Red Hat Enterprise Linux 8.2 Extended Update Support update for thunderbird

1) Security features bypass

EUVDB-ID: #VU66920

Risk: Low

CVSSv3.1: 3.8 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-3032

CWE-ID: CWE-254 - Security Features

Exploit availability: No

Description

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists doe to incorrect processing of HTML emails with an iframe</code> element that uses a <code>srcdoc attribute to define the inner HTML document. A remote attacker can trick the victim to open a specially crafted email message and bypass blocking of remote objects specified in the nested document, for example images or videos.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat Enterprise Linux for x86_64 - Extended Update Support: 8.2

Red Hat Enterprise Linux Server - AUS: 8.2

Red Hat Enterprise Linux for Power, little endian - Extended Update Support: 8.2

Red Hat Enterprise Linux for ARM 64 - Extended Update Support: 8.2

Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions: 8.2

Red Hat Enterprise Linux Server - TUS: 8.2

thunderbird (Red Hat package): before 102.3.0-3.el8_2

External links

http://access.redhat.com/errata/RHSA-2022:6715

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Information disclosure

EUVDB-ID: #VU66919

Risk: Medium

CVSSv3.1: 6.2 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-3033

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to the way Thunderbird handles the meta tag having the http-equiv="refresh" attribute in email messages when the user replies to an email. A remote attacker can send a specially crafted email to the victim and force the application to initiate requests to an external URL regardless of the configuration to block remote content.

Combined with other HTML elements and attributes in the email, it is possible to execute arbitrary JavaScript code included into the malicious message in the context of the message compose document and read or modify the contents of the message compose document, including the quoted original message, which could potentially contain the decrypted plaintext of encrypted data in the crafted email.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat Enterprise Linux for x86_64 - Extended Update Support: 8.2

Red Hat Enterprise Linux Server - AUS: 8.2

Red Hat Enterprise Linux for Power, little endian - Extended Update Support: 8.2

Red Hat Enterprise Linux for ARM 64 - Extended Update Support: 8.2

Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions: 8.2

Red Hat Enterprise Linux Server - TUS: 8.2

thunderbird (Red Hat package): before 102.3.0-3.el8_2

External links

http://access.redhat.com/errata/RHSA-2022:6715

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Security features bypass

EUVDB-ID: #VU66921

Risk: Medium

CVSSv3.1: 4.6 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-3034

CWE-ID: CWE-254 - Security Features

Exploit availability: No

Description

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to iframe elements in an HTML email force the application to initiate network requests. A remote attacker can use an iframe to confirm that the email was read by the victim and obtain victim's IP address.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat Enterprise Linux for x86_64 - Extended Update Support: 8.2

Red Hat Enterprise Linux Server - AUS: 8.2

Red Hat Enterprise Linux for Power, little endian - Extended Update Support: 8.2

Red Hat Enterprise Linux for ARM 64 - Extended Update Support: 8.2

Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions: 8.2

Red Hat Enterprise Linux Server - TUS: 8.2

thunderbird (Red Hat package): before 102.3.0-3.el8_2

External links

http://access.redhat.com/errata/RHSA-2022:6715

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Input validation error

EUVDB-ID: #VU66922

Risk: Low

CVSSv3.1: 2.7 [CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-36059

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input in Matrix SDK. A remote attacker sharing a room with a victim can hide some of the rooms or spaces from users and cause minor temporary corruption.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat Enterprise Linux for x86_64 - Extended Update Support: 8.2

Red Hat Enterprise Linux Server - AUS: 8.2

Red Hat Enterprise Linux for Power, little endian - Extended Update Support: 8.2

Red Hat Enterprise Linux for ARM 64 - Extended Update Support: 8.2

Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions: 8.2

Red Hat Enterprise Linux Server - TUS: 8.2

thunderbird (Red Hat package): before 102.3.0-3.el8_2

External links

http://access.redhat.com/errata/RHSA-2022:6715

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Security features bypass

EUVDB-ID: #VU67503

Risk: Medium

CVSSv3.1: 5.3 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-40956

CWE-ID: CWE-254 - Security Features

Exploit availability: No

Description

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to some requests may ignore the CSP's base-uri settings when handling HTML base element injection. A remote attacker can force the browser to accept the injected element's base instead of the original code, leading to Content Security Policy bypass.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat Enterprise Linux for x86_64 - Extended Update Support: 8.2

Red Hat Enterprise Linux Server - AUS: 8.2

Red Hat Enterprise Linux for Power, little endian - Extended Update Support: 8.2

Red Hat Enterprise Linux for ARM 64 - Extended Update Support: 8.2

Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions: 8.2

Red Hat Enterprise Linux Server - TUS: 8.2

thunderbird (Red Hat package): before 102.3.0-3.el8_2

External links

http://access.redhat.com/errata/RHSA-2022:6715

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Input validation error

EUVDB-ID: #VU67504

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-40957

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to inconsistent data in instruction and data cache when creating wasm code. A remote attacker can trick the victim to open a specially crafted web page, trigger memory corruption and potentially execute arbitrary code.

