~deb8u1","1:68.5.0-1~deb9u1","1:68.6.0-1","1:68.6.0-1~deb10u1","1:68.6.0-1~deb8u1","1:68.6.0-1~deb9u1","1:68.7.0-1","1:68.7.0-1~deb10u1","1:68.7.0-1~deb8u1","1:68.7.0-1~deb9u1","1:68.8.0-1","1:68.8.0-1~deb10u1","1:68.8.0-1~deb8u1","1:68.8.0-1~deb9u1","1:68.8.1-1","1:68.9.0-1","1:68.9.0-1~deb10u1","1:68.9.0-1~deb8u1","1:68.9.0-1~deb8u2","1:68.9.0-1~deb9u1","1:76.0~b1-1","1:76.0~b2-1","1:77.0~b1-1","1:77.0~b2-1","1:77.0~b3-1","1:78.0-1","1:78.0.1-1","1:78.0~b1-1","1:78.0~b2-1","1:78.1.0-1","1:78.1.1-1","1:78.10.0-1","1:78.10.0-1~deb10u1","1:78.10.0-1~deb9u1","1:78.10.2-1","1:78.11.0-1","1:78.11.0-1~deb10u1","1:78.11.0-1~deb9u1","1:78.11.0-2","1:78.12.0-1","1:78.12.0-1~deb10u1","1:78.12.0-1~deb9u1","1:78.13.0-1","1:78.13.0-1~deb10u1","1:78.13.0-1~deb11u1","1:78.13.0-1~deb9u1","1:78.14.0-1","1:78.14.0-1~deb10u1","1:78.14.0-1~deb11u1","1:78.14.0-1~deb9u1","1:78.2.0-1","1:78.2.1-1","1:78.2.2-1","1:78.3.1-1","1:78.3.1-2","1:78.3.1-2~deb10u1","1:78.3.1-2~deb10u2","1:78.3.1-2~deb9u1","1:78.3.2-1","1:78.3.3-1","1:78.4.0-1","1:78.4.0-1~deb10u1","1:78.4.0-1~deb9u1","1:78.4.1-1","1:78.4.2-1","1:78.4.2-1~deb10u1","1:78.4.2-1~deb9u1","1:78.5.0-1","1:78.5.0-1~deb10u1","1:78.5.0-1~deb9u1","1:78.5.1-1","1:78.5.1-1~deb10u1","1:78.5.1-1~deb9u1","1:78.6.0-1","1:78.6.0-1~deb10u1","1:78.6.0-1~deb9u1","1:78.6.1-1","1:78.7.0-1","1:78.7.0-1~deb10u1","1:78.7.0-1~deb9u1","1:78.7.1-1","1:78.8.0-1","1:78.8.0-1~deb10u1","1:78.8.0-1~deb9u1","1:78.9.0-1","1:78.9.0-1~deb10u1","1:78.9.0-1~deb9u1","1:84.0~b3-1","1:85.0~b3-1","1:86.0~b3-1","1:88.0~b2-1","1:89.0~b2-1","1:90.0~b2-1","1:91.0-1","1:91.0.2-1","1:91.0~b1-1","1:91.0~b3-1","1:91.0~b5-1","1:91.1.0-1","1:91.1.1-1","1:91.2.0-1","1:91.2.1-1","1:91.3.0-1","1:91.3.2-1","1:91.4.0-1","1:91.4.1-1","1:91.4.1-1~deb10u1","1:91.4.1-1~deb11u1","1:91.4.1-1~deb9u1","1:91.5.0-1","1:91.5.0-1~deb9u1","1:91.5.0-2","1:91.5.0-2~deb10u1","1:91.5.0-2~deb11u1","1:91.5.1-1","1:91.6.0-1","1:91.6.0-1~deb10u1","1:91.6.0-1~deb11u1","1:91.6.0-1~deb9u1","1:91.6.1-1","1:91.6.1-1~deb10u1","1:91.6.1-1~deb11u1","1:91.6.1-1~deb9u1","1:91.6.2-1","1:91.6.2-1~deb10u1","1:91.6.2-1~deb11u1","1:91.6.2-1~deb9u1","1:91.7.0-1","1:91.7.0-2","1:91.7.0-2~deb10u1","1:91.7.0-2~deb11u1","1:91.7.0-2~deb9u1","1:91.8.0-1~deb9u1"],"bundled":9},{"source":"osv","ecosystem":"Debian:11","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:91.8.0-1~deb11u1"}]}],"versions":["1:78.12.0-1","1:78.13.0-1","1:78.13.0-1~deb10u1","1:78.13.0-1~deb11u1","1:78.13.0-1~deb9u1","1:78.14.0-1","1:78.14.0-1~deb10u1","1:78.14.0-1~deb11u1","1:78.14.0-1~deb9u1","1:84.0~b3-1","1:85.0~b3-1","1:86.0~b3-1","1:88.0~b2-1","1:89.0~b2-1","1:90.0~b2-1","1:91.0-1","1:91.0.2-1","1:91.0~b1-1","1:91.0~b3-1","1:91.0~b5-1","1:91.1.0-1","1:91.1.1-1","1:91.2.0-1","1:91.2.1-1","1:91.3.0-1","1:91.3.2-1","1:91.4.0-1","1:91.4.1-1","1:91.4.1-1~deb10u1","1:91.4.1-1~deb11u1","1:91.4.1-1~deb9u1","1:91.5.0-1","1:91.5.0-1~deb9u1","1:91.5.0-2","1:91.5.0-2~deb10u1","1:91.5.0-2~deb11u1","1:91.5.1-1","1:91.6.0-1","1:91.6.0-1~deb10u1","1:91.6.0-1~deb11u1","1:91.6.0-1~deb9u1","1:91.6.1-1","1:91.6.1-1~deb10u1","1:91.6.1-1~deb11u1","1:91.6.1-1~deb9u1","1:91.6.2-1","1:91.6.2-1~deb10u1","1:91.6.2-1~deb11u1","1:91.6.2-1~deb9u1","1:91.7.0-1","1:91.7.0-2","1:91.7.0-2~deb10u1","1:91.7.0-2~deb11u1","1:91.7.0-2~deb9u1","1:91.8.0-1~deb10u1","1:91.8.0-1~deb9u1"],"bundled":9},{"source":"osv","ecosystem":"Mageia:8","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"91.8.1-1.1.mga8"}]}],"bundled":12},{"source":"osv","ecosystem":"Mageia:8","package":"thunderbird-l10n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"91.8.1-1.mga8"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:91.8.0-1.el8_5"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"thunderbird-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:91.8.0-1.el8_5"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"thunderbird-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:91.8.0-1.el8_5"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:91.8.0-1.el7_9"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"thunderbird-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:91.8.0-1.el7_9"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:91.8.0-1.el7_9"