{"id":"CVE-2022-1520","aliases":["ALPINE-CVE-2022-1520","ALSA-2022:1730","DEBIAN-CVE-2022-1520","DLA-3020-1","DSA-5141-1","EUVD-2022-24818","GHSA-3qrc-jgqf-vg35","MGASA-2022-0163","RHSA-2022:1724","RHSA-2022:1725","RHSA-2022:1726","RHSA-2022:1727","RHSA-2022:1730","RHSA-2022:4589","RLSA-2022:1730","SUSE-SU-2022:1719-1","UBUNTU-CVE-2022-1520","USN-5435-1","openSUSE-SU-2024:12045-1"],"status":"published","title":"When viewing an email message A, which contains an attached message B, where B is encrypted or...","description":"When viewing an email message A, which contains an attached message B, where B is encrypted or digitally signed or both, Thunderbird may show an incorrect encryption or signature status. After opening and viewing the attached message B, when returning to the display of message A, the message A might be shown with the security status of message B. This vulnerability affects Thunderbird \u003c 91.9.","severity":{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.00278,"percentile":0.20523,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-326","CWE-346"],"published":"2022-05-05T13:32:08Z","modified":"2026-11-03T08:00:29Z","fixes":[{"ecosystem":"Alpine:v3.16","package":"thunderbird","fixed_in":["91.9.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"thunderbird","fixed_in":["91.9.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"thunderbird","fixed_in":["91.9.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"thunderbird","fixed_in":["91.9.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"thunderbird","fixed_in":["91.9.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"thunderbird","fixed_in":["91.9.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"thunderbird","fixed_in":["91.9.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"thunderbird","fixed_in":["91.9.0-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"thunderbird","fixed_in":["1:91.9.0-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"thunderbird","fixed_in":["1:91.9.0-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"thunderbird","fixed_in":["1:91.9.0-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"thunderbird","fixed_in":["1:91.9.1+build1-0ubuntu0.18.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"thunderbird","fixed_in":["1:91.9.1+build1-0ubuntu0.20.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"thunderbird","fixed_in":["1:91.9.1+build1-0ubuntu0.22.04.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.16","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"91.9.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"91.9.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"91.9.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"91.9.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"91.9.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"91.9.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"91.9.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"91.9.0-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"91.9.0-3.el8_5.alma"}]}],"bundled":8},{"source":"osv","ecosystem":"Debian:12","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:91.9.0-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:91.9.0-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:91.9.0-1"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:91.9.0-1~deb9u1"}]}],"versions":["1.5-4","1.5.0.2-1","1.5.0.2-2","1.5.0.2-3","1.5.0.4-1","1.5.0.4-2","1.5.0.4-3","1.5.0.5-1","1.5.0.7-1","1.5.0.7-2","1:52.4.0-1","1:52.4.0-1~deb7u1","1:52.4.0-1~deb8u1","1:52.4.0-1~deb9u1","1:52.4.0-2~exp1","1:52.5.0-1","1:52.5.0-1~deb7u1","1:52.5.0-1~deb8u1","1:52.5.0-1~deb9u1","1:52.5.2-1","1:52.5.2-1~deb7u1","1:52.5.2-2","1:52.5.2-2~deb8u1","1:52.5.2-2~deb9u1","1:52.6.0-1","1:52.6.0-1+alpha.1","1:52.6.0-1+alpha.2","1:52.6.0-1~deb7u1","1:52.6.0-1~deb8u1","1:52.6.0-1~deb9u1","1:52.7.0-1","1:52.7.0-1~deb7u1","1:52.7.0-1~deb8u1","1:52.7.0-1~deb9u1","1:52.8.0-1","1:52.8.0-1~deb7u1","1:52.8.0-1~deb8u1","1:52.8.0-1~deb9u1","1:52.9.0-1","1:52.9.1-1","1:52.9.1-1~deb8u1","1:52.9.1-1~deb9u1","1:58.0~b3-1","1:60.0-1","1:60.0-2","1:60.0-2~deb9u1","1:60.0-3","1:60.0-3~deb9u1","1:60.0~b10-1","1:60.0~b2-1","1:60.0~b3-1","1:60.0~b4-1","1:60.0~b5-1","1:60.0~b6-1","1:60.0~b9-1","1:60.0~b9-2","1:60.2.1-1","1:60.2.1-2~deb9u1","1:60.3.0-1","1:60.3.0-1~deb8u1","1:60.3.0-1~deb9u1","1:60.3.1-1","1:60.4.0-1","1:60.4.0-1~deb8u1","1:60.4.0-1~deb9u1","1:60.5.0-1","1:60.5.0-2","1:60.5.0-3","1:60.5.1-1","1:60.5.1-1~deb8u1","1:60.5.1-1~deb9u1","1:60.6.1-1","1:60.6.1-1~deb8u1","1:60.6.1-1~deb9u1","1:60.7.0-1","1:60.7.0-1~deb8u1","1:60.7.0-1~deb9u1","1:60.7.1-1","1:60.7.1-1~deb8u1","1:60.7.1-1~deb9u1","1:60.7.2-1","1:60.7.2-1~deb8u1","1:60.7.2-1~deb9u1","1:60.8.0-1","1:60.8.0-1~deb10u1","1:60.8.0-1~deb8u1","1:60.8.0-1~deb9u1","1:60.8.0-2","1:60.9.0-1","1:60.9.0-1~deb10u1","1:60.9.0-1~deb8u1","1:60.9.0-1~deb9u1","1:65.0~b1-1","1:66.0~b1-1","1:67.0~b3-1","1:68.0~b1-1","1:68.1.1-1~exp1","1:68.1.2-1~exp