Note, the vulnerability affects Firefox on ARM64 platforms only.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat Enterprise Linux for x86_64 - Extended Update Support: 8.2

Red Hat Enterprise Linux Server - AUS: 8.2

Red Hat Enterprise Linux for Power, little endian - Extended Update Support: 8.2

Red Hat Enterprise Linux for ARM 64 - Extended Update Support: 8.2

Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions: 8.2

Red Hat Enterprise Linux Server - TUS: 8.2

thunderbird (Red Hat package): before 102.3.0-3.el8_2

External links

http://access.redhat.com/errata/RHSA-2022:6715

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Security features bypass

EUVDB-ID: #VU67502

Risk: Medium

CVSSv3.1: 5.3 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-40958

CWE-ID: CWE-254 - Security Features

Exploit availability: No

Description

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to incorrect handling of cookies. A remote attacker with access to a shared subdomain can inject a cookies with certain special characters, bypass Secure Context restriction for cookies with __Host and __Secure prefix and overwrite these cookies, potentially allowing session fixation attacks. 

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat Enterprise Linux for x86_64 - Extended Update Support: 8.2

Red Hat Enterprise Linux Server - AUS: 8.2

Red Hat Enterprise Linux for Power, little endian - Extended Update Support: 8.2

Red Hat Enterprise Linux for ARM 64 - Extended Update Support: 8.2

Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions: 8.2

Red Hat Enterprise Linux Server - TUS: 8.2

thunderbird (Red Hat package): before 102.3.0-3.el8_2

External links

http://access.redhat.com/errata/RHSA-2022:6715

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

8) Security features bypass

EUVDB-ID: #VU67500

Risk: Medium

CVSSv3.1: 4.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-40959

CWE-ID: CWE-254 - Security Features

Exploit availability: No

Description

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to incorrect initialization of FeaturePolicy on all pages during iframe navigation. A remote attacker can trick the victim to open a specially crafted website, bypass FeaturePolicy restrictions and force the browser to leak device permissions into untrusted subdocuments.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat Enterprise Linux for x86_64 - Extended Update Support: 8.2

Red Hat Enterprise Linux Server - AUS: 8.2

Red Hat Enterprise Linux for Power, little endian - Extended Update Support: 8.2

Red Hat Enterprise Linux for ARM 64 - Extended Update Support: 8.2

Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions: 8.2

Red Hat Enterprise Linux Server - TUS: 8.2

thunderbird (Red Hat package): before 102.3.0-3.el8_2

External links

http://access.redhat.com/errata/RHSA-2022:6715

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

9) Use-after-free

EUVDB-ID: #VU67501

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-40960

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error caused by a concurrent use of the URL parser with non-UTF-8 data. A remote attacker can trick the victim to visit a specially crafted website, trigger a use-after-free error and execute arbitrary code on the system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat Enterprise Linux for x86_64 - Extended Update Support: 8.2

Red Hat Enterprise Linux Server - AUS: 8.2

Red Hat Enterprise Linux for Power, little endian - Extended Update Support: 8.2

Red Hat Enterprise Linux for ARM 64 - Extended Update Support: 8.2

Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions: 8.2

Red Hat Enterprise Linux Server - TUS: 8.2

thunderbird (Red Hat package): before 102.3.0-3.el8_2

External links

http://access.redhat.com/errata/RHSA-2022:6715

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

10) Buffer overflow

EUVDB-ID: #VU67505

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-40962

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when processing HTML content. A remote attacker can create a specially crafted website, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat Enterprise Linux for x86_64 - Extended Update Support: 8.2

Red Hat Enterprise Linux Server - AUS: 8.2

Red Hat Enterprise Linux for Power, little endian - Extended Update Support: 8.2

Red Hat Enterprise Linux for ARM 64 - Extended Update Support: 8.2

Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions: 8.2

Red Hat Enterprise Linux Server - TUS: 8.2

thunderbird (Red Hat package): before 102.3.0-3.el8_2

External links

http://access.redhat.com/errata/RHSA-2022:6715

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.