{"id":"CVE-2022-2226","aliases":["ALPINE-CVE-2022-2226","ALSA-2022:5482","DEBIAN-CVE-2022-2226","DSA-5175-1","EUVD-2022-34506","GHSA-g426-wcxv-272f","MGASA-2022-0253","RHSA-2022:5470","RHSA-2022:5473","RHSA-2022:5475","RHSA-2022:5478","RHSA-2022:5480","RHSA-2022:5482","RLSA-2022:5470","SUSE-SU-2022:2320-1","SUSE-SU-2022:3281-1","UBUNTU-CVE-2022-2226","USN-5512-1","openSUSE-SU-2024:12161-1"],"status":"published","title":"An OpenPGP digital signature includes information about the date when the signature was created....","description":"An OpenPGP digital signature includes information about the date when the signature was created. When displaying an email that contains a digital signature, the email's date will be shown. If the dates were different, then Thunderbird didn't report the email as having an invalid signature. If an attacker performed a replay attack, in which an old email with old contents are resent at a later time, it could lead the victim to believe that the statements in the email are current. Fixed versions of Thunderbird will require that the signature's date roughly matches the displayed date of the email. This vulnerability affects Thunderbird \u003c 102 and Thunderbird \u003c 91.11.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.00436,"percentile":0.38237,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-294"],"published":"2022-06-30T21:27:54Z","modified":"2026-11-03T08:00:37Z","fixes":[{"ecosystem":"Alpine:v3.16","package":"thunderbird","fixed_in":["91.11.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"thunderbird","fixed_in":["102.0-r0","102.1.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"thunderbird","fixed_in":["102.0-r0","102.1.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"thunderbird","fixed_in":["102.0-r0","102.1.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"thunderbird","fixed_in":["102.0-r0","102.1.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"thunderbird","fixed_in":["102.0-r0","102.1.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"thunderbird","fixed_in":["102.0-r0","102.1.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"thunderbird","fixed_in":["102.0-r0","102.1.0-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"thunderbird","fixed_in":["1:91.11.0-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"thunderbird","fixed_in":["1:91.11.0-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"thunderbird","fixed_in":["1:91.11.0-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"thunderbird","fixed_in":["1:91.11.0+build2-0ubuntu0.18.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"thunderbird","fixed_in":["1:91.11.0+build2-0ubuntu0.20.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"thunderbird","fixed_in":["1:91.11.0+build2-0ubuntu0.22.04.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.16","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"91.11.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"102.0-r0"},{"fixed":"102.1.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"102.0-r0"},{"fixed":"102.1.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"102.0-r0"},{"fixed":"102.1.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"102.0-r0"},{"fixed":"102.1.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"102.0-r0"},{"fixed":"102.1.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"102.0-r0"},{"fixed":"102.1.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"102.0-r0"},{"fixed":"102.1.0-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"91.11.0-2.el9_0.alma"}]}],"bundled":9},{"source":"osv","ecosystem":"Debian:12","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:91.11.0-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:91.11.0-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:91.11.0-1"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:91.11.0-1~deb10u1"}]}],"versions":["1:60.7.2-1","1:60.8.0-1","1:60.8.0-1~deb10u1","1:60.8.0-1~deb8u1","1:60.8.0-1~deb9u1","1:60.8.0-2","1:60.9.0-1","1:60.9.0-1~deb10u1","1:60.9.0-1~deb8u1","1:60.9.0-1~deb9u1","1:65.0~b1-1","1:66.0~b1-1","1:67.0~b3-1","1:68.0~b1-1","1:68.1.1-1~exp1","1:68.1.2-1~exp1","1:68.10.0-1","1:68.10.0-1~deb10u1","1:68.10.0-1~deb9u1","1:68.11.0-1","1:68.11.0-1~deb10u1","1:68.11.0-1~deb9u1","1:68.11.0-2","1:68.11.0-3","1:68.12.0-1","1:68.12.0-1~deb10u1","1:68.12.0-1~deb9u1","1:68.12.0-1~deb9u2","1:68.2.1-1","1:68.2.2-1","1:68.2.2-1~deb10u1","1:68.2.2-1~deb8u1","1:68.2.2-1~deb9u1","1:68.3.0-1","1:68.3.0-2","1:68.3.0-2~deb10u1","1:68.3.0-2~deb8u1","1:68.3.0-2~deb9u1","1:68.3.1-1","1:68.4.1-1","1:68.4.1-1~deb10u1","1:68.4.1-1~deb8u1","1:68.4.1-1~deb9u1","1:68.4.2-1","1:68.5.0-1","1:68.5.0-1~deb10u1","1:68.5.0-1~deb8u1","1:68.5.0-1~deb9u1","1:68.6.0-1","1:68.6.0-1~deb10u1","1:68.6.0-1~deb8u1","1:68.6.0-1~deb9u1","1:68.7.0-1","1:68.7.0-1~deb10u1","1:68.7.0-1~deb8u1","1:68.7.0-1~deb9u1","1:68.8.0-1","1:68.8.0-1~deb10u1","1:68.8.0-1~deb8u1","1:68.8.0-1~deb9u1","1:68.8.1-1","1:68.9.0-1","1:68.9.0-1~deb10u1","1:68.9.0-1~deb8u1","1:68.9.0-1~deb8u2","1:68.9.0-1~deb9u1","1:76.0~b1-1","1:76.0~b2-1","1:77.0~b1-1","1:77.0~b2-1","1:77.0~b3-1","1:78.0-1","1:78.0.1-1","1:78.0~b1-1","1:78.0~b2-1","1:78.1.0-1","1:78.1.1-1","1:78.10.0-1","1:78.10.0-1~deb10u1","1:78.10.0-1~deb9u1","1:78.10.2-1","1:78.11.0-1","1:78.11.0-1~deb10u1","1:78.11.0-1~deb9u1","1:78.11.0-2","1:78.12.0-1","1:78.12.0-1~deb10u1","1:78.12.0-1~deb9u1","1:78.13.0-1","1:78.13.0-1~deb10u1","1:78.13.0-1~deb11u1","1:78.13.0-1~deb9u1","1:78.14.0-1","1:78.14.0-1~deb10u1","1:78.14.0-1~deb11u1","1:78.14.0-1~deb9u1","1:78.2.0-1","1:78.2.1-1","1:78.2.2-1","1:78.3.1-1","1:78.3.1-2","1:78.3.1-2~deb10u1","1:78.3.1-2~deb10u2","1:78.3.1-2~deb9u1","