1","1:68.10.0-1","1:68.10.0-1~deb10u1","1:68.10.0-1~deb9u1","1:68.11.0-1","1:68.11.0-1~deb10u1","1:68.11.0-1~deb9u1","1:68.11.0-2","1:68.11.0-3","1:68.12.0-1","1:68.12.0-1~deb10u1","1:68.12.0-1~deb9u1","1:68.12.0-1~deb9u2","1:68.2.1-1","1:68.2.2-1","1:68.2.2-1~deb10u1","1:68.2.2-1~deb8u1","1:68.2.2-1~deb9u1","1:68.3.0-1","1:68.3.0-2","1:68.3.0-2~deb10u1","1:68.3.0-2~deb8u1","1:68.3.0-2~deb9u1","1:68.3.1-1","1:68.4.1-1","1:68.4.1-1~deb10u1","1:68.4.1-1~deb8u1","1:68.4.1-1~deb9u1","1:68.4.2-1","1:68.5.0-1","1:68.5.0-1~deb10u1","1:68.5.0-1~deb8u1","1:68.5.0-1~deb9u1","1:68.6.0-1","1:68.6.0-1~deb10u1","1:68.6.0-1~deb8u1","1:68.6.0-1~deb9u1","1:68.7.0-1","1:68.7.0-1~deb10u1","1:68.7.0-1~deb8u1","1:68.7.0-1~deb9u1","1:68.8.0-1","1:68.8.0-1~deb10u1","1:68.8.0-1~deb8u1","1:68.8.0-1~deb9u1","1:68.8.1-1","1:68.9.0-1","1:68.9.0-1~deb10u1","1:68.9.0-1~deb8u1","1:68.9.0-1~deb8u2","1:68.9.0-1~deb9u1","1:76.0~b1-1","1:76.0~b2-1","1:77.0~b1-1","1:77.0~b2-1","1:77.0~b3-1","1:78.0-1","1:78.0.1-1","1:78.0~b1-1","1:78.0~b2-1","1:78.1.0-1","1:78.1.1-1","1:78.10.0-1","1:78.10.0-1~deb10u1","1:78.10.0-1~deb9u1","1:78.10.2-1","1:78.11.0-1","1:78.11.0-1~deb10u1","1:78.11.0-1~deb9u1","1:78.11.0-2","1:78.12.0-1","1:78.12.0-1~deb10u1","1:78.12.0-1~deb9u1","1:78.13.0-1","1:78.13.0-1~deb10u1","1:78.13.0-1~deb11u1","1:78.13.0-1~deb9u1","1:78.14.0-1","1:78.14.0-1~deb10u1","1:78.14.0-1~deb11u1","1:78.14.0-1~deb9u1","1:78.2.0-1","1:78.2.1-1","1:78.2.2-1","1:78.3.1-1","1:78.3.1-2","1:78.3.1-2~deb10u1","1:78.3.1-2~deb10u2","1:78.3.1-2~deb9u1","1:78.3.2-1","1:78.3.3-1","1:78.4.0-1","1:78.4.0-1~deb10u1","1:78.4.0-1~deb9u1","1:78.4.1-1","1:78.4.2-1","1:78.4.2-1~deb10u1","1:78.4.2-1~deb9u1","1:78.5.0-1","1:78.5.0-1~deb10u1","1:78.5.0-1~deb9u1","1:78.5.1-1","1:78.5.1-1~deb10u1","1:78.5.1-1~deb9u1","1:78.6.0-1","1:78.6.0-1~deb10u1","1:78.6.0-1~deb9u1","1:78.6.1-1","1:78.7.0-1","1:78.7.0-1~deb10u1","1:78.7.0-1~deb9u1","1:78.7.1-1","1:78.8.0-1","1:78.8.0-1~deb10u1","1:78.8.0-1~deb9u1","1:78.9.0-1","1:78.9.0-1~deb10u1","1:78.9.0-1~deb9u1","1:84.0~b3-1","1:85.0~b3-1","1:86.0~b3-1","1:88.0~b2-1","1:89.0~b2-1","1:90.0~b2-1","1:91.0-1","1:91.0.2-1","1:91.0~b1-1","1:91.0~b3-1","1:91.0~b5-1","1:91.1.0-1","1:91.1.1-1","1:91.2.0-1","1:91.2.1-1","1:91.3.0-1","1:91.3.2-1","1:91.4.0-1","1:91.4.1-1","1:91.4.1-1~deb10u1","1:91.4.1-1~deb11u1","1:91.4.1-1~deb9u1","1:91.5.0-1","1:91.5.0-1~deb9u1","1:91.5.0-2","1:91.5.0-2~deb10u1","1:91.5.0-2~deb11u1","1:91.5.1-1","1:91.6.0-1","1:91.6.0-1~deb10u1","1:91.6.0-1~deb11u1","1:91.6.0-1~deb9u1","1:91.6.1-1","1:91.6.1-1~deb10u1","1:91.6.1-1~deb11u1","1:91.6.1-1~deb9u1","1:91.6.2-1","1:91.6.2-1~deb10u1","1:91.6.2-1~deb11u1","1:91.6.2-1~deb9u1","1:91.7.0-1","1:91.7.0-2","1:91.7.0-2~deb10u1","1:91.7.0-2~deb11u1","1:91.7.0-2~deb9u1","1:91.8.0-1","1:91.8.0-1~deb10u1","1:91.8.0-1~deb11u1","1:91.8.0-1~deb9u1","1:91.8.1-1"],"bundled":8},{"source":"osv","ecosystem":"Debian:10","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:91.9.0-1~deb10u1"}]}],"versions":["1:60.7.2-1","1:60.8.0-1","1:60.8.0-1~deb10u1","1:60.8.0-1~deb8u1","1:60.8.0-1~deb9u1","1:60.8.0-2","1:60.9.0-1","1:60.9.0-1~deb10u1","1:60.9.0-1~deb8u1","1:60.9.0-1~deb9u1","1:65.0~b1-1","1:66.0~b1-1","1:67.0~b3-1","1:68.0~b1-1","1:68.1.1-1~exp1","1:68.1.2-1~exp1","1:68.10.0-1","1:68.10.0-1~deb10u1","1:68.10.0-1~deb9u1","1:68.11.0-1","1:68.11.0-1~deb10u1","1:68.11.0-1~deb9u1","1:68.11.0-2","1:68.11.0-3","1:68.12.0-1","1:68.12.0-1~deb10u1","1:68.12.0-1~deb9u1","1:68.12.0-1~deb9u2","1:68.2.1-1","1:68.2.2-1","1:68.2.2-1~deb10u1","1:68.2.2-1~deb8u1","1:68.2.2-1~deb9u1","1:68.3.0-1","1:68.3.0-2","1:68.3.0-2~deb10u1","1:68.3.0-2~deb8u1","1:68.3.0-2~deb9u1","1:68.3.1-1","1:68.4.1-1","1:68.4.1-1~deb10u1","1:68.4.1-1~deb8u1","1:68.4.1-1~deb9u1","1:68.4.2-1","1:68.5.0-1","1:68.5.0-1~deb10u1","1:68.5.0-1~deb8u1","1:68.5.0-1~deb9u1","1:68.6.0-1","1:68.6.0-1~deb10u1","1:68.6.0-1~deb8u1","1:68.6.0-1~deb9u1","1:68.7.0-1","1:68.7.0-1~deb10u1","1:68.7.0-1~deb8u1","1:68.7.0-1~deb9u1","1:68.8.0-1","1:68.8.0-1~deb10u1","1:68.8.0-1~deb8u1","1:68.8.0-1~deb9u1","1:68.8.1-1","1:68.9.0-1","1:68.9.0-1~deb10u1","1:68.9.0-1~deb8u1","1:68.9.0-1~deb8u2","1:68.9.0-1~deb9u1","1:76.0~b1-1","1:76.0~b2-1","1:77.0~b1-1","1:77.0~b2-1","1:77.0~b3-1","1:78.0-1","1:78.0.1-1","1:78.0~b1-1","1:78.0~b2-1","1:78.1.0-1","1:78.1.1-1","1:78.10.0-1","1:78.10.0-1~deb10u1","1:78.10.0-1~deb9u1","1:78.10.2-1","1:78.11.0-1","1:78.11.0-1~deb10u1","1:78.11.0-1~deb9u1","1:78.11.0-2","1:78.12.0-1","1:78.12.0-1~deb10u1","1:78.12.0-1~deb9u1","1:78.13.0-1","1:78.13.0-1~deb10u1","1:78.13.0-1~deb11u1","1:78.13.0-1~deb9u1","1:78.14.0-1","1:78.14.0-1~deb10u1","1:78.14.0-1~deb11u1","1:78.14.0-1~deb9u1","1:78.2.0-1","1:78.2.1-1","1:78.2.2-1","1:78.3.1-1","1:78.3.1-2","1:78.3.1-2~deb10u1","1:78.3.1-2~deb10u2","1:78.3.1-2~deb9u1","1:78.3.2-1","1:78.3.3-1","1:78.4.0-1","1:78.4.0-1~deb10u1","1:78.4.0-1~deb9u1","1:78.4.1-1","1:78.4.2-1","1:78.4.2-1~deb10u1","1:78.4.2-1~deb9u1","1:78.5.0-1","1:78.5.0-1~deb10u1","