If a Thunderbird user replied to a crafted HTML email containing a <code>meta</code> tag, with the <code>meta</code> tag having the <code>http-equiv="refresh"</code> attribute, and the content attribute specifying an URL, then Thunderbird started a network request to that URL, regardless of the configuration to block remote content. In combination with certain other HTML elements and attributes in the email, it was possible to execute JavaScript code included in the message in the context of the message compose document. The JavaScript code was able to perform actions including, but probably not limited to, read and modify the contents of the message compose document, including the quoted original message, which could potentially contain the decrypted plaintext of encrypted data in the crafted email. The contents could then be transmitted to the network, either to the URL specified in the META refresh tag, or to a different URL, as the JavaScript code could modify the URL specified in the document. This bug doesn't affect users who have changed the default Message Body display setting to 'simple html' or 'plain text'. This vulnerability affects Thunderbird < 102.2.1 and Thunderbird < 91.13.1.

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2022:6708 advisory.

  - When receiving an HTML email that contained an <code>iframe</code> element, which used a     <code>srcdoc</code> attribute to define the inner HTML document, remote objects specified in the nested     document, for example images or videos, were not blocked. Rather, the network was accessed, the objects     were loaded and displayed. This vulnerability affects Thunderbird < 102.2.1 and Thunderbird < 91.13.1.
    (CVE-2022-3032)

  - If a Thunderbird user replied to a crafted HTML email containing a <code>meta</code> tag, with the     <code>meta</code> tag having the <code>http-equiv=refresh</code> attribute, and the content attribute     specifying an URL, then Thunderbird started a network request to that URL, regardless of the configuration     to block remote content. In combination with certain other HTML elements and attributes in the email, it     was possible to execute JavaScript code included in the message in the context of the message compose     document. The JavaScript code was able to perform actions including, but probably not limited to, read and     modify the contents of the message compose document, including the quoted original message, which could     potentially contain the decrypted plaintext of encrypted data in the crafted email. The contents could     then be transmitted to the network, either to the URL specified in the META refresh tag, or to a different     URL, as the JavaScript code could modify the URL specified in the document. This bug doesn't affect users     who have changed the default Message Body display setting to 'simple html' or 'plain text'. This     vulnerability affects Thunderbird < 102.2.1 and Thunderbird < 91.13.1. (CVE-2022-3033)

  - When receiving an HTML email that specified to load an <code>iframe</code> element from a remote location,     a request to the remote document was sent. However, Thunderbird didn't display the document. This     vulnerability affects Thunderbird < 102.2.1 and Thunderbird < 91.13.1. (CVE-2022-3034)

  - matrix-js-sdk is a Matrix messaging protocol Client-Server SDK for JavaScript. In versions prior to 19.4.0     events sent with special strings in key places can temporarily disrupt or impede the matrix-js-sdk from     functioning properly, potentially impacting the consumer's ability to process data safely. Note that the     matrix-js-sdk can appear to be operating normally but be excluding or corrupting runtime data presented to     the consumer. This issue has been fixed in matrix-js-sdk 19.4.0 and users are advised to upgrade. Users     unable to upgrade may mitigate this issue by redacting applicable events, waiting for the sync processor     to store data, and restarting the client. Alternatively, redacting the applicable events and clearing all     storage will often fix most perceived issues. In some cases, no workarounds are possible. (CVE-2022-36059)

  - When injecting an HTML base element, some requests would ignore the CSP's base-uri settings and accept the     injected element's base instead. This vulnerability affects Firefox ESR < 102.3, Thunderbird < 102.3, and     Firefox < 105. (CVE-2022-40956)

  - Inconsistent data in instruction and data cache when creating wasm code could lead to a potentially     exploitable crash.<br>*This bug only affects Firefox on ARM64 platforms.*. This vulnerability affects     Firefox ESR < 102.3, Thunderbird < 102.3, and Firefox < 105. (CVE-2022-40957)

  - By injecting a cookie with certain special characters, an attacker on a shared subdomain which is not a     secure context could set and thus overwrite cookies from a secure context, leading to session fixation and     other attacks. This vulnerability affects Firefox ESR < 102.3, Thunderbird < 102.3, and Firefox < 105.
    (CVE-2022-40958)

  - During iframe navigation, certain pages did not have their FeaturePolicy fully initialized leading to a     bypass that leaked device permissions into untrusted subdocuments. This vulnerability affects Firefox ESR     < 102.3, Thunderbird < 102.3, and Firefox < 105. (CVE-2022-40959)

  - Concurrent use of the URL parser with non-UTF-8 data was not thread-safe. This could lead to a use-after-     free causing a potentially exploitable crash. This vulnerability affects Firefox ESR < 102.3, Thunderbird     < 102.3, and Firefox < 105. (CVE-2022-40960)

  - Mozilla developers Nika Layzell, Timothy Nikkel, Sebastian Hengst, Andreas Pehrson, and the Mozilla     Fuzzing Team reported memory safety bugs present in Firefox 104 and Firefox ESR 102.2. Some of these bugs     showed evidence of memory corruption and we presume that with enough effort some of these could have been     exploited to run arbitrary code. This vulnerability affects Firefox ESR < 102.3, Thunderbird < 102.3, and     Firefox < 105. (CVE-2022-40962)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of thunderbird installed on the remote host is prior to 102.4.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2022-1900 advisory.

