Alpine: thunderbird: security update to 102.0-r0

critical Tenable Cloud Security Plugin ID 407334

Description

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

- The Mozilla Fuzzing Team reported potential vulnerabilities present in Thunderbird 91.10. Some of these
bugs showed evidence of memory corruption and we presume that with enough effort some of these could have
been exploited to run arbitrary code. This vulnerability affects Firefox < 102, Firefox ESR < 91.11,
Thunderbird < 102, and Thunderbird < 91.11. (CVE-2022-34484)

- If an object prototype was corrupted by an attacker, they would have been able to set undesired attributes
on a JavaScript object, leading to privileged code execution. This vulnerability affects Firefox < 102,
Firefox ESR < 91.11, Thunderbird < 102, and Thunderbird < 91.11. (CVE-2022-2200)

- An OpenPGP digital signature includes information about the date when the signature was created. When
displaying an email that contains a digital signature, the email's date will be shown. If the dates were
different, then Thunderbird didn't report the email as having an invalid signature. If an attacker
performed a replay attack, in which an old email with old contents are resent at a later time, it could
lead the victim to believe that the statements in the email are current. Fixed versions of Thunderbird
will require that the signature's date roughly matches the displayed date of the email. This vulnerability
affects Thunderbird < 102 and Thunderbird < 91.11. (CVE-2022-2226)

- An attacker could have injected CSS into stylesheets accessible via internal URIs, such as resource:, and
in doing so bypass a page's Content Security Policy. This vulnerability affects Firefox ESR < 91.11,
Thunderbird < 102, Thunderbird < 91.11, and Firefox < 101. (CVE-2022-31744)

- An iframe that was not permitted to run scripts could do so if the user clicked on a
<code>javascript:</code> link. This vulnerability affects Firefox < 102, Firefox ESR < 91.11, Thunderbird
< 102, and Thunderbird < 91.11. (CVE-2022-34468)

Plugin Details

Severity: Critical

ID: 407334

Version: Revision 1.31

Type: Local

Family: Alpine Linux Local Security Checks

Published: 10/31/2023

Updated: 7/2/2026

Supported Sensors: Agentless Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 5.8

Percentile: 97.13

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 7.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2022-34484

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 8.8

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

CVSS Score Source: CVE-2022-34470

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Vulnerability Publication Date: 5/31/2022

Reference Information

CVE: CVE-2022-2200, CVE-2022-2226, CVE-2022-31744, CVE-2022-34468, CVE-2022-34470, CVE-2022-34472, CVE-2022-34478, CVE-2022-34479, CVE-2022-34481, CVE-2022-34484

IAVA: 2022-A-0226-S, 2022-A-0256-S

Detections

Analytics