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"thunderbird-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:91.8.0-1.el7_9"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:91.8.0-1.el7_9"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"thunderbird-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:91.8.0-1.el7_9"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.1::appstream","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:91.8.0-1.el8_1"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.1::appstream","package":"thunderbird-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:91.8.0-1.el8_1"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.1::appstream","package":"thunderbird-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:91.8.0-1.el8_1"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::appstream","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:91.8.0-1.el8_4"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::appstream","package":"thunderbird-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:91.8.0-1.el8_4"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::appstream","package":"thunderbird-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:91.8.0-1.el8_4"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::appstream","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:91.8.0-1.el8_2"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::appstream","package":"thunderbird-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:91.8.0-1.el8_2"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::appstream","package":"thunderbird-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:91.8.0-1.el8_2"}]}],"bundled":9},{"source":"osv","ecosystem":"Rocky Linux:8","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:91.8.0-1.el8_5"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP3","package":"MozillaThunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"91.8.0-150200.8.65.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP4","package":"MozillaThunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"91.8.0-150200.8.65.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP3","package":"MozillaThunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"91.8.0-150200.8.65.1"}]}],"bundled":9},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"MozillaThunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"91.8.0-150200.8.65.1"}]}],"bundled":9},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:91.8.1+build1-0ubuntu0.18.04.1"}]}],"versions":["1:52.4.0+build1-0ubuntu2","1:52.6.0+build1-0ubuntu1","1:52.7.0+build1-0ubuntu1","1:52.8.0+build1-0ubuntu0.18.04.1","1:52.9.1+build3-0ubuntu0.18.04.1","1:60.2.1+build1-0ubuntu0.18.04.2","1:60.4.0+build2-0ubuntu0.18.04.1","1:60.5.1+build2-0ubuntu0.18.04.1","1:60.6.1+build2-0ubuntu0.18.04.1","1:60.7.0+build1-0ubuntu0.18.04.1","1:60.7.1+build1-0ubuntu0.18.04.1","1:60.7.2+build2-0ubuntu0.18.04.1","1:60.8.0+build1-0ubuntu0.18.04.1","1:60.9.0+build1-0ubuntu0.18.04.1","1:68.2.1+build1-0ubuntu0.18.04.1","1:68.2.2+build1-0ubuntu0.18.04.1","1:68.4.1+build1-0ubuntu0.18.04.1","1:68.7.0+build1-0ubuntu0.18.04.1","1:68.8.0+build2-0ubuntu0.18.04.2","1:68.10.0+build1-0ubuntu0.18.04.1","1:78.8.1+build1-0ubuntu0.18.04.1","1:78.11.0+build1-0ubuntu0.18.04.2","1:78.13.0+build1-0ubuntu0.18.04.1","1:78.14.0+build1-0ubuntu0.18.04.1","1:78.14.0+build1-0ubuntu0.18.04.2","1:91.5.0+build1-0ubuntu0.18.04.1","1:91.7.0+build2-0ubuntu0.18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:91.8.1+build1-0ubuntu0.20.04.1"}]}],"versions":["1:68.1.2+build1-0ubuntu1","1:68.1.2+build1-0ubuntu2","1:68.2.1+build1-0ubuntu1","1:68.2.2+build1-0ubuntu1","1:68.3.0+build2-0ubuntu1","1:68.3.1+build1-0ubuntu2","1:68.4.1+build1-0ubuntu1","1:68.4.2+build2-0ubuntu1","1:68.5.0+build1-0ubuntu1","1:68.6.0+build2-0ubuntu1","1:68.7.0+build1-0ubuntu1","1:68.7.0+build1-0ubuntu2","1:68.8.0+build2-0ubuntu0.20.04.2","1:68.10.0+build1-0ubuntu0.20.04.1","1:78.7.1+build1-0ubuntu0.20.04.1","1:78.8.1+build1-0ubuntu0.20.04.1","1:78.11.0+build1-0ubuntu0.20.04.2","1:78.13.0+build1-0ubuntu0.20.04.2","1:78.14.0+build1-0ubuntu0.20.04.1","1:78.14.0+build1-0ubuntu0.20.04.2","1:91.5.0+build1-0ubuntu0.20.04.1","1:91.7.0+build2