  - Matrix Javascript SDK is the Matrix Client-Server SDK for JavaScript. Starting with version 17.1.0-rc.1,     improperly formed beacon events can disrupt or impede the matrix-js-sdk from functioning properly,     potentially impacting the consumer's ability to process data safely. Note that the matrix-js-sdk can     appear to be operating normally but be excluding or corrupting runtime data presented to the consumer.
    This is patched in matrix-js-sdk v19.7.0. Redacting applicable events, waiting for the sync processor to     store data, and restarting the client are possible workarounds. Alternatively, redacting the applicable     events and clearing all storage will fix the further perceived issues. Downgrading to an unaffected     version, noting that such a version may be subject to other vulnerabilities, will additionally resolve the     issue. (CVE-2022-39236)

  - Matrix Javascript SDK is the Matrix Client-Server SDK for JavaScript. Prior to version 19.7.0, an attacker     cooperating with a malicious homeserver can construct messages appearing to have come from another person.
    Such messages will be marked with a grey shield on some platforms, but this may be missing in others. This     attack is possible due to the matrix-js-sdk implementing a too permissive key forwarding strategy on the     receiving end. Starting with version 19.7.0, the default policy for accepting key forwards has been made     more strict in the matrix-js-sdk. matrix-js-sdk will now only accept forwarded keys in response to     previously issued requests and only from own, verified devices. The SDK now sets a `trusted` flag on the     decrypted message upon decryption, based on whether the key used to decrypt the message was received from     a trusted source. Clients need to ensure that messages decrypted with a key with `trusted = false` are     decorated appropriately, for example, by showing a warning for such messages. This attack requires     coordination between a malicious homeserver and an attacker, and those who trust your homeservers do not     need a workaround. (CVE-2022-39249)

  - Matrix JavaScript SDK is the Matrix Client-Server software development kit (SDK) for JavaScript. Prior to     version 19.7.0, an attacker cooperating with a malicious homeserver could interfere with the verification     flow between two users, injecting its own cross-signing user identity in place of one of the users'     identities. This would lead to the other device trusting/verifying the user identity under the control of     the homeserver instead of the intended one. The vulnerability is a bug in the matrix-js-sdk, caused by     checking and signing user identities and devices in two separate steps, and inadequately fixing the keys     to be signed between those steps. Even though the attack is partly made possible due to the design     decision of treating cross-signing user identities as Matrix devices on the server side (with their device     ID set to the public part of the user identity key), no other examined implementations were vulnerable.
    Starting with version 19.7.0, the matrix-js-sdk has been modified to double check that the key signed is     the one that was verified instead of just referencing the key by ID. An additional check has been made to     report an error when one of the device ID matches a cross-signing key. As this attack requires     coordination between a malicious homeserver and an attacker, those who trust their homeservers do not need     a particular workaround. (CVE-2022-39250)

  - Matrix Javascript SDK is the Matrix Client-Server SDK for JavaScript. Prior to version 19.7.0, an attacker     cooperating with a malicious homeserver can construct messages that legitimately appear to have come from     another person, without any indication such as a grey shield. Additionally, a sophisticated attacker     cooperating with a malicious homeserver could employ this vulnerability to perform a targeted attack in     order to send fake to-device messages appearing to originate from another user. This can allow, for     example, to inject the key backup secret during a self-verification, to make a targeted device start using     a malicious key backup spoofed by the homeserver. These attacks are possible due to a protocol confusion     vulnerability that accepts to-device messages encrypted with Megolm instead of Olm. Starting with version     19.7.0, matrix-js-sdk has been modified to only accept Olm-encrypted to-device messages. Out of caution,     several other checks have been audited or added. This attack requires coordination between a malicious     home server and an attacker, so those who trust their home servers do not need a workaround.
    (CVE-2022-39251)

  - libexpat before 2.4.9 has a use-after-free in the doContent function in xmlparse.c. (CVE-2022-40674)

  - Mozilla: Remote content specified in an HTML document that was nested inside an iframe's srcdoc attribute     was not blocked (CVE-2022-3032)

  - Mozilla: Leaking of sensitive information when composing a response to an HTML email with a META refresh     tag (CVE-2022-3033)

  - Mozilla: An iframe element in an HTML email could trigger a network request (CVE-2022-3034)

  - Mozilla: Matrix SDK bundled with Thunderbird vulnerable to denial-of-service attack (CVE-2022-36059)

  - When injecting an HTML base element, some requests would ignore the CSP's base-uri settings and accept the     injected element's base instead.  (CVE-2022-40956)

  - Inconsistent data in instruction and data cache when creating wasm code could lead to a potentially     exploitable crash. This bug only affects Firefox on ARM64 platforms.  (CVE-2022-40957)

  - By injecting a cookie with certain special characters, an attacker on a shared subdomain which is not a     secure context could set and thus overwrite cookies from a secure context, leading to session fixation and     other attacks.  (CVE-2022-40958)

  - During iframe navigation, certain pages did not have their FeaturePolicy fully initialized leading to a     bypass that leaked device permissions into untrusted subdocuments.  (CVE-2022-40959)

  - Concurrent use of the URL parser with non-UTF-8 data was not thread-safe. This could lead to a use-after-     free causing a potentially exploitable crash.  (CVE-2022-40960)

  - Mozilla developers Nika Layzell, Timothy Nikkel, Sebastian Hengst, Andreas Pehrson, and the Mozilla     Fuzzing Team reported memory safety bugs present in Firefox 104 and Firefox ESR 102.2. Some of these bugs     showed evidence of memory corruption and we presume that with enough effort some of these could have been     exploited to run arbitrary code.  (CVE-2022-40962)

  - A same-origin policy violation could have allowed the theft of cross-origin URL entries, leaking the     result of a redirect, via <code>performance.getEntries()</code>.  (CVE-2022-42927)

  - Certain types of allocations were missing annotations that, if the Garbage Collector was in a specific     state, could have lead to memory corruption and a potentially exploitable crash.  (CVE-2022-42928)

  - If a website called <code>window.print()</code> in a particular way, it could cause a denial of service of     the browser, which may persist beyond browser restart depending on the user's session restore settings.
    (CVE-2022-42929)

  - Mozilla developers Ashley Hale and the Mozilla Fuzzing Team reported memory safety bugs present in     Thunderbird 102.3. Some of these bugs showed evidence of memory corruption and we presume that with enough     effort some of these could have been exploited to run arbitrary code.  (CVE-2022-42932)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2022:6717 advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2022-6710 advisory.