1:78.3.2-1","1:78.3.3-1","1:78.4.0-1","1:78.4.0-1~deb10u1","1:78.4.0-1~deb9u1","1:78.4.1-1","1:78.4.2-1","1:78.4.2-1~deb10u1","1:78.4.2-1~deb9u1","1:78.5.0-1","1:78.5.0-1~deb10u1","1:78.5.0-1~deb9u1","1:78.5.1-1","1:78.5.1-1~deb10u1","1:78.5.1-1~deb9u1","1:78.6.0-1","1:78.6.0-1~deb10u1","1:78.6.0-1~deb9u1","1:78.6.1-1","1:78.7.0-1","1:78.7.0-1~deb10u1","1:78.7.0-1~deb9u1","1:78.7.1-1","1:78.8.0-1","1:78.8.0-1~deb10u1","1:78.8.0-1~deb9u1","1:78.9.0-1","1:78.9.0-1~deb10u1","1:78.9.0-1~deb9u1","1:84.0~b3-1","1:85.0~b3-1","1:86.0~b3-1","1:88.0~b2-1","1:89.0~b2-1","1:90.0~b2-1","1:91.0-1","1:91.0.2-1","1:91.0~b1-1","1:91.0~b3-1","1:91.0~b5-1","1:91.1.0-1","1:91.1.1-1","1:91.10.0-1","1:91.10.0-1~deb10u1","1:91.10.0-1~deb11u1","1:91.10.0-1~deb9u1","1:91.2.0-1","1:91.2.1-1","1:91.3.0-1","1:91.3.2-1","1:91.4.0-1","1:91.4.1-1","1:91.4.1-1~deb10u1","1:91.4.1-1~deb11u1","1:91.4.1-1~deb9u1","1:91.5.0-1","1:91.5.0-1~deb9u1","1:91.5.0-2","1:91.5.0-2~deb10u1","1:91.5.0-2~deb11u1","1:91.5.1-1","1:91.6.0-1","1:91.6.0-1~deb10u1","1:91.6.0-1~deb11u1","1:91.6.0-1~deb9u1","1:91.6.1-1","1:91.6.1-1~deb10u1","1:91.6.1-1~deb11u1","1:91.6.1-1~deb9u1","1:91.6.2-1","1:91.6.2-1~deb10u1","1:91.6.2-1~deb11u1","1:91.6.2-1~deb9u1","1:91.7.0-1","1:91.7.0-2","1:91.7.0-2~deb10u1","1:91.7.0-2~deb11u1","1:91.7.0-2~deb9u1","1:91.8.0-1","1:91.8.0-1~deb10u1","1:91.8.0-1~deb11u1","1:91.8.0-1~deb9u1","1:91.8.1-1","1:91.9.0-1","1:91.9.0-1~deb10u1","1:91.9.0-1~deb11u1","1:91.9.0-1~deb9u1"],"bundled":9},{"source":"osv","ecosystem":"Debian:11","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:91.11.0-1~deb11u1"}]}],"versions":["1:78.12.0-1","1:78.13.0-1","1:78.13.0-1~deb10u1","1:78.13.0-1~deb11u1","1:78.13.0-1~deb9u1","1:78.14.0-1","1:78.14.0-1~deb10u1","1:78.14.0-1~deb11u1","1:78.14.0-1~deb9u1","1:84.0~b3-1","1:85.0~b3-1","1:86.0~b3-1","1:88.0~b2-1","1:89.0~b2-1","1:90.0~b2-1","1:91.0-1","1:91.0.2-1","1:91.0~b1-1","1:91.0~b3-1","1:91.0~b5-1","1:91.1.0-1","1:91.1.1-1","1:91.10.0-1","1:91.10.0-1~deb10u1","1:91.10.0-1~deb11u1","1:91.10.0-1~deb9u1","1:91.11.0-1~deb10u1","1:91.2.0-1","1:91.2.1-1","1:91.3.0-1","1:91.3.2-1","1:91.4.0-1","1:91.4.1-1","1:91.4.1-1~deb10u1","1:91.4.1-1~deb11u1","1:91.4.1-1~deb9u1","1:91.5.0-1","1:91.5.0-1~deb9u1","1:91.5.0-2","1:91.5.0-2~deb10u1","1:91.5.0-2~deb11u1","1:91.5.1-1","1:91.6.0-1","1:91.6.0-1~deb10u1","1:91.6.0-1~deb11u1","1:91.6.0-1~deb9u1","1:91.6.1-1","1:91.6.1-1~deb10u1","1:91.6.1-1~deb11u1","1:91.6.1-1~deb9u1","1:91.6.2-1","1:91.6.2-1~deb10u1","1:91.6.2-1~deb11u1","1:91.6.2-1~deb9u1","1:91.7.0-1","1:91.7.0-2","1:91.7.0-2~deb10u1","1:91.7.0-2~deb11u1","1:91.7.0-2~deb9u1","1:91.8.0-1","1:91.8.0-1~deb10u1","1:91.8.0-1~deb11u1","1:91.8.0-1~deb9u1","1:91.8.1-1","1:91.9.0-1","1:91.9.0-1~deb10u1","1:91.9.0-1~deb11u1","1:91.9.0-1~deb9u1"],"bundled":9},{"source":"osv","ecosystem":"Mageia:8","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"91.11.0-1.mga8"}]}],"bundled":9},{"source":"osv","ecosystem":"Mageia:8","package":"thunderbird-l10n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"91.11.0-1.mga8"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:91.11.0-2.el8_6"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"thunderbird-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:91.11.0-2.el8_6"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"thunderbird-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:91.11.0-2.el8_6"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::appstream","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:91.11.0-2.el8_4"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::appstream","package":"thunderbird-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:91.11.0-2.el8_4"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::appstream","package":"thunderbird-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:91.11.0-2.el8_4"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::appstream","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:91.11.0-2.el8_2"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::appstream","package":"thunderbird-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:91.11.0-2.el8_2"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::appstream","package":"thunderbird-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:91.11.0-2.el8_2"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.1::appstream","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:91.11.0-2.el8_1"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.1::appstream","package":"thunderbird-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:91.11.0-2.el8_1"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.1::appstream","package":"thunderbird-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:91.11.0-2.el8_1"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:91.11.0-2.el7_9"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"thunderbird-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:91.11.0-2.el7_9"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:91.11.0-2.el7_9"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"thunderbird-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:91.11.0-2.el7_9"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:91.11.0-2.el7_9"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"thunderbird-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:91.11.0-2.el7_9"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:91.11.0-2.el9_0"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"thunderbird-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:91.11.0-2.el9_0"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"thunderbird-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:91.11.0-2.el9_0"}]}],"bundled":9},{"source":"osv","ecosystem":"Rocky Linux:8","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:91.11.0-2.el8_6"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP3","package":"MozillaThunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"91.11.0-150200.8.76.