1:78.5.0-1~deb9u1","1:78.5.1-1","1:78.5.1-1~deb10u1","1:78.5.1-1~deb9u1","1:78.6.0-1","1:78.6.0-1~deb10u1","1:78.6.0-1~deb9u1","1:78.6.1-1","1:78.7.0-1","1:78.7.0-1~deb10u1","1:78.7.0-1~deb9u1","1:78.7.1-1","1:78.8.0-1","1:78.8.0-1~deb10u1","1:78.8.0-1~deb9u1","1:78.9.0-1","1:78.9.0-1~deb10u1","1:78.9.0-1~deb9u1","1:84.0~b3-1","1:85.0~b3-1","1:86.0~b3-1","1:88.0~b2-1","1:89.0~b2-1","1:90.0~b2-1","1:91.0-1","1:91.0.2-1","1:91.0~b1-1","1:91.0~b3-1","1:91.0~b5-1","1:91.1.0-1","1:91.1.1-1","1:91.2.0-1","1:91.2.1-1","1:91.3.0-1","1:91.3.2-1","1:91.4.0-1","1:91.4.1-1","1:91.4.1-1~deb10u1","1:91.4.1-1~deb11u1","1:91.4.1-1~deb9u1","1:91.5.0-1","1:91.5.0-1~deb9u1","1:91.5.0-2","1:91.5.0-2~deb10u1","1:91.5.0-2~deb11u1","1:91.5.1-1","1:91.6.0-1","1:91.6.0-1~deb10u1","1:91.6.0-1~deb11u1","1:91.6.0-1~deb9u1","1:91.6.1-1","1:91.6.1-1~deb10u1","1:91.6.1-1~deb11u1","1:91.6.1-1~deb9u1","1:91.6.2-1","1:91.6.2-1~deb10u1","1:91.6.2-1~deb11u1","1:91.6.2-1~deb9u1","1:91.7.0-1","1:91.7.0-2","1:91.7.0-2~deb10u1","1:91.7.0-2~deb11u1","1:91.7.0-2~deb9u1","1:91.8.0-1","1:91.8.0-1~deb10u1","1:91.8.0-1~deb11u1","1:91.8.0-1~deb9u1","1:91.8.1-1","1:91.9.0-1~deb9u1"],"bundled":8},{"source":"osv","ecosystem":"Debian:11","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:91.9.0-1~deb11u1"}]}],"versions":["1:78.12.0-1","1:78.13.0-1","1:78.13.0-1~deb10u1","1:78.13.0-1~deb11u1","1:78.13.0-1~deb9u1","1:78.14.0-1","1:78.14.0-1~deb10u1","1:78.14.0-1~deb11u1","1:78.14.0-1~deb9u1","1:84.0~b3-1","1:85.0~b3-1","1:86.0~b3-1","1:88.0~b2-1","1:89.0~b2-1","1:90.0~b2-1","1:91.0-1","1:91.0.2-1","1:91.0~b1-1","1:91.0~b3-1","1:91.0~b5-1","1:91.1.0-1","1:91.1.1-1","1:91.2.0-1","1:91.2.1-1","1:91.3.0-1","1:91.3.2-1","1:91.4.0-1","1:91.4.1-1","1:91.4.1-1~deb10u1","1:91.4.1-1~deb11u1","1:91.4.1-1~deb9u1","1:91.5.0-1","1:91.5.0-1~deb9u1","1:91.5.0-2","1:91.5.0-2~deb10u1","1:91.5.0-2~deb11u1","1:91.5.1-1","1:91.6.0-1","1:91.6.0-1~deb10u1","1:91.6.0-1~deb11u1","1:91.6.0-1~deb9u1","1:91.6.1-1","1:91.6.1-1~deb10u1","1:91.6.1-1~deb11u1","1:91.6.1-1~deb9u1","1:91.6.2-1","1:91.6.2-1~deb10u1","1:91.6.2-1~deb11u1","1:91.6.2-1~deb9u1","1:91.7.0-1","1:91.7.0-2","1:91.7.0-2~deb10u1","1:91.7.0-2~deb11u1","1:91.7.0-2~deb9u1","1:91.8.0-1","1:91.8.0-1~deb10u1","1:91.8.0-1~deb11u1","1:91.8.0-1~deb9u1","1:91.8.1-1","1:91.9.0-1~deb10u1","1:91.9.0-1~deb9u1"],"bundled":8},{"source":"osv","ecosystem":"Mageia:8","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"91.9.0-1.mga8"}]}],"bundled":8},{"source":"osv","ecosystem":"Mageia:8","package":"thunderbird-l10n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"91.9.0-1.mga8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::appstream","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:91.9.0-3.el8_2"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::appstream","package":"thunderbird-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:91.9.0-3.el8_2"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::appstream","package":"thunderbird-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:91.9.0-3.el8_2"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:91.9.0-3.el7_9"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"thunderbird-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:91.9.0-3.el7_9"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:91.9.0-3.el7_9"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"thunderbird-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:91.9.0-3.el7_9"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:91.9.0-3.el7_9"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"thunderbird-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:91.9.0-3.el7_9"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::appstream","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:91.9.0-3.el8_4"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::appstream","package":"thunderbird-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:91.9.0-3.el8_4"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::appstream","package":"thunderbird-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:91.9.0-3.el8_4"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.1::appstream","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:91.9.0-3.el8_1"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.1::appstream","package":"thunderbird-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:91.9.0-3.el8_1"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.1::appstream","package":"thunderbird-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:91.9.0-3.el8_1"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:91.9.0-3.el8_5"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"thunderbird-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:91.9.0-3.el8_5"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"thunderbird-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:91.9.0-3.el8_5"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:91.9.0-3.el9_0"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"thunderbird-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:91.9.0-3.el9_0"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"thunderbird-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:91.9.0-3.el9_0"}]}],"bundled":8},{"source":"osv","ecosystem":"Rocky