  - When injecting an HTML base element, some requests would ignore the CSP's base-uri settings and accept the     injected element's base instead.  (CVE-2022-40956)

  - Inconsistent data in instruction and data cache when creating wasm code could lead to a potentially     exploitable crash. This bug only affects Firefox on ARM64 platforms.  (CVE-2022-40957)

  - By injecting a cookie with certain special characters, an attacker on a shared subdomain which is not a     secure context could set and thus overwrite cookies from a secure context, leading to session fixation and     other attacks.  (CVE-2022-40958)

  - During iframe navigation, certain pages did not have their FeaturePolicy fully initialized leading to a     bypass that leaked device permissions into untrusted subdocuments.  (CVE-2022-40959)

  - Mozilla: Remote content specified in an HTML document that was nested inside an iframe's srcdoc attribute     was not blocked (CVE-2022-3032)

  - Mozilla: An iframe element in an HTML email could trigger a network request (CVE-2022-3034)

  - Concurrent use of the URL parser with non-UTF-8 data was not thread-safe. This could lead to a use-after-     free causing a potentially exploitable crash.  (CVE-2022-40960)

  - Mozilla developers Nika Layzell, Timothy Nikkel, Sebastian Hengst, Andreas Pehrson, and the Mozilla     Fuzzing Team reported memory safety bugs present in Firefox 104 and Firefox ESR 102.2. Some of these bugs     showed evidence of memory corruption and we presume that with enough effort some of these could have been     exploited to run arbitrary code.  (CVE-2022-40962)

  - Mozilla: Leaking of sensitive information when composing a response to an HTML email with a META refresh     tag (CVE-2022-3033)

  - Mozilla: Matrix SDK bundled with Thunderbird vulnerable to denial-of-service attack (CVE-2022-36059)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5663-1 advisory.

  - Mozilla developers and the Mozilla Fuzzing Team reported memory safety bugs present in Thunderbird 102.
    Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of     these could have been exploited to run arbitrary code.  (CVE-2022-2505)

  - Mozilla: Remote content specified in an HTML document that was nested inside an iframe's srcdoc attribute     was not blocked (CVE-2022-3032)

  - Mozilla: Leaking of sensitive information when composing a response to an HTML email with a META refresh     tag (CVE-2022-3033)

  - Mozilla: An iframe element in an HTML email could trigger a network request (CVE-2022-3034)

  - Mozilla: Matrix SDK bundled with Thunderbird vulnerable to denial-of-service attack (CVE-2022-36059)

  - When visiting directory listings for `chrome://` URLs as source text, some parameters were reflected.
    (CVE-2022-36318)

  - When combining CSS properties for overflow and transform, the mouse cursor could interact with different     coordinates than displayed.  (CVE-2022-36319)

  - An attacker could have abused XSLT error handling to associate attacker-controlled content with another     origin which was displayed in the address bar. This could have been used to fool the user into submitting     data intended for the spoofed origin.  (CVE-2022-38472)

  - Mozilla: Cross-origin XSLT Documents would have inherited the parent's permissions (CVE-2022-38473)

  - A data race could occur in the <code>PK11ChangePW</code> function, potentially leading to a use-after-free     vulnerability.  In Thunderbird, this lock protected the data when a user changed their master password.
    (CVE-2022-38476)

  - Mozilla developer Nika Layzell and the Mozilla Fuzzing Team reported memory safety bugs present in     Thunderbird 102.1. Some of these bugs showed evidence of memory corruption and we presume that with enough     effort some of these could have been exploited to run arbitrary code.  (CVE-2022-38477)

  - Members the Mozilla Fuzzing Team reported memory safety bugs present in Thunderbird 102.1 and Thunderbird     91.12. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some     of these could have been exploited to run arbitrary code.  (CVE-2022-38478)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Scientific Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the SLSA-2022:6710-1 advisory.

  - Mozilla: Leaking of sensitive information when composing a response to an  HTML email with a META refresh     tag (CVE-2022-3033)

  - Mozilla: Bypassing FeaturePolicy restrictions on transient pages (CVE-2022-40959)

  - Mozilla: Data-race when parsing non-UTF-8 URLs in threads (CVE-2022-40960)

  - Mozilla: Memory safety bugs fixed in Firefox 105 and Firefox ESR 102.3 (CVE-2022-40962)

  - Mozilla: Remote content specified in an HTML document that was nested inside an iframe's srcdoc attribute     was not blocked (CVE-2022-3032)

  - Mozilla: An iframe element in an HTML email could trigger a network request (CVE-2022-3034)

  - Mozilla: Matrix SDK bundled with Thunderbird vulnerable to  denial-of- service attack (CVE-2022-36059)

  - Mozilla: Bypassing Secure Context restriction for cookies with __Host and  __Secure prefix     (CVE-2022-40958)

  - Mozilla: Content-Security-Policy base-uri bypass (CVE-2022-40956)

  - Mozilla: Incoherent instruction cache when building WASM on ARM64 (CVE-2022-40957)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2022-6708 advisory.

  - When injecting an HTML base element, some requests would ignore the CSP's base-uri settings and accept the     injected element's base instead.  (CVE-2022-40956)

  - Inconsistent data in instruction and data cache when creating wasm code could lead to a potentially     exploitable crash. This bug only affects Firefox on ARM64 platforms.  (CVE-2022-40957)

  - By injecting a cookie with certain special characters, an attacker on a shared subdomain which is not a     secure context could set and thus overwrite cookies from a secure context, leading to session fixation and     other attacks.  (CVE-2022-40958)

  - During iframe navigation, certain pages did not have their FeaturePolicy fully initialized leading to a     bypass that leaked device permissions into untrusted subdocuments.  (CVE-2022-40959)

  - Mozilla: Remote content specified in an HTML document that was nested inside an iframe's srcdoc attribute     was not blocked (CVE-2022-3032)

  - Mozilla: An iframe element in an HTML email could trigger a network request (CVE-2022-3034)

  - Concurrent use of the URL parser with non-UTF-8 data was not thread-safe. This could lead to a use-after-     free causing a potentially exploitable crash.  (CVE-2022-40960)

  - Mozilla developers Nika Layzell, Timothy Nikkel, Sebastian Hengst, Andreas Pehrson, and the Mozilla     Fuzzing Team reported memory safety bugs present in Firefox 104 and Firefox ESR 102.2. Some of these bugs     showed evidence of memory corruption and we presume that with enough effort some of these could have been     exploited to run arbitrary code.  (CVE-2022-40962)

  - Mozilla: Leaking of sensitive information when composing a response to an HTML email with a META refresh     tag (CVE-2022-3033)

  - Mozilla: Matrix SDK bundled with Thunderbird vulnerable to denial-of-service attack (CVE-2022-36059)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2022-6717 advisory.

