Описание
Security update for MozillaThunderbird
This update for MozillaThunderbird fixes the following issues:
Mozilla Thunderbird 91.6.2 (bsc#1196809):
- CVE-2022-26485: Use-after-free in XSLT parameter processing
- CVE-2022-26486: Use-after-free in WebGPU IPC Framework
Список пакетов
openSUSE Leap 15.3
MozillaThunderbird-91.6.2-8.59.1
MozillaThunderbird-translations-common-91.6.2-8.59.1
MozillaThunderbird-translations-other-91.6.2-8.59.1
Ссылки
- E-Mail link for openSUSE-SU-2022:0804-1
- SUSE Security Ratings
- SUSE Bug 1196809
- SUSE CVE CVE-2022-26485 page
- SUSE CVE CVE-2022-26486 page
Описание
Removing an XSLT parameter during processing could have lead to an exploitable use-after-free. We have had reports of attacks in the wild abusing this flaw. This vulnerability affects Firefox < 97.0.2, Firefox ESR < 91.6.1, Firefox for Android < 97.3.0, Thunderbird < 91.6.2, and Focus < 97.3.0.
Затронутые продукты
openSUSE Leap 15.3:MozillaThunderbird-91.6.2-8.59.1
openSUSE Leap 15.3:MozillaThunderbird-translations-common-91.6.2-8.59.1
openSUSE Leap 15.3:MozillaThunderbird-translations-other-91.6.2-8.59.1
Ссылки
- CVE-2022-26485
- SUSE Bug 1196809
Описание
An unexpected message in the WebGPU IPC framework could lead to a use-after-free and exploitable sandbox escape. We have had reports of attacks in the wild abusing this flaw. This vulnerability affects Firefox < 97.0.2, Firefox ESR < 91.6.1, Firefox for Android < 97.3.0, Thunderbird < 91.6.2, and Focus < 97.3.0.
Затронутые продукты
openSUSE Leap 15.3:MozillaThunderbird-91.6.2-8.59.1
openSUSE Leap 15.3:MozillaThunderbird-translations-common-91.6.2-8.59.1
openSUSE Leap 15.3:MozillaThunderbird-translations-other-91.6.2-8.59.1
Ссылки
- CVE-2022-26486
- SUSE Bug 1196809