MGASA-2022-0428

See a problem?
Please try reporting it to the source first.

Source

https://advisories.mageia.org/MGASA-2022-0428.html

Import Source

https://advisories.mageia.org/MGASA-2022-0428.json

JSON Data

https://api.osv.dev/v1/vulns/MGASA-2022-0428

Related

Published

2022-11-17T20:45:15Z

Modified

2022-11-17T19:49:25Z

Summary

Updated thunderbird packages fix security vulnerability

Details

Service Workers might have learned size of cross-origin media files. (CVE-2022-45403)

Fullscreen notification bypass. (CVE-2022-45404)

Use-after-free in InputStream implementation. (CVE-2022-45405)

Use-after-free of a JavaScript Realm. (CVE-2022-45406)

Fullscreen notification bypass via windowName. (CVE-2022-45408)

Use-after-free in Garbage Collection. (CVE-2022-45409)

ServiceWorker-intercepted requests bypassed SameSite cookie policy. (CVE-2022-45410)

Cross-Site Tracing was possible via non-standard override headers. (CVE-2022-45411)

Symlinks may resolve to partially uninitialized buffers. (CVE-2022-45412)

Keystroke Side-Channel Leakage. (CVE-2022-45416)

Custom mouse cursor could have been drawn over browser UI. (CVE-2022-45418)

Iframe contents could be rendered outside the iframe. (CVE-2022-45420)

Memory safety bugs fixed in Thunderbird 102.5. (CVE-2022-45421)

References

Credits

Affected packages

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

102.5.0-1.mga8

{
    "section": "core"
}

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

102.5.0-1.mga8

{
    "section": "core"
}