  - When injecting an HTML base element, some requests would ignore the CSP's base-uri settings and accept the     injected element's base instead.  (CVE-2022-40956)

  - Inconsistent data in instruction and data cache when creating wasm code could lead to a potentially     exploitable crash. This bug only affects Firefox on ARM64 platforms.  (CVE-2022-40957)

  - By injecting a cookie with certain special characters, an attacker on a shared subdomain which is not a     secure context could set and thus overwrite cookies from a secure context, leading to session fixation and     other attacks.  (CVE-2022-40958)

  - During iframe navigation, certain pages did not have their FeaturePolicy fully initialized leading to a     bypass that leaked device permissions into untrusted subdocuments.  (CVE-2022-40959)

  - Mozilla: Remote content specified in an HTML document that was nested inside an iframe's srcdoc attribute     was not blocked (CVE-2022-3032)

  - Mozilla: An iframe element in an HTML email could trigger a network request (CVE-2022-3034)

  - Concurrent use of the URL parser with non-UTF-8 data was not thread-safe. This could lead to a use-after-     free causing a potentially exploitable crash.  (CVE-2022-40960)

  - Mozilla developers Nika Layzell, Timothy Nikkel, Sebastian Hengst, Andreas Pehrson, and the Mozilla     Fuzzing Team reported memory safety bugs present in Firefox 104 and Firefox ESR 102.2. Some of these bugs     showed evidence of memory corruption and we presume that with enough effort some of these could have been     exploited to run arbitrary code.  (CVE-2022-40962)

  - Mozilla: Leaking of sensitive information when composing a response to an HTML email with a META refresh     tag (CVE-2022-3033)

  - Mozilla: Matrix SDK bundled with Thunderbird vulnerable to denial-of-service attack (CVE-2022-36059)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2022:6716 advisory.

  - Mozilla: Remote content specified in an HTML document that was nested inside an iframe's srcdoc attribute     was not blocked (CVE-2022-3032)

  - Mozilla: Leaking of sensitive information when composing a response to an HTML email with a META refresh     tag (CVE-2022-3033)

  - Mozilla: An iframe element in an HTML email could trigger a network request (CVE-2022-3034)

  - Mozilla: Matrix SDK bundled with Thunderbird vulnerable to denial-of-service attack (CVE-2022-36059)

  - Mozilla: Content-Security-Policy base-uri bypass (CVE-2022-40956)

  - Mozilla: Incoherent instruction cache when building WASM on ARM64 (CVE-2022-40957)

  - Mozilla: Bypassing Secure Context restriction for cookies with __Host and __Secure prefix (CVE-2022-40958)

  - Mozilla: Bypassing FeaturePolicy restrictions on transient pages (CVE-2022-40959)

  - Mozilla: Data-race when parsing non-UTF-8 URLs in threads (CVE-2022-40960)

  - Mozilla: Memory safety bugs fixed in Firefox 105 and Firefox ESR 102.3 (CVE-2022-40962)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2022:6708 advisory.

  - Mozilla: Remote content specified in an HTML document that was nested inside an iframe's srcdoc attribute     was not blocked (CVE-2022-3032)

  - Mozilla: Leaking of sensitive information when composing a response to an HTML email with a META refresh     tag (CVE-2022-3033)

  - Mozilla: An iframe element in an HTML email could trigger a network request (CVE-2022-3034)

  - Mozilla: Matrix SDK bundled with Thunderbird vulnerable to denial-of-service attack (CVE-2022-36059)

  - Mozilla: Content-Security-Policy base-uri bypass (CVE-2022-40956)

  - Mozilla: Incoherent instruction cache when building WASM on ARM64 (CVE-2022-40957)

  - Mozilla: Bypassing Secure Context restriction for cookies with __Host and __Secure prefix (CVE-2022-40958)

  - Mozilla: Bypassing FeaturePolicy restrictions on transient pages (CVE-2022-40959)

  - Mozilla: Data-race when parsing non-UTF-8 URLs in threads (CVE-2022-40960)

  - Mozilla: Memory safety bugs fixed in Firefox 105 and Firefox ESR 102.3 (CVE-2022-40962)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2022:6710 advisory.

  - Mozilla: Remote content specified in an HTML document that was nested inside an iframe's srcdoc attribute     was not blocked (CVE-2022-3032)

  - Mozilla: Leaking of sensitive information when composing a response to an HTML email with a META refresh     tag (CVE-2022-3033)

  - Mozilla: An iframe element in an HTML email could trigger a network request (CVE-2022-3034)

  - Mozilla: Matrix SDK bundled with Thunderbird vulnerable to denial-of-service attack (CVE-2022-36059)

  - Mozilla: Content-Security-Policy base-uri bypass (CVE-2022-40956)

  - Mozilla: Incoherent instruction cache when building WASM on ARM64 (CVE-2022-40957)

  - Mozilla: Bypassing Secure Context restriction for cookies with __Host and __Secure prefix (CVE-2022-40958)

  - Mozilla: Bypassing FeaturePolicy restrictions on transient pages (CVE-2022-40959)

  - Mozilla: Data-race when parsing non-UTF-8 URLs in threads (CVE-2022-40960)

  - Mozilla: Memory safety bugs fixed in Firefox 105 and Firefox ESR 102.3 (CVE-2022-40962)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2022:6715 advisory.

  - Mozilla: Remote content specified in an HTML document that was nested inside an iframe's srcdoc attribute     was not blocked (CVE-2022-3032)

  - Mozilla: Leaking of sensitive information when composing a response to an HTML email with a META refresh     tag (CVE-2022-3033)

  - Mozilla: An iframe element in an HTML email could trigger a network request (CVE-2022-3034)

  - Mozilla: Matrix SDK bundled with Thunderbird vulnerable to denial-of-service attack (CVE-2022-36059)

  - Mozilla: Content-Security-Policy base-uri bypass (CVE-2022-40956)

  - Mozilla: Incoherent instruction cache when building WASM on ARM64 (CVE-2022-40957)

  - Mozilla: Bypassing Secure Context restriction for cookies with __Host and __Secure prefix (CVE-2022-40958)

  - Mozilla: Bypassing FeaturePolicy restrictions on transient pages (CVE-2022-40959)

  - Mozilla: Data-race when parsing non-UTF-8 URLs in threads (CVE-2022-40960)

  - Mozilla: Memory safety bugs fixed in Firefox 105 and Firefox ESR 102.3 (CVE-2022-40962)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2022:6713 advisory.