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP4","package":"MozillaThunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"91.11.0-150200.8.76.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP3","package":"MozillaThunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"91.11.0-150200.8.76.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP4","package":"MozillaThunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"91.11.0-150200.8.76.1"}]}],"bundled":10},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"MozillaThunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"91.11.0-150200.8.76.1"}]}],"bundled":10},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"MozillaThunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"91.11.0-150200.8.76.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP3","package":"MozillaThunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"102.2.2-150200.8.82.1"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP4","package":"MozillaThunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"102.2.2-150200.8.82.1"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP3","package":"MozillaThunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"102.2.2-150200.8.82.1"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP4","package":"MozillaThunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"102.2.2-150200.8.82.1"}]}],"bundled":23},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"MozillaThunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"102.2.2-150200.8.82.1"}]}],"bundled":23},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"MozillaThunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"102.2.2-150200.8.82.1"}]}],"bundled":23},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:91.11.0+build2-0ubuntu0.18.04.1"}]}],"versions":["1:52.4.0+build1-0ubuntu2","1:52.6.0+build1-0ubuntu1","1:52.7.0+build1-0ubuntu1","1:52.8.0+build1-0ubuntu0.18.04.1","1:52.9.1+build3-0ubuntu0.18.04.1","1:60.2.1+build1-0ubuntu0.18.04.2","1:60.4.0+build2-0ubuntu0.18.04.1","1:60.5.1+build2-0ubuntu0.18.04.1","1:60.6.1+build2-0ubuntu0.18.04.1","1:60.7.0+build1-0ubuntu0.18.04.1","1:60.7.1+build1-0ubuntu0.18.04.1","1:60.7.2+build2-0ubuntu0.18.04.1","1:60.8.0+build1-0ubuntu0.18.04.1","1:60.9.0+build1-0ubuntu0.18.04.1","1:68.2.1+build1-0ubuntu0.18.04.1","1:68.2.2+build1-0ubuntu0.18.04.1","1:68.4.1+build1-0ubuntu0.18.04.1","1:68.7.0+build1-0ubuntu0.18.04.1","1:68.8.0+build2-0ubuntu0.18.04.2","1:68.10.0+build1-0ubuntu0.18.04.1","1:78.8.1+build1-0ubuntu0.18.04.1","1:78.11.0+build1-0ubuntu0.18.04.2","1:78.13.0+build1-0ubuntu0.18.04.1","1:78.14.0+build1-0ubuntu0.18.04.1","1:78.14.0+build1-0ubuntu0.18.04.2","1:91.5.0+build1-0ubuntu0.18.04.1","1:91.7.0+build2-0ubuntu0.18.04.1","1:91.8.1+build1-0ubuntu0.18.04.1","1:91.9.1+build1-0ubuntu0.18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:91.11.0+build2-0ubuntu0.20.04.1"}]}],"versions":["1:68.1.2+build1-0ubuntu1","1:68.1.2+build1-0ubuntu2","1:68.2.1+build1-0ubuntu1","1:68.2.2+build1-0ubuntu1","1:68.3.0+build2-0ubuntu1","1:68.3.1+build1-0ubuntu2","1:68.4.1+build1-0ubuntu1","1:68.4.2+build2-0ubuntu1","1:68.5.0+build1-0ubuntu1","1:68.6.0+build2-0ubuntu1","1:68.7.0+build1-0ubuntu1","1:68.7.0+build1-0ubuntu2","1:68.8.0+build2-0ubuntu0.20.04.2","1:68.10.0+build1-0ubuntu0.20.04.1","1:78.7.1+build1-0ubuntu0.20.04.1","1:78.8.1+build1-0ubuntu0.20.04.1","1:78.11.0+build1-0ubuntu0.20.04.2","1:78.13.0+build1-0ubuntu0.20.04.2","1:78.14.0+build1-0ubuntu0.20.04.1","1:78.14.0+build1-0ubuntu0.20.04.2","1:91.5.0+build1-0ubuntu0.20.04.1","1:91.7.0+build2-0ubuntu0.20.04.1","1:91.8.1+build1-0ubuntu0.20.04.1","1:91.9.1+build1-0ubuntu0.20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:91.11.0+build2-0ubuntu0.22.04.1"}]}],"versions":["1:91.1.2+build1-0ubuntu1","1:91.3.0+build2-0ubuntu1","1:91.3.1+build1-0ubuntu1","1:91.3.2+build1-0ubuntu1","1:91.4.0+build1.1-0ubuntu1","1:91.4.0+build2-0ubuntu1","1:91.5.0+build1-0ubuntu1","1:91.5.1+build1-0ubuntu1","1:91.6.1+build1-0ubuntu1","1:91.7.0+build1-0ubuntu1","1:91.7.0+build2-0ubuntu1","1:91.8.0+build2-0ubuntu1","1:91.9.1+build1-0ubuntu0.22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:91.11.0+build2-0ubuntu0.18.04.1"}]}],"versions":["1:52.4.0+build1-0ubuntu2","1:52.6.0+build1-0ubuntu1","1:52.7.0+build1-0ubuntu1","1:52.8.0+build1-0ubuntu0.18.04.1","1:52.9.1+build3-0ubuntu0.18.04.1","1:60.2.1+build1-0ubuntu0.18.04.2","1:60.4.0+build2-0ubuntu0.18.04.1","1:60.5.1+build2-0ubuntu0.18.04.1","1:60.6.1+build2-0ubuntu0.18.04.1","1:60.7.0+build1-0ubuntu0.18.04.1","1:60.7.1+build1-0ubuntu0.18.04.1","1:60.7.2+build2-0ubuntu0.18.04.1","1:60.8.0+build1-0ubuntu0.18.04.1","1:60.9.0+build1-0ubuntu0.18.04.1","1:68.2.1+build1-0ubuntu0.18.04.1","1:68.2.2+build1-0ubuntu0.18.04.1","1:68.4.1+build1-0ubuntu0.18.04.1","1:68.7.0+build1-0ubuntu0.18.04.1","1:68.8.0+build2-0ubuntu0.18.04.2","1:68.10.0+build1-0ubuntu0.18.04.1","1:78.8.1+build1-0ubuntu0.18.04.1","1:78.11.0+build1-0ubuntu0.18.04.2","1:78.13.0+build1-0ubuntu0.18.04.1","1:78.14.0+build1-0ubuntu0.18.04.1","1:78.14.0+build1-0ubuntu0.18.04.2","1:91.5.0+build1-0ubuntu0.18.04.1","1:91.7.0+build2-0ubuntu0.18.04.1","1:91.8.1+build1-0ubuntu0.18.04.1","1:91.9.1+build1-0ubuntu0.18.04.1"],"bundled":17},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:91.11.0+build2-0ubuntu0.20.04.1"}]}],"versions":["1:68.