-0ubuntu0.20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:91.8.1+build1-0ubuntu0.18.04.1"}]}],"versions":["1:52.4.0+build1-0ubuntu2","1:52.6.0+build1-0ubuntu1","1:52.7.0+build1-0ubuntu1","1:52.8.0+build1-0ubuntu0.18.04.1","1:52.9.1+build3-0ubuntu0.18.04.1","1:60.2.1+build1-0ubuntu0.18.04.2","1:60.4.0+build2-0ubuntu0.18.04.1","1:60.5.1+build2-0ubuntu0.18.04.1","1:60.6.1+build2-0ubuntu0.18.04.1","1:60.7.0+build1-0ubuntu0.18.04.1","1:60.7.1+build1-0ubuntu0.18.04.1","1:60.7.2+build2-0ubuntu0.18.04.1","1:60.8.0+build1-0ubuntu0.18.04.1","1:60.9.0+build1-0ubuntu0.18.04.1","1:68.2.1+build1-0ubuntu0.18.04.1","1:68.2.2+build1-0ubuntu0.18.04.1","1:68.4.1+build1-0ubuntu0.18.04.1","1:68.7.0+build1-0ubuntu0.18.04.1","1:68.8.0+build2-0ubuntu0.18.04.2","1:68.10.0+build1-0ubuntu0.18.04.1","1:78.8.1+build1-0ubuntu0.18.04.1","1:78.11.0+build1-0ubuntu0.18.04.2","1:78.13.0+build1-0ubuntu0.18.04.1","1:78.14.0+build1-0ubuntu0.18.04.1","1:78.14.0+build1-0ubuntu0.18.04.2","1:91.5.0+build1-0ubuntu0.18.04.1","1:91.7.0+build2-0ubuntu0.18.04.1"],"bundled":8},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:91.8.1+build1-0ubuntu0.20.04.1"}]}],"versions":["1:68.1.2+build1-0ubuntu1","1:68.1.2+build1-0ubuntu2","1:68.2.1+build1-0ubuntu1","1:68.2.2+build1-0ubuntu1","1:68.3.0+build2-0ubuntu1","1:68.3.1+build1-0ubuntu2","1:68.4.1+build1-0ubuntu1","1:68.4.2+build2-0ubuntu1","1:68.5.0+build1-0ubuntu1","1:68.6.0+build2-0ubuntu1","1:68.7.0+build1-0ubuntu1","1:68.7.0+build1-0ubuntu2","1:68.8.0+build2-0ubuntu0.20.04.2","1:68.10.0+build1-0ubuntu0.20.04.1","1:78.7.1+build1-0ubuntu0.20.04.1","1:78.8.1+build1-0ubuntu0.20.04.1","1:78.11.0+build1-0ubuntu0.20.04.2","1:78.13.0+build1-0ubuntu0.20.04.2","1:78.14.0+build1-0ubuntu0.20.04.1","1:78.14.0+build1-0ubuntu0.20.04.2","1:91.5.0+build1-0ubuntu0.20.04.1","1:91.7.0+build2-0ubuntu0.20.04.1"],"bundled":8}],"products":[{"vendor":"mozilla","product":"thunderbird"}],"references":[{"url":"https://www.mozilla.org/security/advisories/mfsa2022-15/","tags":["x_transferred","Vendor Advisory","advisory"]},{"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=1754985","tags":["x_transferred","Issue Tracking","Permissions Required","Vendor Advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-1197","tags":["advisory"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2022-15"},{"url":"https://github.com/advisories/GHSA-h922-mv7w-mhm4"},{"url":"https://security.alpinelinux.org/vuln/CVE-2022-1197","tags":["advisory"]},{"url":"https://vulners.com/cve/CVE-2022-1097","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2022-1196","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2022-1197","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2022-24713","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2022-28281","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2022-28282","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2022-28285","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2022-28286","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2022-28289","tags":["report"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-1197","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2022-0157.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=30250","tags":["report"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2022-15/","tags":["advisory"]},{"url":"https://www.thunderbird.net/en-US/thunderbird/91.8.0/releasenotes/","tags":["web"]},{"url":"https://www.thunderbird.net/en-US/thunderbird/91.8.1/releasenotes/","tags":["web"]},{"url":"https://access.redhat.com/errata/RHSA-2022:1301","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2072559","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2072560","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2072561","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2072562","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2072563","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2072564","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2072565","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2072566","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2072963","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_1301.