  - Mozilla: Remote content specified in an HTML document that was nested inside an iframe's srcdoc attribute     was not blocked (CVE-2022-3032)

  - Mozilla: Leaking of sensitive information when composing a response to an HTML email with a META refresh     tag (CVE-2022-3033)

  - Mozilla: An iframe element in an HTML email could trigger a network request (CVE-2022-3034)

  - Mozilla: Matrix SDK bundled with Thunderbird vulnerable to denial-of-service attack (CVE-2022-36059)

  - Mozilla: Content-Security-Policy base-uri bypass (CVE-2022-40956)

  - Mozilla: Incoherent instruction cache when building WASM on ARM64 (CVE-2022-40957)

  - Mozilla: Bypassing Secure Context restriction for cookies with __Host and __Secure prefix (CVE-2022-40958)

  - Mozilla: Bypassing FeaturePolicy restrictions on transient pages (CVE-2022-40959)

  - Mozilla: Data-race when parsing non-UTF-8 URLs in threads (CVE-2022-40960)

  - Mozilla: Memory safety bugs fixed in Firefox 105 and Firefox ESR 102.3 (CVE-2022-40962)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2022:6717 advisory.

  - Mozilla: Remote content specified in an HTML document that was nested inside an iframe's srcdoc attribute     was not blocked (CVE-2022-3032)

  - Mozilla: Leaking of sensitive information when composing a response to an HTML email with a META refresh     tag (CVE-2022-3033)

  - Mozilla: An iframe element in an HTML email could trigger a network request (CVE-2022-3034)

  - Mozilla: Matrix SDK bundled with Thunderbird vulnerable to denial-of-service attack (CVE-2022-36059)

  - Mozilla: Content-Security-Policy base-uri bypass (CVE-2022-40956)

  - Mozilla: Incoherent instruction cache when building WASM on ARM64 (CVE-2022-40957)

  - Mozilla: Bypassing Secure Context restriction for cookies with __Host and __Secure prefix (CVE-2022-40958)

  - Mozilla: Bypassing FeaturePolicy restrictions on transient pages (CVE-2022-40959)

  - Mozilla: Data-race when parsing non-UTF-8 URLs in threads (CVE-2022-40960)

  - Mozilla: Memory safety bugs fixed in Firefox 105 and Firefox ESR 102.3 (CVE-2022-40962)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Thunderbird installed on the remote macOS or Mac OS X host is prior to 91.13.1. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2022-39 advisory.

  - If a Thunderbird user replied to a crafted HTML email containing a <code>meta</code> tag, with the     <code>meta</code> tag having the <code>http-equiv=refresh</code> attribute, and the content attribute     specifying an URL, then Thunderbird started a network request to that URL, regardless of the configuration     to block remote content. In combination with certain other HTML elements and attributes in the email, it     was possible to execute JavaScript code included in the message in the context of the message compose     document.  The JavaScript code was able to perform actions including, but probably not limited to, read     and modify the contents of the message compose document, including the quoted original message, which     could potentially contain the decrypted plaintext of encrypted data  in the crafted email. The contents     could then be transmitted to the network, either to the URL specified in the META refresh tag, or to a     different URL, as the JavaScript code could modify the URL specified in the document. This bug doesn't     affect users who have changed the default Message Body display setting to 'simple html' or 'plain text'.
    (CVE-2022-3033)

  - When receiving an HTML email that contained an <code>iframe</code> element, which used a     <code>srcdoc</code> attribute to define the inner HTML document, remote objects specified in the nested     document, for example images or videos, were not blocked. Rather, the network was accessed, the objects     were loaded and displayed. (CVE-2022-3032)

  - When receiving an HTML email that specified to load an <code>iframe</code> element from a remote location,     a request to the remote document was sent. However, Thunderbird didn't display the document.
    (CVE-2022-3034)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Thunderbird installed on the remote Windows host is prior to 91.13.1. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2022-39 advisory.

  - If a Thunderbird user replied to a crafted HTML email containing a <code>meta</code> tag, with the     <code>meta</code> tag having the <code>http-equiv=refresh</code> attribute, and the content attribute     specifying an URL, then Thunderbird started a network request to that URL, regardless of the configuration     to block remote content. In combination with certain other HTML elements and attributes in the email, it     was possible to execute JavaScript code included in the message in the context of the message compose     document.  The JavaScript code was able to perform actions including, but probably not limited to, read     and modify the contents of the message compose document, including the quoted original message, which     could potentially contain the decrypted plaintext of encrypted data  in the crafted email. The contents     could then be transmitted to the network, either to the URL specified in the META refresh tag, or to a     different URL, as the JavaScript code could modify the URL specified in the document. This bug doesn't     affect users who have changed the default Message Body display setting to 'simple html' or 'plain text'.
    (CVE-2022-3033)

  - When receiving an HTML email that contained an <code>iframe</code> element, which used a     <code>srcdoc</code> attribute to define the inner HTML document, remote objects specified in the nested     document, for example images or videos, were not blocked. Rather, the network was accessed, the objects     were loaded and displayed. (CVE-2022-3032)

  - When receiving an HTML email that specified to load an <code>iframe</code> element from a remote location,     a request to the remote document was sent. However, Thunderbird didn't display the document.
    (CVE-2022-3034)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:3281-1 advisory.