1.2+build1-0ubuntu1","1:68.1.2+build1-0ubuntu2","1:68.2.1+build1-0ubuntu1","1:68.2.2+build1-0ubuntu1","1:68.3.0+build2-0ubuntu1","1:68.3.1+build1-0ubuntu2","1:68.4.1+build1-0ubuntu1","1:68.4.2+build2-0ubuntu1","1:68.5.0+build1-0ubuntu1","1:68.6.0+build2-0ubuntu1","1:68.7.0+build1-0ubuntu1","1:68.7.0+build1-0ubuntu2","1:68.8.0+build2-0ubuntu0.20.04.2","1:68.10.0+build1-0ubuntu0.20.04.1","1:78.7.1+build1-0ubuntu0.20.04.1","1:78.8.1+build1-0ubuntu0.20.04.1","1:78.11.0+build1-0ubuntu0.20.04.2","1:78.13.0+build1-0ubuntu0.20.04.2","1:78.14.0+build1-0ubuntu0.20.04.1","1:78.14.0+build1-0ubuntu0.20.04.2","1:91.5.0+build1-0ubuntu0.20.04.1","1:91.7.0+build2-0ubuntu0.20.04.1","1:91.8.1+build1-0ubuntu0.20.04.1","1:91.9.1+build1-0ubuntu0.20.04.1"],"bundled":17},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:91.11.0+build2-0ubuntu0.22.04.1"}]}],"versions":["1:91.1.2+build1-0ubuntu1","1:91.3.0+build2-0ubuntu1","1:91.3.1+build1-0ubuntu1","1:91.3.2+build1-0ubuntu1","1:91.4.0+build1.1-0ubuntu1","1:91.4.0+build2-0ubuntu1","1:91.5.0+build1-0ubuntu1","1:91.5.1+build1-0ubuntu1","1:91.6.1+build1-0ubuntu1","1:91.7.0+build1-0ubuntu1","1:91.7.0+build2-0ubuntu1","1:91.8.0+build2-0ubuntu1","1:91.9.1+build1-0ubuntu0.22.04.1"],"bundled":17},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"MozillaThunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"91.11.0-1.1"}]}],"bundled":10}],"products":[{"vendor":"mozilla","product":"thunderbird"}],"references":[{"url":"https://www.mozilla.org/security/advisories/mfsa2022-26/","tags":["x_transferred","Vendor Advisory","advisory"]},{"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=1775441","tags":["x_transferred","Issue Tracking","Permissions Required","Vendor Advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-2226","tags":["advisory"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2022-26"},{"url":"https://github.com/advisories/GHSA-g426-wcxv-272f"},{"url":"https://security.alpinelinux.org/vuln/CVE-2022-2226","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2022:5482","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-2200","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-2226","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-31744","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-34468","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-34470","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-34472","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-34479","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-34481","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-34484","tags":["report"]},{"url":"https://bugzilla.redhat.com/2102161","tags":["report"]},{"url":"https://bugzilla.redhat.com/2102162","tags":["report"]},{"url":"https://bugzilla.redhat.com/2102163","tags":["report"]},{"url":"https://bugzilla.redhat.com/2102164","tags":["report"]},{"url":"https://bugzilla.redhat.com/2102165","tags":["report"]},{"url":"https://bugzilla.redhat.com/2102166","tags":["report"]},{"url":"https://bugzilla.redhat.com/2102168","tags":["report"]},{"url":"https://bugzilla.redhat.com/2102169","tags":["report"]},{"url":"https://bugzilla.redhat.com/2102204","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2022-5482.html","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-2226","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2022-0253.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=30587","tags":["report"]},{"url":"https://www.thunderbird.net/en-US/thunderbird/91.11.0/releasenotes/","tags":["web"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2022-26/","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2022:5470","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2102161","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2102162","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2102163","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2102164","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2102165","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2102166","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2102168","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2102169","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2102204","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_5470.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-2200","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-2200","tags":["advisory"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2022-25/#CVE-2022-2200","tags":["article"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2022-26/#CVE-2022-2200","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-2226","tags":["advisory","report"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2022-26/#CVE-2022-2226","tags":["article","report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-31744","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-31744","tags":["advisory"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2022-25/#CVE-2022-31744","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-34468","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-34468","tags":["advisory"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2022-25/#CVE-2022-34468","tags":["article"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2022-26/#CVE-2022-34468","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-34470","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-34470","tags":["advisory"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2022-25/#CVE-2022-34470","tags":["article"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2022-26/#CVE-2022-34470","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