Linux:8","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:91.9.0-3.el8_5"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP3","package":"MozillaThunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"91.9.0-150200.8.68.2"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP4","package":"MozillaThunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"91.9.0-150200.8.68.2"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP3","package":"MozillaThunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"91.9.0-150200.8.68.2"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP4","package":"MozillaThunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"91.9.0-150200.8.68.2"}]}],"bundled":8},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"MozillaThunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"91.9.0-150200.8.68.2"}]}],"bundled":8},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"MozillaThunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"91.9.0-150200.8.68.2"}]}],"bundled":8},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:91.9.1+build1-0ubuntu0.18.04.1"}]}],"versions":["1:52.4.0+build1-0ubuntu2","1:52.6.0+build1-0ubuntu1","1:52.7.0+build1-0ubuntu1","1:52.8.0+build1-0ubuntu0.18.04.1","1:52.9.1+build3-0ubuntu0.18.04.1","1:60.2.1+build1-0ubuntu0.18.04.2","1:60.4.0+build2-0ubuntu0.18.04.1","1:60.5.1+build2-0ubuntu0.18.04.1","1:60.6.1+build2-0ubuntu0.18.04.1","1:60.7.0+build1-0ubuntu0.18.04.1","1:60.7.1+build1-0ubuntu0.18.04.1","1:60.7.2+build2-0ubuntu0.18.04.1","1:60.8.0+build1-0ubuntu0.18.04.1","1:60.9.0+build1-0ubuntu0.18.04.1","1:68.2.1+build1-0ubuntu0.18.04.1","1:68.2.2+build1-0ubuntu0.18.04.1","1:68.4.1+build1-0ubuntu0.18.04.1","1:68.7.0+build1-0ubuntu0.18.04.1","1:68.8.0+build2-0ubuntu0.18.04.2","1:68.10.0+build1-0ubuntu0.18.04.1","1:78.8.1+build1-0ubuntu0.18.04.1","1:78.11.0+build1-0ubuntu0.18.04.2","1:78.13.0+build1-0ubuntu0.18.04.1","1:78.14.0+build1-0ubuntu0.18.04.1","1:78.14.0+build1-0ubuntu0.18.04.2","1:91.5.0+build1-0ubuntu0.18.04.1","1:91.7.0+build2-0ubuntu0.18.04.1","1:91.8.1+build1-0ubuntu0.18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:91.9.1+build1-0ubuntu0.20.04.1"}]}],"versions":["1:68.1.2+build1-0ubuntu1","1:68.1.2+build1-0ubuntu2","1:68.2.1+build1-0ubuntu1","1:68.2.2+build1-0ubuntu1","1:68.3.0+build2-0ubuntu1","1:68.3.1+build1-0ubuntu2","1:68.4.1+build1-0ubuntu1","1:68.4.2+build2-0ubuntu1","1:68.5.0+build1-0ubuntu1","1:68.6.0+build2-0ubuntu1","1:68.7.0+build1-0ubuntu1","1:68.7.0+build1-0ubuntu2","1:68.8.0+build2-0ubuntu0.20.04.2","1:68.10.0+build1-0ubuntu0.20.04.1","1:78.7.1+build1-0ubuntu0.20.04.1","1:78.8.1+build1-0ubuntu0.20.04.1","1:78.11.0+build1-0ubuntu0.20.04.2","1:78.13.0+build1-0ubuntu0.20.04.2","1:78.14.0+build1-0ubuntu0.20.04.1","1:78.14.0+build1-0ubuntu0.20.04.2","1:91.5.0+build1-0ubuntu0.20.04.1","1:91.7.0+build2-0ubuntu0.20.04.1","1:91.8.1+build1-0ubuntu0.20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:91.9.1+build1-0ubuntu0.22.04.1"}]}],"versions":["1:91.1.2+build1-0ubuntu1","1:91.3.0+build2-0ubuntu1","1:91.3.1+build1-0ubuntu1","1:91.3.2+build1-0ubuntu1","1:91.4.0+build1.1-0ubuntu1","1:91.4.0+build2-0ubuntu1","1:91.5.0+build1-0ubuntu1","1:91.5.1+build1-0ubuntu1","1:91.6.1+build1-0ubuntu1","1:91.7.0+build1-0ubuntu1","1:91.7.0+build2-0ubuntu1","1:91.8.0+build2-0ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:91.9.1+build1-0ubuntu0.18.04.1"}]}],"versions":["1:52.4.0+build1-0ubuntu2","1:52.6.0+build1-0ubuntu1","1:52.7.0+build1-0ubuntu1","1:52.8.0+build1-0ubuntu0.18.04.1","1:52.9.1+build3-0ubuntu0.18.04.1","1:60.2.1+build1-0ubuntu0.18.04.2","1:60.4.0+build2-0ubuntu0.18.04.1","1:60.5.1+build2-0ubuntu0.18.04.1","1:60.6.1+build2-0ubuntu0.18.04.1","1:60.7.0+build1-0ubuntu0.18.04.1","1:60.7.1+build1-0ubuntu0.18.04.1","1:60.7.2+build2-0ubuntu0.18.04.1","1:60.8.0+build1-0ubuntu0.18.04.1","1:60.9.0+build1-0ubuntu0.18.04.1","1:68.2.1+build1-0ubuntu0.18.04.1","1:68.2.2+build1-0ubuntu0.18.04.1","1:68.4.1+build1-0ubuntu0.18.04.1","1:68.7.0+build1-0ubuntu0.18.04.1","1:68.8.0+build2-0ubuntu0.18.04.2","1:68.10.0+build1-0ubuntu0.18.04.1","1:78.8.1+build1-0ubuntu0.18.04.1","1:78.11.0+build1-0ubuntu0.18.04.2","1:78.13.0+build1-0ubuntu0.18.04.1","1:78.14.0+build1-0ubuntu0.18.04.1","1:78.14.0+build1-0ubuntu0.18.04.2","1:91.5.0+build1-0ubuntu0.18.04.1","1:91.7.0+build2-0ubuntu0.18.04.1","1:91.8.1+build1-0ubuntu0.18.04.1"],"bundled":10},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:91.9.1+build1-0ubuntu0.20.04.1"}]}],"versions":["1:68.1.2+build1-0ubuntu1","1:68.1.2+build1-0ubuntu2","1:68.2.1+build1-0ubuntu1","1:68.2.2+build1-0ubuntu1","1:68.3.0+build2-0ubuntu1","1:68.3.1+build1-0ubuntu2","1:68.4.1+build1-0ubuntu1","1:68.4.2+build2-0ubuntu1","1:68.5.0+build1-0ubuntu1","1:68.6.0+build2-0ubuntu1","1:68.7.0+build1-0ubuntu1","1:68.7.0+build1-0ubuntu2","1:68.8.0+build2-0ubuntu0.20.04.2","1:68.10.0+build1-0ubuntu0.20.04.1","1:78.7.1+build1-0ubuntu0.20.04.1","1:78.8.1+build1-0ubuntu0.20.04.1","1:78.11.0+build1-0ubuntu0.20.04.2","1:78.13.0+build1-0ubuntu0.20.04.2","1:78.14.0+build1-0ubuntu0.20.04.1","1:78.14.0+build1-0ubuntu0.20.04.2","1:91.5.0+build1-0ubuntu0.20.04.1","1:91.7.0+build2-0ubuntu0.20.04.1","1:91.8.1+build1-0ubuntu0.20.04.1"],"bundled":10},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:91.9.1+build1-0ubuntu0.22.04.1"}]}],"versions":["1:91.1.2+build1-0ubuntu1","1:91.3.0+build2-0ubuntu1","1:91.3.1+build1-0ubuntu1","1:91.3.2+build1-0ubuntu1","1:91.4.0+build1.1-0ubuntu1","1:91.4.0+build2-0ubuntu1","1:91.5.0+build1-0ubuntu1","1:91.5.1+build1-0ubuntu1","1:91.6.1+build1-0ubuntu1","1:91.7.0+build1-0ubuntu1","1:91.7.0+build2-0ubuntu1","1:91.8.0+build2-0ubuntu1"],"bundled":10},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"MozillaThunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"91.9.0-1.1"}]}],"bundled":8}],"products":[{"vendor":"mozilla","product":"thunderbird"}],"references":[{"url":"https://www.mozilla.org/security/advisories/mfsa2022-18/","tags":["x_transferred","Vendor Advisory","advisory"]},{"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=1745019","tags":["x_transferred","Issue Tracking","Permissions Required","Vendor Advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-1520","tags":["advisory"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2022-18"},{"url":"https://github.com/advisories/GHSA-3qrc-jgqf-vg35"},{"url":"https://security.alpinelinux.org/vuln/CVE-2022-1520","tags":["advisory"]},{"url":"https://errata.almalinux.org/8/ALSA-2022-1730.html","tags":["advisory"]},{"url":"https://vulners.com/cve/CVE-2022-1520","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2022-29909","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2022-29911","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2022-29912","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2022-29913","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2022-29914","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2022-29916","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2022-29917","tags":["report"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-1520","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2022-0163.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=30374","tags":["report"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2022-18/","tags":["advisory"]},{"url":"https://www.thunderbird.net/en-US/thunderbird/91.9.0/releasenotes/","tags":["web"]},{"url":"https://access.redhat.com/errata/RHSA-2022:1724","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2081468","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2081469","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2081470","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2081471","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2081472","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2081473","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2082037","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2082038","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_1724.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-1520","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-1520","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-29909","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-29909","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-29909","tags":["advisory"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2022-17/#CVE-2022-29909","tags":["article"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2022-18/#CVE-2022-29909","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-29911","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-29911","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-29911","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-29912","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-29912","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-29912","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-29913","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-29913","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-29913","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-29914","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-29914","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-29914","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-29916","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-29916","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-29916","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-29917","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-29917","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-29917","tags":["advisory"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2022-17/#CVE-2022-29917","tags":["article"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2022-18/#CVE-2022-29917","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2022:1725","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_1725.