| Description: | Summary:
The remote host is missing an update for the 'thunderbird, thunderbird-l10n' package(s) announced via the MGASA-2022-0157 advisory.
Vulnerability Insight:
The updated thunderbird packages fix security vulnerabilities:
Use-after-free in NSSToken objects (CVE-2022-1097).
Use-after-free after VR Process destruction (CVE-2022-1196).
OpenPGP revocation information was ignored (CVE-2022-1197).
Denial of Service via complex regular expressions (CVE-2022-24713).
xmltok_impl.c in Expat (aka libexpat) before 2.4.5 lacks certain validation
of encoding, such as checks for whether a UTF-8 character is valid in a
certain context (CVE-2022-25235).
xmlparse.c in Expat (aka libexpat) before 2.4.5 allows attackers to insert
namespace-separator characters into namespace URIs (CVE-2022-25236).
In Expat (aka libexpat) before 2.4.5, there is an integer overflow in
storeRawNames (CVE-2022-25315).
Out of bounds write due to unexpected WebAuthN Extensions (CVE-2022-28281).
Use-after-free in DocumentL10n::TranslateDocument (CVE-2022-28282).
Incorrect AliasSet used in JIT Codegen (CVE-2022-28285).
iframe contents could be rendered outside the border (CVE-2022-28286).
Memory safety bugs fixed in Thunderbird 91.8 (CVE-2022-28289).
Affected Software/OS:
'thunderbird, thunderbird-l10n' package(s) on Mageia 8.
Solution:
Please install the updated package(s).
CVSS Score:
7.5
CVSS Vector:
AV:N/AC:L/Au:N/C:P/I:P/A:P
|