-34472","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-34472","tags":["advisory"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2022-25/#CVE-2022-34472","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-34479","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-34479","tags":["advisory"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2022-25/#CVE-2022-34479","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-34481","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-34481","tags":["advisory"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2022-25/#CVE-2022-34481","tags":["article"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2022-26/#CVE-2022-34481","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-34484","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-34484","tags":["advisory"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2022-25/#CVE-2022-34484","tags":["article"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2022-26/#CVE-2022-34484","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2022:5473","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_5473.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2022:5475","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_5475.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2022:5478","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_5478.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2022:5480","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_5480.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_5482.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2022:5470","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20222320-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1200793","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-2200","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-2226","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-31744","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-34468","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-34470","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-34472","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-34478","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-34479","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-34481","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-34484","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20223281-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1201758","tags":["report"]},{"url":"https://bugzilla.suse.com/1202645","tags":["report"]},{"url":"https://bugzilla.suse.com/1203007","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-2505","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-3032","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-3033","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-3034","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-36059","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-36314","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-36318","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-36319","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-38472","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-38473","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-38476","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-38477","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-38478","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2022-2226","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5512-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2022-1834","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-2200","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-31736","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-31737","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-31738","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-31740","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-31741","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-31742","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-31744","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-31747","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-34468","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-34470","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-34472","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-34479","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-34481","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-34484","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2022-2226","description":"An OpenPGP digital signature includes information about the date when the signature was created. When displaying an email that contains a digital signature, the email's date will be shown. If the dates were different, then Thunderbird didn't report the email as having an invalid signature. If an attacker performed a replay attack, in which an old email with old contents are resent at a later time, it could lead the victim to believe that the statements in the email are current. Fixed versions of Thunderbird will require that the signature's date roughly matches the displayed date of the email. This vulnerability affects Thunderbird \u003c 102 and Thunderbird \u003c 91.11.","status":"published","published":"2022-12-22T00:00:00Z","modified":"2025-04-15T15:01:41.069Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-294"],"updated_at":"2026-11-02T14:34:32.495407Z"}],"euvd":[{"id":"EUVD-2022-34506","description":"An OpenPGP digital signature includes information about the date when the signature was created. When displaying