SUSE-SU-2022:4334-1

MEDIUM6.3

Security update for MozillaThunderbird

Published Dec 6, 2022

Modified 3 years ago

Fix available

Details

Description of the patch:

This update for MozillaThunderbird fixes the following issues:

Update to version 102.5.1:

CVE-2022-45414: Quoting from an HTML email with certain tags will trigger network requests and load remote content, regardless of a configuration to block remote content (bsc#1205941).

Affected Packages

MozillaThunderbird

SUSE Linux Enterprise Desktop 15 SP3SUSE Linux Enterprise Desktop 15 SP4SUSE Linux Enterprise Module for Package Hub 15 SP3SUSE Linux Enterprise Module for Package Hub 15 SP4SUSE Linux Enterprise Server 15 SP3

Fixed in:

102.5.1-150200.8.93.1

MozillaThunderbird-translations-common

SUSE Linux Enterprise Desktop 15 SP3SUSE Linux Enterprise Desktop 15 SP4SUSE Linux Enterprise Module for Package Hub 15 SP3SUSE Linux Enterprise Module for Package Hub 15 SP4SUSE Linux Enterprise Server 15 SP3

Fixed in:

102.5.1-150200.8.93.1

MozillaThunderbird-translations-other

SUSE Linux Enterprise Desktop 15 SP3SUSE Linux Enterprise Desktop 15 SP4SUSE Linux Enterprise Module for Package Hub 15 SP3SUSE Linux Enterprise Module for Package Hub 15 SP4SUSE Linux Enterprise Server 15 SP3

Fixed in:

102.5.1-150200.8.93.1

References

https://bugzilla.suse.com/1205941

https://lists.suse.com/pipermail/sle-security-updates/2022-December/013195.html

https://www.suse.com/security/cve/CVE-2022-45414/

https://www.suse.com/support/security/rating/

https://www.suse.com/support/update/announcement/2022/suse-su-20224334-1/

CVSS Analysis

CVSS v3.1

6.3

Exploitability

Attack Vector

NetworkAV:N

Attack Complexity

LowAC:L

Privileges Required

NonePR:N

User Interaction

RequiredUI:R

Scope

Scope

UnchangedS:U

Impact

Confidentiality

LowC:L

Integrity

LowI:L

Availability

LowA:L

6.3/CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

Upstream

Ecosystems(12)

SUSE Linux Enterprise Desktop 15 SP3 SUSE Linux Enterprise Desktop 15 SP4 SUSE Linux Enterprise Module for Package Hub 15 SP3 SUSE Linux Enterprise Module for Package Hub 15 SP4 SUSE Linux Enterprise Server 15 SP3

Timeline

PublishedDec 6, 2022

ModifiedDec 6, 2022

SUSE-SU-2022:4334-1 | Mondoo Vulnerability Intelligence