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2022:1726","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_1726.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2022:1727","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_1727.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2022:1730","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_1730.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2022:4589","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_4589.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2022:1730","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20221719-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1198970","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-1520","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-29909","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-29911","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-29912","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-29913","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-29914","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-29916","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-29917","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2022-1520","tags":["report"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2022-18/#CVE-2022-1520","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5435-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2022-1529","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-1802","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-29909","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-29911","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-29912","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-29913","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-29914","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-29916","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-29917","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2022-1520","description":"When viewing an email message A, which contains an attached message B, where B is encrypted or digitally signed or both, Thunderbird may show an incorrect encryption or signature status. After opening and viewing the attached message B, when returning to the display of message A, the message A might be shown with the security status of message B. This vulnerability affects Thunderbird \u003c 91.9.","status":"published","published":"2022-12-22T00:00:00Z","modified":"2025-04-16T15:20:58.943Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-346"],"updated_at":"2026-11-02T14:34:38.581997Z"}],"euvd":[{"id":"EUVD-2022-24818","description":"When viewing an email message A, which contains an attached message B, where B is encrypted or digitally signed or both, Thunderbird may show an incorrect encryption or signature status. After opening and viewing the attached message B, when returning to the display of message A, the message A might be shown with the security status of message B. This vulnerability affects Thunderbird \u003c 91.9.","status":"published","published":"2022-12-22T00:00:00Z","modified":"2025-04-16T15:20:58Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T20:52:25.343198Z"}],"ghsa":[{"id":"GHSA-3qrc-jgqf-vg35","title":"When viewing an email message A, which contains an attached message B, where B is encrypted or...","description":"When viewing an email message A, which contains an attached message B, where B is encrypted or digitally signed or both, Thunderbird may show an incorrect encryption or signature status. After opening and viewing the attached message B, when returning to the display of message A, the message A might be shown with the security status of message B. This vulnerability affects Thunderbird \u003c 91.9.","status":"published","published":"2022-12-22T21:30:30Z","modified":"2025-04-16T18:32:39Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-326","CWE-346"],"updated_at":"2026-11-02T15:01:35.379285Z"}],"nvd":[{"id":"CVE-2022-1520","description":"When viewing an email message A, which contains an attached message B, where B is encrypted or digitally signed or both, Thunderbird may show an incorrect encryption or signature status. After opening and viewing the attached message B, when returning to the display of message A, the message A might be shown with the security status of message B. This vulnerability affects Thunderbird \u003c 