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-1097","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-1097","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-1097","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-1196","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-1196","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-1196","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-1197","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-1197","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-24713","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-24713","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-24713","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-28281","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-28281","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-28281","tags":["advisory"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2022-14/#CVE-2022-28281","tags":["article"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2022-15/#CVE-2022-28281","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-28282","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-28282","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-28282","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-28285","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-28285","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-28285","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-28286","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-28286","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-28286","tags":["advisory"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2022-14/#CVE-2022-28286","tags":["article"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2022-15/#CVE-2022-28286","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-28289","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-28289","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-28289","tags":["advisory"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2022-14/#CVE-2022-28289","tags":["article"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2022-15/#CVE-2022-28289","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2022:1302","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_1302.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2022:1303","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_1303.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2022:1305","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_1305.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2022:1326","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_1326.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2022:1301","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20221176-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1197903","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-1097","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-1196","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-1197","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-24713","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-28281","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-28282","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-28285","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-28286","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-28289","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2022-1197","tags":["report"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2022-15/#CVE-2022-1197","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5393-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2022-1097","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-1196","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-28281","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-28282","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-28285","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-28286","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-28289","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2022-1197","description":"When importing a revoked key that specified key compromise as the revocation reason, Thunderbird did not update the existing copy of the key that was not yet revoked, and the existing key was kept as non-revoked. Revocation statements that used another revocation reason, or that didn't specify a revocation reason, were unaffected. This vulnerability affects Thunderbird \u003c 91.8.","status":"published","published":"2022-12-22T00:00:00Z","modified":"2025-04-16T15:25:49.637Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-295"],"updated_at":"2026-11-02T14:34:38.581997Z"}],"euvd":[{"id":"EUVD-2022-24537","description":"When importing a revoked key that specified key compromise as the revocation reason, Thunderbird did not update the existing copy of the key that was not yet revoked, and the existing key was kept as non-revoked. Revocation statements that used another revocation reason, or that didn't specify a revocation reason, were unaffected. This vulnerability affects Thunderbird \u003c 91.8.","status":"published","published":"2022-12-22T00:00:00Z","modified":"2025-04-16T15:25:49Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T20:52:25.343198Z"}],"ghsa":[{"id":"GHSA-h922-mv7w-mhm4","title":"When importing a revoked key that specified key compromise as the revocation reason, Thunderbird...","description":"When importing a revoked key that specified key compromise as the revocation reason, Thunderbird did not update the existing copy of the key that was not yet revoked, and the existing key was kept as non-revoked. Revocation statements that used another revocation reason, or that didn't specify a revocation reason, were unaffected. This vulnerability affects Thunderbird \u003c 91.8.","status":"published","published":"2022-12-22T21:30:31Z","modified":"2025-04-16T18:32:40Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-295"],"updated_at":"2026-11-02T15:01:35.927372Z"}],"nvd":[{"id":"CVE-2022-1197","description":"When importing a revoked key that specified key compromise as the revocation reason, Thunderbird did not update the existing copy of the key that was not yet revoked, and the existing key was kept as non-revoked. Revocation statements that used another revocation reason, or that didn't specify a revocation reason, were unaffected. This vulnerability affects Thunderbird \u003c 91.8.","status":"published","published":"2022-12-22T20:15:13.143Z","modified":"2026-06-17T04:21:59.753Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-295"],"updated_at":"2026-11-02T14:07:34.388163Z"}],"osv":[{"id":"ALPINE-CVE-2022-1197","description":"When importing a revoked key that specified key compromise as the revocation reason, Thunderbird did not update the existing copy of the key that was not yet revoked, and the existing key was kept as non-revoked. Revocation statements that used another revocation reason, or that didn't specify a revocation reason, were unaffected. This vulnerability affects Thunderbird \u003c 91.8.","status":"published","published":"2022-12-22T20:15:13.143Z","modified":"2026-11-03T07:30:11.438852487Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-03T07:50:38.973973Z"},{"id":"CVE-2022-1197","description":"When importing a revoked key that specified key compromise as the revocation reason, Thunderbird did not update the existing copy of the key that was not yet revoked, and the existing key was kept as non-revoked. Revocation statements that used another revocation reason, or that didn't specify a revocation reason, were unaffected. This vulnerability affects Thunderbird \u003c 91.8.","status":"published","published":"2022-12-22T20:15:13.143Z","modified":"2026-04-16T04:39:28.989290885Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:23.245966Z"},{"id":"DEBIAN-CVE-2022-1197","description":"When importing a revoked key that specified key compromise as the revocation reason, Thunderbird did not update the existing copy of the key that was not yet revoked, and the existing key was kept as non-revoked. Revocation statements that used another revocation reason, or that didn't specify a revocation reason, were unaffected. This vulnerability affects Thunderbird \u003c 91.8.","status":"published","published":"2022-12-22T20:15:13.143Z","modified":"2026-11-03T08:01:58.37594759Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-03T08:24:50.542442Z"},{"id":"RHSA-2022:1301","title":"Red