  - If an object prototype was corrupted by an attacker, they would have been able to set undesired attributes     on a JavaScript object, leading to privileged code execution. This vulnerability affects Firefox < 102,     Firefox ESR < 91.11, Thunderbird < 102, and Thunderbird < 91.11. (CVE-2022-2200)

  - An OpenPGP digital signature includes information about the date when the signature was created. When     displaying an email that contains a digital signature, the email's date will be shown. If the dates were     different, then Thunderbird didn't report the email as having an invalid signature. If an attacker     performed a replay attack, in which an old email with old contents are resent at a later time, it could     lead the victim to believe that the statements in the email are current. Fixed versions of Thunderbird     will require that the signature's date roughly matches the displayed date of the email. This vulnerability     affects Thunderbird < 102 and Thunderbird < 91.11. (CVE-2022-2226)

  - Mozilla developers and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 102. Some     of these bugs showed evidence of memory corruption and we presume that with enough effort some of these     could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR < 102.1, Firefox <     103, and Thunderbird < 102.1. (CVE-2022-2505)

  - When receiving an HTML email that contained an <code>iframe</code> element, which used a     <code>srcdoc</code> attribute to define the inner HTML document, remote objects specified in the nested     document, for example images or videos, were not blocked. Rather, the network was accessed, the objects     were loaded and displayed. This vulnerability affects Thunderbird < 102.2.1 and Thunderbird < 91.13.1.
    (CVE-2022-3032)

  - If a Thunderbird user replied to a crafted HTML email containing a <code>meta</code> tag, with the     <code>meta</code> tag having the <code>http-equiv=refresh</code> attribute, and the content attribute     specifying an URL, then Thunderbird started a network request to that URL, regardless of the configuration     to block remote content. In combination with certain other HTML elements and attributes in the email, it     was possible to execute JavaScript code included in the message in the context of the message compose     document. The JavaScript code was able to perform actions including, but probably not limited to, read and     modify the contents of the message compose document, including the quoted original message, which could     potentially contain the decrypted plaintext of encrypted data in the crafted email. The contents could     then be transmitted to the network, either to the URL specified in the META refresh tag, or to a different     URL, as the JavaScript code could modify the URL specified in the document. This bug doesn't affect users     who have changed the default Message Body display setting to 'simple html' or 'plain text'. This     vulnerability affects Thunderbird < 102.2.1 and Thunderbird < 91.13.1. (CVE-2022-3033)

  - When receiving an HTML email that specified to load an <code>iframe</code> element from a remote location,     a request to the remote document was sent. However, Thunderbird didn't display the document. This     vulnerability affects Thunderbird < 102.2.1 and Thunderbird < 91.13.1. (CVE-2022-3034)

  - An attacker could have injected CSS into stylesheets accessible via internal URIs, such as resource:, and     in doing so bypass a page's Content Security Policy. This vulnerability affects Firefox ESR < 91.11,     Thunderbird < 102, Thunderbird < 91.11, and Firefox < 101. (CVE-2022-31744)

  - An iframe that was not permitted to run scripts could do so if the user clicked on a     <code>javascript:</code> link. This vulnerability affects Firefox < 102, Firefox ESR < 91.11, Thunderbird     < 102, and Thunderbird < 91.11. (CVE-2022-34468)

  - Session history navigations may have led to a use-after-free and potentially exploitable crash. This     vulnerability affects Firefox < 102, Firefox ESR < 91.11, Thunderbird < 102, and Thunderbird < 91.11.
    (CVE-2022-34470)

  - If there was a PAC URL set and the server that hosts the PAC was not reachable, OCSP requests would have     been blocked, resulting in incorrect error pages being shown. This vulnerability affects Firefox < 102,     Firefox ESR < 91.11, Thunderbird < 102, and Thunderbird < 91.11. (CVE-2022-34472)

  - The <code>ms-msdt</code>, <code>search</code>, and <code>search-ms</code> protocols deliver content to     Microsoft applications, bypassing the browser, when a user accepts a prompt. These applications have had     known vulnerabilities, exploited in the wild (although we know of none exploited through Thunderbird), so     in this release Thunderbird has blocked these protocols from prompting the user to open them.<br>*This bug     only affects Thunderbird on Windows. Other operating systems are unaffected.*. This vulnerability affects     Firefox < 102, Firefox ESR < 91.11, Thunderbird < 102, and Thunderbird < 91.11. (CVE-2022-34478)

  - A malicious website that could create a popup could have resized the popup to overlay the address bar with     its own content, resulting in potential user confusion or spoofing attacks. <br>*This bug only affects     Thunderbird for Linux. Other operating systems are unaffected.*. This vulnerability affects Firefox < 102,     Firefox ESR < 91.11, Thunderbird < 102, and Thunderbird < 91.11. (CVE-2022-34479)

  - In the <code>nsTArray_Impl::ReplaceElementsAt()</code> function, an integer overflow could have occurred     when the number of elements to replace was too large for the container. This vulnerability affects Firefox     < 102, Firefox ESR < 91.11, Thunderbird < 102, and Thunderbird < 91.11. (CVE-2022-34481)

  - The Mozilla Fuzzing Team reported potential vulnerabilities present in Thunderbird 91.10. Some of these     bugs showed evidence of memory corruption and we presume that with enough effort some of these could have     been exploited to run arbitrary code. This vulnerability affects Firefox < 102, Firefox ESR < 91.11,     Thunderbird < 102, and Thunderbird < 91.11. (CVE-2022-34484)

  - matrix-js-sdk is a Matrix messaging protocol Client-Server SDK for JavaScript. In versions prior to 19.4.0     events sent with special strings in key places can temporarily disrupt or impede the matrix-js-sdk from     functioning properly, potentially impacting the consumer's ability to process data safely. Note that the     matrix-js-sdk can appear to be operating normally but be excluding or corrupting runtime data presented to     the consumer. This issue has been fixed in matrix-js-sdk 19.4.0 and users are advised to upgrade. Users     unable to upgrade may mitigate this issue by redacting applicable events, waiting for the sync processor     to store data, and restarting the client. Alternatively, redacting the applicable events and clearing all     storage will often fix most perceived issues. In some cases, no workarounds are possible. (CVE-2022-36059)

  - When opening a Windows shortcut from the local filesystem, an attacker could supply a remote path that     would lead to unexpected network requests from the operating system.<br>This bug only affects Firefox for     Windows. Other operating systems are unaffected.*. This vulnerability affects Firefox ESR < 102.1, Firefox     < 103, and Thunderbird < 102.1. (CVE-2022-36314)

  - When visiting directory listings for `chrome://` URLs as source text, some parameters were reflected. This     vulnerability affects Firefox ESR < 102.1, Firefox ESR < 91.12, Firefox < 103, Thunderbird < 102.1, and     Thunderbird < 91.12. (CVE-2022-36318)