91.9.","status":"published","published":"2022-12-22T20:15:13.217Z","modified":"2026-06-17T04:22:36.203Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium","assessor":"primary"},{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-346"],"updated_at":"2026-11-02T14:07:34.388163Z"}],"osv":[{"id":"ALPINE-CVE-2022-1520","description":"When viewing an email message A, which contains an attached message B, where B is encrypted or digitally signed or both, Thunderbird may show an incorrect encryption or signature status. After opening and viewing the attached message B, when returning to the display of message A, the message A might be shown with the security status of message B. This vulnerability affects Thunderbird \u003c 91.9.","status":"published","published":"2022-12-22T20:15:13.217Z","modified":"2026-11-03T07:31:09.01747836Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-03T07:50:01.054176Z"},{"id":"CVE-2022-1520","description":"When viewing an email message A, which contains an attached message B, where B is encrypted or digitally signed or both, Thunderbird may show an incorrect encryption or signature status. After opening and viewing the attached message B, when returning to the display of message A, the message A might be shown with the security status of message B. This vulnerability affects Thunderbird \u003c 91.9.","status":"published","published":"2022-12-22T20:15:13.217Z","modified":"2026-04-16T04:32:43.460836919Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:23.245966Z"},{"id":"DEBIAN-CVE-2022-1520","description":"When viewing an email message A, which contains an attached message B, where B is encrypted or digitally signed or both, Thunderbird may show an incorrect encryption or signature status. After opening and viewing the attached message B, when returning to the display of message A, the message A might be shown with the security status of message B. This vulnerability affects Thunderbird \u003c 91.9.","status":"published","published":"2022-12-22T20:15:13.217Z","modified":"2026-11-03T08:00:29.407565519Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-03T08:25:15.646766Z"},{"id":"RHSA-2022:1724","title":"Red Hat Security Advisory: thunderbird security update","status":"published","published":"2024-09-16T08:04:15Z","modified":"2025-11-22T12:33:05Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:09.62945Z"},{"id":"RHSA-2022:1725","title":"Red Hat Security Advisory: thunderbird security update","status":"published","published":"2024-09-16T08:04:22Z","modified":"2026-06-26T10:58:45Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:09.62945Z"},{"id":"RHSA-2022:1726","title":"Red Hat Security Advisory: thunderbird security update","status":"published","published":"2024-09-16T08:04:30Z","modified":"2025-11-22T12:33:07Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:09.62945Z"},{"id":"RHSA-2022:1727","title":"Red Hat Security Advisory: thunderbird security update","status":"published","published":"2024-09-16T08:04:09Z","modified":"2025-11-22T12:33:08Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:09.62945Z"},{"id":"RHSA-2022:1730","title":"Red Hat Security Advisory: thunderbird security update","status":"published","published":"2024-09-16T08:04:01Z","modified":"2025-11-22T12:33:10Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:09.62945Z"},{"id":"RHSA-2022:4589","title":"Red Hat Security Advisory: thunderbird security update","status":"published","published":"2024-09-16T08:04:38Z","modified":"2025-11-22T12:34:11Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:09.62945Z"},{"id":"RLSA-2022:1730","title":"Important: thunderbird security update","description":"Mozilla Thunderbird is a standalone mail and newsgroup client.\n\nThis update upgrades Thunderbird to version 91.9.0.\n\nSecurity Fix(es):\n\n* Mozilla: Bypassing permission prompt in nested browsing contexts (CVE-2022-29909)\n\n* Mozilla: iframe Sandbox bypass (CVE-2022-29911)\n\n* Mozilla: Fullscreen notification bypass using popups (CVE-2022-29914)\n\n* Mozilla: Leaking browser history with CSS variables (CVE-2022-29916)\n\n* Mozilla: Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9 (CVE-2022-29917)\n\n* Mozilla: Reader mode bypassed SameSite cookies (CVE-2022-29912)\n\n* Mozilla: Speech Synthesis feature not properly disabled (CVE-2022-29913)\n\n* Mozilla: Incorrect security status shown after viewing an attached email (CVE-2022-1520)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2022-05-05T13:32:08Z","modified":"2026-02-05T12:45:05.435569Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:24.322216Z"},{"id":"UBUNTU-CVE-2022-1520","description":"When viewing an email message A, which contains an attached message B, where B is encrypted or digitally signed or both, Thunderbird may show an incorrect encryption or signature status. After opening and viewing the attached message B, when returning to the display of message A, the message A might be shown with the security status of message B. This vulnerability affects Thunderbird \u003c 91.9.","status":"published","published":"2022-05-07T00:00:00Z","modified":"2026-04-22T13:13:32.549549Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium"},{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T16:53:51.630172Z"},{"id":"ALSA-2022:1730","title":"Important: thunderbird security update","description":"Mozilla Thunderbird is a standalone mail and newsgroup client.