Hat Security Advisory: thunderbird security update","status":"published","published":"2024-09-16T07:48:51Z","modified":"2025-11-22T12:32:15Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:09.077222Z"},{"id":"RHSA-2022:1302","title":"Red Hat Security Advisory: thunderbird security update","status":"published","published":"2024-09-16T07:48:36Z","modified":"2026-06-26T10:58:29Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:09.077222Z"},{"id":"RHSA-2022:1303","title":"Red Hat Security Advisory: thunderbird security update","status":"published","published":"2024-09-16T07:48:43Z","modified":"2025-11-22T12:32:16Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:09.077222Z"},{"id":"RHSA-2022:1305","title":"Red Hat Security Advisory: thunderbird security update","status":"published","published":"2024-09-16T07:48:58Z","modified":"2025-11-22T12:32:16Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:09.077222Z"},{"id":"RHSA-2022:1326","title":"Red Hat Security Advisory: thunderbird security update","status":"published","published":"2024-09-16T07:49:05Z","modified":"2025-11-22T12:32:19Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:09.077222Z"},{"id":"RLSA-2022:1301","title":"Important: thunderbird security update","description":"Mozilla Thunderbird is a standalone mail and newsgroup client.\n\nThis update upgrades Thunderbird to version 91.8.0.\n\nSecurity Fix(es):\n\n* Mozilla: Use-after-free in NSSToken objects (CVE-2022-1097)\n\n* Mozilla: Out of bounds write due to unexpected WebAuthN Extensions (CVE-2022-28281)\n\n* Mozilla: Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8 (CVE-2022-28289)\n\n* Mozilla: Use-after-free after VR Process destruction (CVE-2022-1196)\n\n* Mozilla: OpenPGP revocation information was ignored (CVE-2022-1197)\n\n* Mozilla: Use-after-free in DocumentL10n::TranslateDocument (CVE-2022-28282)\n\n* Mozilla: Incorrect AliasSet used in JIT Codegen (CVE-2022-28285)\n\n* Mozilla: Denial of Service via complex regular expressions (CVE-2022-24713)\n\n* Mozilla: iframe contents could be rendered outside the border (CVE-2022-28286)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2022-04-11T13:29:58Z","modified":"2026-02-05T14:15:10.728723Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:24.322216Z"},{"id":"UBUNTU-CVE-2022-1197","description":"When importing a revoked key that specified key compromise as the revocation reason, Thunderbird did not update the existing copy of the key that was not yet revoked, and the existing key was kept as non-revoked. Revocation statements that used another revocation reason, or that didn't specify a revocation reason, were unaffected. This vulnerability affects Thunderbird \u003c 91.8.","status":"published","published":"2022-04-07T00:00:00Z","modified":"2026-04-22T13:12:53.909622Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium"},{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T16:53:51.630172Z"},{"id":"ALSA-2022:1301","title":"Important: thunderbird security update","description":"Mozilla Thunderbird is a standalone mail and newsgroup client.\n\nThis update upgrades Thunderbird to version 91.8.0.\n\nSecurity Fix(es):\n\n* Mozilla: Use-after-free in NSSToken objects (CVE-2022-1097)\n\n* Mozilla: Out of bounds write due to unexpected WebAuthN Extensions (CVE-2022-28281)\n\n* Mozilla: Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8 (CVE-2022-28289)\n\n* Mozilla: Use-after-free after VR Process destruction (CVE-2022-1196)\n\n* Mozilla: OpenPGP revocation information was ignored (CVE-2022-1197)\n\n* Mozilla: Use-after-free in DocumentL10n::TranslateDocument (CVE-2022-28282)\n\n* Mozilla: Incorrect AliasSet used in JIT Codegen (CVE-2022-28285)\n\n* Mozilla: Denial of Service via complex regular expressions (CVE-2022-24713)\n\n* Mozilla: iframe contents could be rendered outside the border (CVE-2022-28286)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2022-04-11T13:29:58Z","modified":"2026-10-29T11:02:01.633119679Z","updated_at":"2026-11-02T15:27:51.196609Z"},{"id":"DLA-2978-1","title":"thunderbird - security update","status":"published","published":"2022-04-11T00:00:00Z","modified":"2026-03-09T01:18:14.535157Z","updated_at":"2026-11-02T15:46:11.189256Z"},{"id":"DSA-5118-1","title":"thunderbird - security update","status":"published","published":"2022-04-10T00:00:00Z","modified":"2026-03-09T02:11:29.345601Z","updated_at":"2026-11-02T15:46:17.543497Z"},{"id":"MGASA-2022-0157","title":"Updated thunderbird packages fix security vulnerabilities","description":"The updated thunderbird packages fix security vulnerabilities:\n\nUse-after-free in NSSToken objects (CVE-2022-1097).