Test ID:	1.3.6.1.4.1.25623.1.1.4.2022.4085.1
Category:	SuSE Local Security Checks
Title:	SUSE: Security Advisory (SUSE-SU-2022:4085-1)
Summary:	The remote host is missing an update for the 'MozillaThunderbird' package(s) announced via the SUSE-SU-2022:4085-1 advisory.
Description:	Summary: The remote host is missing an update for the 'MozillaThunderbird' package(s) announced via the SUSE-SU-2022:4085-1 advisory. Vulnerability Insight: This update for MozillaThunderbird fixes the following issues: Fixed various security issues (MFSA 2022-49, bsc#1205270): * CVE-2022-45403 (bmo#1762078) Service Workers might have learned size of cross-origin media files * CVE-2022-45404 (bmo#1790815) Fullscreen notification bypass * CVE-2022-45405 (bmo#1791314) Use-after-free in InputStream implementation * CVE-2022-45406 (bmo#1791975) Use-after-free of a JavaScript Realm * CVE-2022-45408 (bmo#1793829) Fullscreen notification bypass via windowName * CVE-2022-45409 (bmo#1796901) Use-after-free in Garbage Collection * CVE-2022-45410 (bmo#1658869) ServiceWorker-intercepted requests bypassed SameSite cookie policy * CVE-2022-45411 (bmo#1790311) Cross-Site Tracing was possible via non-standard override headers * CVE-2022-45412 (bmo#1791029) Symlinks may resolve to partially uninitialized buffers * CVE-2022-45416 (bmo#1793676) Keystroke Side-Channel Leakage * CVE-2022-45418 (bmo#1795815) Custom mouse cursor could have been drawn over browser UI * CVE-2022-45420 (bmo#1792643) Iframe contents could be rendered outside the iframe * CVE-2022-45421 (bmo#1767920, bmo#1789808, bmo#1794061) Memory safety bugs fixed in Thunderbird 102.5 Fixed various security issues: (MFSA 2022-46, bsc#1204421): * CVE-2022-42927 (bmo#1789128) Same-origin policy violation could have leaked cross-origin URLs * CVE-2022-42928 (bmo#1791520) Memory Corruption in JS Engine * CVE-2022-42929 (bmo#1789439) Denial of Service via window.print * CVE-2022-42932 (bmo#1789729, bmo#1791363, bmo#1792041) Memory safety bugs fixed in Thunderbird 102.4 Mozilla Thunderbird 102.5 * changed: `Ctrl+N` shortcut to create new contacts from address book restored (bmo#1751288) * fixed: Account Settings UI did not update to reflect default identity changes (bmo#1782646) * fixed: New POP mail notifications were incorrectly shown for messages marked by filters as read or junk (bmo#1787531) * fixed: Connecting to an IMAP server configured to use `PREAUTH` caused Thunderbird to hang (bmo#1798161) * fixed: Error responses received in greeting header from NNTP servers did not display error message (bmo#1792281) * fixed: News messages sent using 'Send Later' failed to send after going back online (bmo#1794997) * fixed: 'Download/Sync Now...' did not completely sync all newsgroups before going offline (bmo#1795547) * fixed: Username was missing from error dialog on failed login to news server (bmo#1796964) * fixed: Thunderbird can now fetch RSS channel feeds with incomplete channel URL (bmo#1794775) * fixed: Add-on 'Contribute' button in Add-ons Manager did not work (bmo#1795751) * fixed: Help text for `/part` Matrix command was incorrect (bmo#1795578) * fixed: Invite Attendees dialog did not fetch free/busy info for attendees with encoded characters in their name (bmo#1797927) Mozilla Thunderbird 102.4.2 * changed: 'Address Book' ... [Please see the references for more information on the vulnerabilities] Affected Software/OS: 'MozillaThunderbird' package(s) on SUSE Linux Enterprise Module for Packagehub Subpackages 15-SP3, SUSE Linux Enterprise Module for Packagehub Subpackages 15-SP4, SUSE Linux Enterprise Workstation Extension 15-SP3, SUSE Linux Enterprise Workstation Extension 15-SP4. Solution: Please install the updated package(s). CVSS Score: 10.0 CVSS Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2022-42927 https://bugzilla.mozilla.org/show_bug.cgi?id=1789128 https://www.mozilla.org/security/advisories/mfsa2022-44/ https://www.mozilla.org/security/advisories/mfsa2022-45/ https://www.mozilla.org/security/advisories/mfsa2022-46/ Common Vulnerability Exposure (CVE) ID: CVE-2022-42928 https://bugzilla.mozilla.org/show_bug.cgi?id=1791520 Common Vulnerability Exposure (CVE) ID: CVE-2022-42929 https://bugzilla.mozilla.org/show_bug.cgi?id=1789439 Common Vulnerability Exposure (CVE) ID: CVE-2022-42932 Memory safety bugs fixed in Firefox 106 and Firefox ESR 102.4 https://bugzilla.mozilla.org/buglist.cgi?bug_id=1789729%2C1791363%2C1792041 Common Vulnerability Exposure (CVE) ID: CVE-2022-45403 https://bugzilla.mozilla.org/show_bug.cgi?id=1762078 https://www.mozilla.org/security/advisories/mfsa2022-47/ https://www.mozilla.org/security/advisories/mfsa2022-48/ https://www.mozilla.org/security/advisories/mfsa2022-49/ Common Vulnerability Exposure (CVE) ID: CVE-2022-45404 https://bugzilla.mozilla.org/show_bug.cgi?id=1790815 Common Vulnerability Exposure (CVE) ID: CVE-2022-45405 https://bugzilla.mozilla.org/show_bug.cgi?id=1791314 Common Vulnerability Exposure (CVE) ID: CVE-2022-45406 https://bugzilla.mozilla.org/show_bug.cgi?id=1791975 Common Vulnerability Exposure (CVE) ID: CVE-2022-45408 https://bugzilla.mozilla.org/show_bug.cgi?id=1793829 Common Vulnerability Exposure (CVE) ID: CVE-2022-45409 https://bugzilla.mozilla.org/show_bug.cgi?id=1796901 Common Vulnerability Exposure (CVE) ID: CVE-2022-45410 https://bugzilla.mozilla.org/show_bug.cgi?id=1658869 Common Vulnerability Exposure (CVE) ID: CVE-2022-45411 https://bugzilla.mozilla.org/show_bug.cgi?id=1790311 Common Vulnerability Exposure (CVE) ID: CVE-2022-45412 https://bugzilla.mozilla.org/show_bug.cgi?id=1791029 Common Vulnerability Exposure (CVE) ID: CVE-2022-45416 https://bugzilla.mozilla.org/show_bug.cgi?id=1793676 Common Vulnerability Exposure (CVE) ID: CVE-2022-45418 https://bugzilla.mozilla.org/show_bug.cgi?id=1795815 Common Vulnerability Exposure (CVE) ID: CVE-2022-45420 https://bugzilla.mozilla.org/show_bug.cgi?id=1792643 Common Vulnerability Exposure (CVE) ID: CVE-2022-45421 https://bugzilla.mozilla.org/buglist.cgi?bug_id=1767920%2C1789808%2C1794061
Copyright	Copyright (C) 2022 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.