CVE-2022-22743 Affecting thunderbird package, versions <1:91.5.0+build1-0ubuntu0.21.10.1


Severity

Recommended
low

Based on Ubuntu security rating.

Threat Intelligence

EPSS
0.09% (41st percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-UBUNTU2110-THUNDERBIRD-2340388
  • published14 Jan 2022
  • disclosed22 Dec 2022

Introduced: 14 Jan 2022

CVE-2022-22743  (opens in a new tab)

How to fix?

Upgrade Ubuntu:21.10 thunderbird to version 1:91.5.0+build1-0ubuntu0.21.10.1 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream thunderbird package and not the thunderbird package as distributed by Ubuntu. See How to fix? for Ubuntu:21.10 relevant fixed versions and status.

When navigating from inside an iframe while requesting fullscreen access, an attacker-controlled tab could have made the browser unable to leave fullscreen mode. This vulnerability affects Firefox ESR < 91.5, Firefox < 96, and Thunderbird < 91.5.

CVSS Scores

version 3.1