an email that contains a digital signature, the email's date will be shown. If the dates were different, then Thunderbird didn't report the email as having an invalid signature. If an attacker performed a replay attack, in which an old email with old contents are resent at a later time, it could lead the victim to believe that the statements in the email are current. Fixed versions of Thunderbird will require that the signature's date roughly matches the displayed date of the email. This vulnerability affects Thunderbird \u003c 102 and Thunderbird \u003c 91.11.","status":"published","published":"2022-12-22T00:00:00Z","modified":"2025-04-15T15:01:41Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T20:52:28.317823Z"}],"ghsa":[{"id":"GHSA-g426-wcxv-272f","title":"An OpenPGP digital signature includes information about the date when the signature was created....","description":"An OpenPGP digital signature includes information about the date when the signature was created. When displaying an email that contains a digital signature, the email's date will be shown. If the dates were different, then Thunderbird didn't report the email as having an invalid signature. If an attacker performed a replay attack, in which an old email with old contents are resent at a later time, it could lead the victim to believe that the statements in the email are current. Fixed versions of Thunderbird will require that the signature's date roughly matches the displayed date of the email. This vulnerability affects Thunderbird \u003c 102 and Thunderbird \u003c 91.11.","status":"published","published":"2022-12-22T21:30:29Z","modified":"2025-04-15T15:31:44Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"cwes":["CWE-294"],"updated_at":"2026-11-02T15:01:32.576314Z"}],"nvd":[{"id":"CVE-2022-2226","description":"An OpenPGP digital signature includes information about the date when the signature was created. When displaying an email that contains a digital signature, the email's date will be shown. If the dates were different, then Thunderbird didn't report the email as having an invalid signature. If an attacker performed a replay attack, in which an old email with old contents are resent at a later time, it could lead the victim to believe that the statements in the email are current. Fixed versions of Thunderbird will require that the signature's date roughly matches the displayed date of the email. This vulnerability affects Thunderbird \u003c 102 and Thunderbird \u003c 91.11.","status":"published","published":"2022-12-22T20:15:27.54Z","modified":"2026-06-17T04:41:31.31Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium","assessor":"primary"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-294"],"updated_at":"2026-11-02T14:07:34.388163Z"}],"osv":[{"id":"ALPINE-CVE-2022-2226","description":"An OpenPGP digital signature includes information about the date when the signature was created. When displaying an email that contains a digital signature, the email's date will be shown. If the dates were different, then Thunderbird didn't report the email as having an invalid signature. If an attacker performed a replay attack, in which an old email with old contents are resent at a later time, it could lead the victim to believe that the statements in the email are current. Fixed versions of Thunderbird will require that the signature's date roughly matches the displayed date of the email. This vulnerability affects Thunderbird \u003c 102 and Thunderbird \u003c 91.11.","status":"published","published":"2022-12-22T20:15:27.54Z","modified":"2026-11-03T07:30:18.154847944Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-03T07:50:38.973973Z"},{"id":"CVE-2022-2226","description":"An OpenPGP digital signature includes information about the date when the signature was created. When displaying an email that contains a digital signature, the email's date will be shown. If the dates were different, then Thunderbird didn't report the email as having an invalid signature. If an attacker performed a replay attack, in which an old email with old contents are resent at a later time, it could lead the victim to believe that the statements in the email are current. Fixed versions of Thunderbird will require that the signature's date roughly matches the displayed date of the email. This vulnerability affects Thunderbird \u003c 102 and Thunderbird \u003c 91.11.","status":"published","published":"2022-12-22T20:15:27.54Z","modified":"2026-04-16T04:30:22.059263435Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:24.061177Z"},{"id":"DEBIAN-CVE-2022-2226","description":"An OpenPGP digital signature includes information about the date when the signature was created. When displaying an email that contains a digital signature, the email's date will be shown. If the dates were different, then Thunderbird didn't report the email as having an invalid signature. If an attacker performed a replay attack, in which an old email with old contents are resent at a later time, it could lead the victim to believe that the statements in the email are current. Fixed versions of Thunderbird will require that the signature's date roughly matches the displayed date of the email. This vulnerability affects Thunderbird \u003c 102 and Thunderbird \u003c 91.11.","status":"published","published":"2022-12-22T20:15:27.54Z","modified":"2026-11-03T08:00:37.111314786Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-03T08:25:15.646766Z"},{"id":"RHSA-2022:5470","title":"Red Hat Security Advisory: thunderbird security update","status":"published","published":"2024-09-16T08:32:26Z","modified":"2025-11-22T12:36:04Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:09.62945Z"},{"id":"RHSA-2022:5473","title":"Red