  - When combining CSS properties for overflow and transform, the mouse cursor could interact with different     coordinates than displayed. This vulnerability affects Firefox ESR < 102.1, Firefox ESR < 91.12, Firefox <     103, Thunderbird < 102.1, and Thunderbird < 91.12. (CVE-2022-36319)

  - An attacker could have abused XSLT error handling to associate attacker-controlled content with another     origin which was displayed in the address bar. This could have been used to fool the user into submitting     data intended for the spoofed origin. This vulnerability affects Thunderbird < 102.2, Thunderbird < 91.13,     Firefox ESR < 91.13, Firefox ESR < 102.2, and Firefox < 104. (CVE-2022-38472)

  - A cross-origin iframe referencing an XSLT document would inherit the parent domain's permissions (such as     microphone or camera access). This vulnerability affects Thunderbird < 102.2, Thunderbird < 91.13, Firefox     ESR < 91.13, Firefox ESR < 102.2, and Firefox < 104. (CVE-2022-38473)

  - A data race could occur in the <code>PK11_ChangePW</code> function, potentially leading to a use-after-     free vulnerability. In Firefox, this lock protected the data when a user changed their master password.
    This vulnerability affects Firefox ESR < 102.2 and Thunderbird < 102.2. (CVE-2022-38476)

  - Mozilla developer Nika Layzell and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox     103 and Firefox ESR 102.1. Some of these bugs showed evidence of memory corruption and we presume that     with enough effort some of these could have been exploited to run arbitrary code. This vulnerability     affects Firefox ESR < 102.2, Thunderbird < 102.2, and Firefox < 104. (CVE-2022-38477)

  - Members the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 103, Firefox ESR 102.1,     and Firefox ESR 91.12. Some of these bugs showed evidence of memory corruption and we presume that with     enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects     Thunderbird < 102.2, Thunderbird < 91.13, Firefox ESR < 91.13, Firefox ESR < 102.2, and Firefox < 104.
    (CVE-2022-38478)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of mozilla-thunderbird installed on the remote host is prior to 102.2.1. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2022-249-02 advisory.

  - When receiving an HTML email that contained an <code>iframe</code> element, which used a     <code>srcdoc</code> attribute to define the inner HTML document, remote objects specified in the nested     document, for example images or videos, were not blocked. Rather, the network was accessed, the objects     were loaded and displayed.  (CVE-2022-3032)

  - If a Thunderbird user replied to a crafted HTML email containing a <code>meta</code> tag, with the     <code>meta</code> tag having the <code>http-equiv=refresh</code> attribute, and the content attribute     specifying an URL, then Thunderbird started a network request to that URL, regardless of the configuration     to block remote content. In combination with certain other HTML elements and attributes in the email, it     was possible to execute JavaScript code included in the message in the context of the message compose     document.  The JavaScript code was able to perform actions including, but probably not limited to, read     and modify the contents of the message compose document, including the quoted original message, which     could potentially contain the decrypted plaintext of encrypted data  in the crafted email. The contents     could then be transmitted to the network, either to the URL specified in the META refresh tag, or to a     different URL, as the JavaScript code could modify the URL specified in the document. This bug doesn't     affect users who have changed the default Message Body display setting to 'simple html' or 'plain text'.
    (CVE-2022-3033)

  - When receiving an HTML email that specified to load an <code>iframe</code> element from a remote location,     a request to the remote document was sent. However, Thunderbird didn't display the document.
    (CVE-2022-3034)

  - Thunderbird users who use the Matrix chat protocol were vulnerable to a denial-of-service attack. An     adversary sharing a room with a user had the ability to carry out an attack against affected clients,     making it not show all of a user's rooms or spaces and/or causing minor temporary corruption.
    (CVE-2022-36059)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 36 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2022-8bf22a684b advisory.

  - If a Thunderbird user replied to a crafted HTML email containing a <code>meta</code> tag, with the     <code>meta</code> tag having the <code>http-equiv=refresh</code> attribute, and the content attribute     specifying an URL, then Thunderbird started a network request to that URL, regardless of the configuration     to block remote content. In combination with certain other HTML elements and attributes in the email, it     was possible to execute JavaScript code included in the message in the context of the message compose     document. The JavaScript code was able to perform actions including, but probably not limited to, read and     modify the contents of the message compose document, including the quoted original message, which could     potentially contain the decrypted plaintext of encrypted data in the crafted email. The contents could     then be transmitted to the network, either to the URL specified in the META refresh tag, or to a different     URL, as the JavaScript code could modify the URL specified in the document. This bug doesn't affect users     who have changed the default Message Body display setting to 'simple html' or 'plain text'. This     vulnerability affects Thunderbird < 102.2.1 and Thunderbird < 91.13.1. (CVE-2022-3033)

  - When receiving an HTML email that contained an <code>iframe</code> element, which used a     <code>srcdoc</code> attribute to define the inner HTML document, remote objects specified in the nested     document, for example images or videos, were not blocked. Rather, the network was accessed, the objects     were loaded and displayed. This vulnerability affects Thunderbird < 102.2.1 and Thunderbird < 91.13.1.
    (CVE-2022-3032)

  - When receiving an HTML email that specified to load an <code>iframe</code> element from a remote location,     a request to the remote document was sent. However, Thunderbird didn't display the document. This     vulnerability affects Thunderbird < 102.2.1 and Thunderbird < 91.13.1. (CVE-2022-3034)

  - matrix-js-sdk is a Matrix messaging protocol Client-Server SDK for JavaScript. In versions prior to 19.4.0     events sent with special strings in key places can temporarily disrupt or impede the matrix-js-sdk from     functioning properly, potentially impacting the consumer's ability to process data safely. Note that the     matrix-js-sdk can appear to be operating normally but be excluding or corrupting runtime data presented to     the consumer. This issue has been fixed in matrix-js-sdk 19.4.0 and users are advised to upgrade. Users     unable to upgrade may mitigate this issue by redacting applicable events, waiting for the sync processor     to store data, and restarting the client. Alternatively, redacting the applicable events and clearing all     storage will often fix most perceived issues. In some cases, no workarounds are possible. (CVE-2022-36059)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Thunderbird installed on the remote macOS or Mac OS X host is prior to 102.2.1. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2022-38 advisory.