\n\nThis update upgrades Thunderbird to version 91.9.0.\n\nSecurity Fix(es):\n\n* Mozilla: Bypassing permission prompt in nested browsing contexts (CVE-2022-29909)\n\n* Mozilla: iframe Sandbox bypass (CVE-2022-29911)\n\n* Mozilla: Fullscreen notification bypass using popups (CVE-2022-29914)\n\n* Mozilla: Leaking browser history with CSS variables (CVE-2022-29916)\n\n* Mozilla: Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9 (CVE-2022-29917)\n\n* Mozilla: Reader mode bypassed SameSite cookies (CVE-2022-29912)\n\n* Mozilla: Speech Synthesis feature not properly disabled (CVE-2022-29913)\n\n* Mozilla: Incorrect security status shown after viewing an attached email (CVE-2022-1520)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2022-05-05T13:32:08Z","modified":"2026-10-29T11:01:03.117941298Z","updated_at":"2026-11-02T15:27:51.196609Z"},{"id":"DLA-3020-1","title":"thunderbird - security update","status":"published","published":"2022-05-23T00:00:00Z","modified":"2026-03-09T01:21:16.28229Z","updated_at":"2026-11-02T15:46:11.189256Z"},{"id":"DSA-5141-1","title":"thunderbird - security update","status":"published","published":"2022-05-19T00:00:00Z","modified":"2026-03-09T02:11:30.974941Z","updated_at":"2026-11-02T15:46:17.543497Z"},{"id":"MGASA-2022-0163","title":"Updated thunderbird packages fix security vulnerability","description":"Incorrect security status shown after viewing an attached email.\n(CVE-2022-1520)\nFullscreen notification bypass using popups. (CVE-2022-29914)\nBypassing permission prompt in nested browsing contexts. (CVE-2022-29909)\nLeaking browser history with CSS variables. (CVE-2022-29916)\niframe sandbox bypass. (CVE-2022-29911)\nReader mode bypassed SameSite cookies. (CVE-2022-29912)\nSpeech Synthesis feature not properly disabled. (CVE-2022-29913)\nMemory safety bugs fixed in Thunderbird 91.9. (CVE-2022-29917)\n","status":"published","published":"2022-05-06T20:16:39Z","modified":"2026-04-16T04:41:53.411955217Z","updated_at":"2026-11-02T15:49:41.849028Z"},{"id":"openSUSE-SU-2024:12045-1","title":"MozillaThunderbird-91.9.0-1.1 on GA media","description":"These are all security issues fixed in the MozillaThunderbird-91.9.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:18:12.776456Z","updated_at":"2026-11-02T16:58:35.485255Z"},{"id":"SUSE-SU-2022:1719-1","title":"Security update for MozillaThunderbird","description":"This update for MozillaThunderbird fixes the following issues:\n\nVarious security fixes MFSA 2022-18 (bsc#1198970):\n\n- CVE-2022-1520: Incorrect security status shown after viewing an attached email (bmo#1745019).\n- CVE-2022-29914: Fullscreen notification bypass using popups (bmo#1746448).\n- CVE-2022-29909: Bypassing permission prompt in nested browsing contexts (bmo#1755081).\n- CVE-2022-29916: Leaking browser history with CSS variables (bmo#1760674).\n- CVE-2022-29911: iframe sandbox bypass (bmo#1761981).\n- CVE-2022-29912: Reader mode bypassed SameSite cookies (bmo#1692655).\n- CVE-2022-29913: Speech Synthesis feature not properly disabled (bmo#1764778).\n- CVE-2022-29917: Memory safety bugs fixed in Thunderbird 91.9 (bmo#1684739, bmo#1706441, bmo#1753298, bmo#1762614, bmo#1762620).\n","status":"published","published":"2022-05-17T15:45:34Z","modified":"2026-02-04T02:31:42.55033Z","updated_at":"2026-11-02T15:53:50.513981Z"},{"id":"USN-5435-1","title":"thunderbird vulnerabilities","description":"Multiple security issues were discovered in Thunderbird. If a user were\ntricked into opening a specially crafted website in a browsing context, an\nattacker could potentially exploit these to cause a denial of service,\nbypass permission prompts, obtain sensitive information, bypass security\nrestrictions, cause user confusion, or execute arbitrary code.\n(CVE-2022-29909, CVE-2022-29911, CVE-2022-29912, CVE-2022-29913,\nCVE-2022-29914, CVE-2022-29916, CVE-2022-29917)\n\nIt was discovered that Thunderbird would show the wrong security status\nafter viewing an attached message that is signed or encrypted. An attacker\ncould potentially exploit this by tricking the user into trusting the\nauthenticity of a message. (CVE-2022-1520)\n\nIt was discovered that the methods of an Array object could be corrupted\nas a result of prototype pollution by sending a message to the parent\nprocess. If a user were tricked into opening a specially crafted website\nin a browsing context, an attacker could exploit this to execute\nJavaScript in a privileged context. (CVE-2022-1529, CVE-2022-1802)\n","status":"published","published":"2022-05-25T07:47:27Z","modified":"2026-04-22T10:24:30.175249Z","updated_at":"2026-11-02T16:58:16.20937Z"}]}}