Hat Security Advisory: thunderbird security update","status":"published","published":"2024-09-16T08:32:19Z","modified":"2025-11-22T12:36:06Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:09.62945Z"},{"id":"RHSA-2022:5475","title":"Red Hat Security Advisory: thunderbird security update","status":"published","published":"2024-09-16T08:32:54Z","modified":"2025-11-22T12:36:07Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:09.62945Z"},{"id":"RHSA-2022:5478","title":"Red Hat Security Advisory: thunderbird security update","status":"published","published":"2024-09-16T08:32:11Z","modified":"2025-11-22T12:36:09Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:09.62945Z"},{"id":"RHSA-2022:5480","title":"Red Hat Security Advisory: thunderbird security update","status":"published","published":"2024-09-16T08:32:47Z","modified":"2026-06-26T10:59:44Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:09.62945Z"},{"id":"RHSA-2022:5482","title":"Red Hat Security Advisory: thunderbird security update","status":"published","published":"2024-09-16T08:32:38Z","modified":"2025-11-22T12:36:11Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:09.62945Z"},{"id":"RLSA-2022:5470","title":"Important: thunderbird security update","description":"Mozilla Thunderbird is a standalone mail and newsgroup client.\n\nThis update upgrades Thunderbird to version 91.11.\n\nSecurity Fix(es):\n\n* Mozilla: CSP sandbox header without `allow-scripts` can be bypassed via retargeted javascript: URI (CVE-2022-34468)\n\n* Mozilla: Use-after-free in nsSHistory (CVE-2022-34470)\n\n* Mozilla: A popup window could be resized in a way to overlay the address bar with web content (CVE-2022-34479)\n\n* Mozilla: Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11 (CVE-2022-34484)\n\n* Mozilla: Undesired attributes could be set as part of prototype pollution (CVE-2022-2200)\n\n* Mozilla: An email with a mismatching OpenPGP signature date was accepted as valid (CVE-2022-2226)\n\n* Mozilla: CSP bypass enabling stylesheet injection (CVE-2022-31744)\n\n* Mozilla: Unavailable PAC file resulted in OCSP requests being blocked (CVE-2022-34472)\n\n* Mozilla: Potential integer overflow in ReplaceElementsAt (CVE-2022-34481)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2022-06-30T21:27:54Z","modified":"2026-02-05T12:30:09.292103Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:24.322216Z"},{"id":"UBUNTU-CVE-2022-2226","description":"An OpenPGP digital signature includes information about the date when the signature was created. When displaying an email that contains a digital signature, the email's date will be shown. If the dates were different, then Thunderbird didn't report the email as having an invalid signature. If an attacker performed a replay attack, in which an old email with old contents are resent at a later time, it could lead the victim to believe that the statements in the email are current. Fixed versions of Thunderbird will require that the signature's date roughly matches the displayed date of the email. This vulnerability affects Thunderbird \u003c 102 and Thunderbird \u003c 91.11.","status":"published","published":"2022-07-04T00:00:00Z","modified":"2026-04-22T13:16:29.260478Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T16:53:52.391598Z"},{"id":"ALSA-2022:5482","title":"Important: thunderbird security update","description":"Mozilla Thunderbird is a standalone mail and newsgroup client.\nThis update upgrades Thunderbird to version 91.11.\nSecurity Fix(es):\n* Mozilla: CSP sandbox header without `allow-scripts` can be bypassed via retargeted javascript: URI (CVE-2022-34468)\n* Mozilla: Use-after-free in nsSHistory (CVE-2022-34470)\n* Mozilla: A popup window could be resized in a way to overlay the address bar with web content (CVE-2022-34479)\n* Mozilla: Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11 (CVE-2022-34484)\n* Mozilla: Undesired attributes could be set as part of prototype pollution (CVE-2022-2200)\n* Mozilla: An email with a mismatching OpenPGP signature date was accepted as valid (CVE-2022-2226)\n* Mozilla: CSP bypass enabling stylesheet injection (CVE-2022-31744)\n* Mozilla: Unavailable PAC file resulted in OCSP requests being blocked (CVE-2022-34472)\n* Mozilla: Potential integer overflow in ReplaceElementsAt (CVE-2022-34481)\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2022-07-01T00:00:00Z","modified":"2026-10-29T11:31:12.332354096Z","updated_at":"2026-11-02T15:27:51.655726Z"},{"id":"DSA-5175-1","title":"thunderbird - security update","status":"published","published":"2022-07-04T00:00:00Z","modified":"2026-03-09T02:10:03.793256Z","updated_at":"2026-11-02T15:46:17.543497Z"},{"id":"MGASA-2022-0253","title":"Updated thunderbird packages fix security vulnerability","description":"A popup window could be resized in a way to overlay the address bar with\nweb content. (CVE-2022-34479)\n\nUse-after-free in nsSHistory. (CVE-2022-34470)\n\nCSP sandbox header without `allow-scripts` can be bypassed via retargeted\njavascript: URI. (CVE-2022-34468)\n\nAn email with a mismatching OpenPGP signature date was accepted as valid.\n(CVE-2022-2226)\n\nPotential integer overflow in ReplaceElementsAt. (CVE-2022-34481)\n\nCSP bypass enabling stylesheet injection. (CVE-2022-31744)\n\nUnavailable PAC file resulted in OCSP requests being blocked.\n(CVE-2022-34472)\n\nUndesired attributes could be set as part of prototype pollution.\n(CVE-2022-2200)\n\nMemory safety bugs fixed in Thunderbird 91.11 and Thunderbird 102.