  - If a Thunderbird user replied to a crafted HTML email containing a <code>meta</code> tag, with the     <code>meta</code> tag having the <code>http-equiv=refresh</code> attribute, and the content attribute     specifying an URL, then Thunderbird started a network request to that URL, regardless of the configuration     to block remote content. In combination with certain other HTML elements and attributes in the email, it     was possible to execute JavaScript code included in the message in the context of the message compose     document.  The JavaScript code was able to perform actions including, but probably not limited to, read     and modify the contents of the message compose document, including the quoted original message, which     could potentially contain the decrypted plaintext of encrypted data  in the crafted email. The contents     could then be transmitted to the network, either to the URL specified in the META refresh tag, or to a     different URL, as the JavaScript code could modify the URL specified in the document. This bug doesn't     affect users who have changed the default Message Body display setting to 'simple html' or 'plain text'.
    (CVE-2022-3033)

  - When receiving an HTML email that contained an <code>iframe</code> element, which used a     <code>srcdoc</code> attribute to define the inner HTML document, remote objects specified in the nested     document, for example images or videos, were not blocked. Rather, the network was accessed, the objects     were loaded and displayed. (CVE-2022-3032)

  - When receiving an HTML email that specified to load an <code>iframe</code> element from a remote location,     a request to the remote document was sent. However, Thunderbird didn't display the document.
    (CVE-2022-3034)

  - Thunderbird users who use the Matrix chat protocol were vulnerable to a denial-of-service attack. An     adversary sharing a room with a user had the ability to carry out an attack against affected clients,     making it not show all of a user's rooms or spaces and/or causing minor temporary corruption.
    (CVE-2022-36059)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Thunderbird installed on the remote Windows host is prior to 102.2.1. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2022-38 advisory.

  - If a Thunderbird user replied to a crafted HTML email containing a <code>meta</code> tag, with the     <code>meta</code> tag having the <code>http-equiv=refresh</code> attribute, and the content attribute     specifying an URL, then Thunderbird started a network request to that URL, regardless of the configuration     to block remote content. In combination with certain other HTML elements and attributes in the email, it     was possible to execute JavaScript code included in the message in the context of the message compose     document.  The JavaScript code was able to perform actions including, but probably not limited to, read     and modify the contents of the message compose document, including the quoted original message, which     could potentially contain the decrypted plaintext of encrypted data  in the crafted email. The contents     could then be transmitted to the network, either to the URL specified in the META refresh tag, or to a     different URL, as the JavaScript code could modify the URL specified in the document. This bug doesn't     affect users who have changed the default Message Body display setting to 'simple html' or 'plain text'.
    (CVE-2022-3033)

  - When receiving an HTML email that contained an <code>iframe</code> element, which used a     <code>srcdoc</code> attribute to define the inner HTML document, remote objects specified in the nested     document, for example images or videos, were not blocked. Rather, the network was accessed, the objects     were loaded and displayed. (CVE-2022-3032)

  - When receiving an HTML email that specified to load an <code>iframe</code> element from a remote location,     a request to the remote document was sent. However, Thunderbird didn't display the document.
    (CVE-2022-3034)

  - Thunderbird users who use the Matrix chat protocol were vulnerable to a denial-of-service attack. An     adversary sharing a room with a user had the ability to carry out an attack against affected clients,     making it not show all of a user's rooms or spaces and/or causing minor temporary corruption.
    (CVE-2022-36059)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
184997	Rocky Linux 8 : thunderbird (RLSA-2022:6708)	Nessus	Rocky Linux Local Security Checks	high
168453	Amazon Linux 2 : thunderbird (ALAS-2022-1900)	Nessus	Amazon Linux Local Security Checks	high
167652	AlmaLinux 9 : thunderbird (ALSA-2022:6717)	Nessus	Alma Linux Local Security Checks	high
166568	Oracle Linux 7 : thunderbird (ELSA-2022-6710)	Nessus	Oracle Linux Local Security Checks	high
165820	Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS : Thunderbird vulnerabilities (USN-5663-1)	Nessus	Ubuntu Local Security Checks	high
165606	Scientific Linux Security Update : thunderbird on SL7.x x86_64 (2022:6710)	Nessus	Scientific Linux Local Security Checks	high
165518	Oracle Linux 8 : thunderbird (ELSA-2022-6708)	Nessus	Oracle Linux Local Security Checks	high
165515	Oracle Linux 9 : thunderbird (ELSA-2022-6717)	Nessus	Oracle Linux Local Security Checks	high
165474	RHEL 8 : thunderbird (RHSA-2022:6716)	Nessus	Red Hat Local Security Checks	high
165468	RHEL 8 : thunderbird (RHSA-2022:6708)	Nessus	Red Hat Local Security Checks	high
165467	RHEL 7 : thunderbird (RHSA-2022:6710)	Nessus	Red Hat Local Security Checks	high
165464	RHEL 8 : thunderbird (RHSA-2022:6715)	Nessus	Red Hat Local Security Checks	high
165462	RHEL 8 : thunderbird (RHSA-2022:6713)	Nessus	Red Hat Local Security Checks	high
165458	RHEL 9 : thunderbird (RHSA-2022:6717)	Nessus	Red Hat Local Security Checks	high
165246	Mozilla Thunderbird < 91.13.1	Nessus	MacOS X Local Security Checks	high
165245	Mozilla Thunderbird < 91.13.1	Nessus	Windows	high
165233	SUSE SLED15 / SLES15 Security Update : MozillaThunderbird (SUSE-SU-2022:3281-1)	Nessus	SuSE Local Security Checks	critical
164798	Slackware Linux 15.0 / current mozilla-thunderbird Multiple Vulnerabilities (SSA:2022-249-02)	Nessus	Slackware Local Security Checks	high
164645	Fedora 36 : thunderbird (2022-8bf22a684b)	Nessus	Fedora Local Security Checks	high
164540	Mozilla Thunderbird < 102.2.1	Nessus	MacOS X Local Security Checks	high
164539	Mozilla Thunderbird < 102.2.1	Nessus	Windows	high

Detections

Analytics

CVE-2022-3033

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

critical

high

high

high

high