\n\nUse-after-free after VR Process destruction (CVE-2022-1196).\n\nOpenPGP revocation information was ignored (CVE-2022-1197).\n\nDenial of Service via complex regular expressions (CVE-2022-24713).\n\nxmltok_impl.c in Expat (aka libexpat) before 2.4.5 lacks certain validation\nof encoding, such as checks for whether a UTF-8 character is valid in a\ncertain context (CVE-2022-25235).\n\nxmlparse.c in Expat (aka libexpat) before 2.4.5 allows attackers to insert\nnamespace-separator characters into namespace URIs (CVE-2022-25236).\n\nIn Expat (aka libexpat) before 2.4.5, there is an integer overflow in\nstoreRawNames (CVE-2022-25315).\n\nOut of bounds write due to unexpected WebAuthN Extensions (CVE-2022-28281).\n\nUse-after-free in DocumentL10n::TranslateDocument (CVE-2022-28282).\n\nIncorrect AliasSet used in JIT Codegen (CVE-2022-28285).\n\niframe contents could be rendered outside the border (CVE-2022-28286).\n\nMemory safety bugs fixed in Thunderbird 91.8 (CVE-2022-28289).\n","status":"published","published":"2022-04-28T22:46:19Z","modified":"2026-04-16T04:42:50.677397177Z","updated_at":"2026-11-02T15:49:41.849028Z"},{"id":"SUSE-SU-2022:1176-1","title":"Security update for MozillaThunderbird","description":"This update for MozillaThunderbird fixes the following issues:\n\n- Updated to version 91.8 (bsc#1197903):\n  - CVE-2022-1097: Fixed a memory corruption issue with NSSToken objects.\n  - CVE-2022-28281: Fixed a memory corruption issue due to unexpected WebAuthN\n    Extensions.\n  - CVE-2022-1197: Fixed an issue where OpenPGP revocation information was ignored.\n  - CVE-2022-1196: Fixed a memory corruption issue after VR process destruction.\n  - CVE-2022-28282: Fixed a memory corruption issue in document translation.\n  - CVE-2022-28285: Fixed a memory corruption issue in JIT code generation.\n  - CVE-2022-28286: Fixed an iframe layout issue that could have been exploited\n    to stage spoofing attacks.\n  - CVE-2022-24713: Fixed a potential denial of service via complex regular\n    expressions.\n  - CVE-2022-28289: Fixed multiple memory corruption issues.\n\nNon-security fixes:\n\n- Changed Google accounts using password authentication to use OAuth2.\n- Fixed an issue where OpenPGP ECC keys created by Thunderbird could not be\n  imported into GnuPG.\n- Fixed an issue where exporting multiple public PGP keys from Thunderbird\n  was not possible.\n- Fixed an issue where replying to a newsgroup message erroneously displayed\n  a 'No-reply' popup warning.\n- Fixed an issue with opening older address books.\n- Fixed an issue where LDAP directories would be lost when switching to\n  'Offline' mode.\n- Fixed an issue when importing webcals.\n","status":"published","published":"2022-04-13T10:15:53Z","modified":"2025-05-02T04:32:23.808797Z","updated_at":"2026-11-02T15:53:50.513981Z"},{"id":"USN-5393-1","title":"thunderbird vulnerabilities","description":"Multiple security issues were discovered in Thunderbird. If a user were\ntricked into opening a specially crafted website in a browsing context, an\nattacker could potentially exploit these to cause a denial of service,\nconduct spoofing attacks, or execute arbitrary code. (CVE-2022-1097,\nCVE-2022-1196, CVE-2022-28281, CVE-2022-28282, CVE-2022-28285,\nCVE-2022-28286, CVE-2022-28289)\n\nIt was discovered that Thunderbird ignored OpenPGP revocation when\nimporting a revoked key in some circumstances. An attacker could\npotentially exploit this by tricking the user into trusting the\nauthenticity of a message or tricking them into use a revoked key to\nsend an encrypted message. (CVE-2022-1197)\n","status":"published","published":"2022-04-27T19:44:24Z","modified":"2026-04-22T10:22:55.983894Z","updated_at":"2026-11-02T16:58:16.20937Z"}]}}