\n(CVE-2022-34484)\n","status":"published","published":"2022-07-05T19:11:26Z","modified":"2026-04-16T04:41:54.07607887Z","updated_at":"2026-11-02T15:49:41.849028Z"},{"id":"openSUSE-SU-2024:12161-1","title":"MozillaThunderbird-91.11.0-1.1 on GA media","description":"These are all security issues fixed in the MozillaThunderbird-91.11.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:32:09.611399Z","updated_at":"2026-11-02T16:58:35.485255Z"},{"id":"SUSE-SU-2022:2320-1","title":"Security update for MozillaThunderbird","description":"This update for MozillaThunderbird fixes the following issues:\n\n  - CVE-2022-2200: Undesired attributes could be set as part of prototype pollution (bmo#1771381)\n  - CVE-2022-2226: An email with a mismatching OpenPGP signature date was accepted as valid (bmo#1775441)\n  - CVE-2022-31744: CSP bypass enabling stylesheet injection (bmo#1757604)\n  - CVE-2022-34468: CSP sandbox header without `allow-scripts` can be bypassed via retargeted javascript: URI (bmo#1768537)\n  - CVE-2022-34470: Use-after-free in nsSHistory (bmo#1765951)\n  - CVE-2022-34472: Unavailable PAC file resulted in OCSP requests being blocked (bmo#1770123)\n  - CVE-2022-34478: Microsoft protocols can be attacked if a user accepts a prompt (bmo#1773717)\n  - CVE-2022-34479: A popup window could be resized in a way to overlay the address bar with web content (bmo#1745595)\n  - CVE-2022-34481: Potential integer overflow in ReplaceElementsAt (bmo#1497246)\n  - CVE-2022-34484: Memory safety bugs fixed in Thunderbird 91.11 and Thunderbird 102 (bmo#1763634, bmo#1772651)\n","status":"published","published":"2022-07-07T08:04:45Z","modified":"2026-02-04T03:17:30.17486Z","updated_at":"2026-11-02T15:53:50.965375Z"},{"id":"SUSE-SU-2022:3281-1","title":"Security update for MozillaThunderbird","description":"This update for MozillaThunderbird fixes the following issues:\n\nUpdated to Mozilla Thunderbird 102.2.2:\n- CVE-2022-3033: Fixed leaking of sensitive information when composing a response to an HTML email with a META refresh tag (bsc#1203007).\n- CVE-2022-3032: Fixed missing blocking of remote content specified in an HTML document that was nested inside an iframe's srcdoc attribute (bsc#1203007).\n- CVE-2022-3034: Fixed issue where iframe element in an HTML email could trigger a network request (bsc#1203007).\n- CVE-2022-36059: Fixed DoS in Matrix SDK bundled with Thunderbird service attack (bsc#1203007).\n \n- CVE-2022-38472: Fixed Address bar spoofing via XSLT error handling (bsc#1202645).\n- CVE-2022-38473: Fixed cross-origin XSLT Documents inheriting the parent's permissions (bsc#1202645).\n- CVE-2022-38476: Fixed data race and potential use-after-free in PK11_ChangePW (bsc#1202645).\n- CVE-2022-38477: Fixed memory safety bugs (bsc#1202645).\n- CVE-2022-38478: Fixed memory safety bugs (bsc#1202645).\n\n- CVE-2022-36319: Fixed mouse position spoofing with CSS transforms (bsc#1201758).\n- CVE-2022-36318: Fixed directory indexes for bundled resources reflected URL parameters (bsc#1201758).\n- CVE-2022-36314: Fixed unexpected network loads when opening local .lnk files (bsc#1201758).\n- CVE-2022-2505: Fixed memory safety bugs (bsc#1201758).\n\n- CVE-2022-34479: Fixed vulnerability which could overlay the address bar with web content (bsc#1200793).\n- CVE-2022-34470: Fixed use-after-free in nsSHistory (bsc#1200793).\n- CVE-2022-34468: Fixed CSP sandbox header without `allow-scripts` bypass via retargeted javascript (bsc#1200793).\n- CVE-2022-2226: Fixed emails with a mismatching OpenPGP signature date incorrectly accepted as valid (bsc#1200793).\n- CVE-2022-34481: Fixed integer overflow in ReplaceElementsAt (bsc#1200793).\n- CVE-2022-31744: Fixed CSP bypass enabling stylesheet injection (bsc#1200793).\n- CVE-2022-34472: Fixed unavailable PAC file resulting in OCSP requests being blocked (bsc#1200793).\n- CVE-2022-34478: Fixed Microsoft protocols attacks if a user accepts a prompt (bsc#1200793).\n- CVE-2022-2200: Fixed vulnerability where undesired attributes could be set as part of prototype pollution (bsc#1200793).\n- CVE-2022-34484: Fixed memory safety bugs (bsc#1200793).\n","status":"published","published":"2022-09-15T13:33:15Z","modified":"2026-02-04T03:29:06.527695Z","updated_at":"2026-11-02T15:53:51.440565Z"},{"id":"USN-5512-1","title":"thunderbird vulnerabilities","description":"Multiple security issues were discovered in Thunderbird. If a user were\ntricked into opening a specially crafted website in a browsing context, an\nattacker could potentially exploit these to cause a denial of service,\nobtain sensitive information, spoof the UI, bypass CSP restrictions, or\nexecute arbitrary code. (CVE-2022-2200, CVE-2022-31736, CVE-2022-31737,\nCVE-2022-31738, CVE-2022-31740, CVE-2022-31741, CVE-2022-31742,\nCVE-2022-31744, CVE-2022-31747, CVE-2022-34468, CVE-2022-34470,\nCVE-2022-34479, CVE-2022-34481, CVE-2022-34484)\n\nIt was discovered that an unavailable PAC file caused OCSP requests to\nbe blocked, resulting in incorrect error pages being displayed.\n(CVE-2022-34472)\n\nIt was discovered that the Braille space character could be used to\ncause Thunderbird to display the wrong sender address for signed messages.\nAn attacker could potentially exploit this to trick the user into\nbelieving a message had been sent from somebody they trusted.\n(CVE-2022-1834)\n\nIt was discovered that Thunderbird would consider an email with a\nmismatched OpenPGP signature date as valid. An attacker could potentially\nexploit this by replaying an older message in order to trick the user into\nbelieving that the statements in the message are current. (CVE-2022-2226)\n","status":"published","published":"2022-07-14T09:28:00Z","modified":"2026-04-22T10:25:10.21083Z","updated_at":"2026-11-02T16:58:16.20937Z"}]}}