Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:rpm/redhat/thunderbird@102.6.0-2?arch=el9_1
purl pkg:rpm/redhat/thunderbird@102.6.0-2?arch=el9_1
Next non-vulnerable version None.
Latest non-vulnerable version None.
Risk 4.4
Vulnerabilities affecting this package (7)
Vulnerability Summary Fixed by
VCID-362f-1bn1-mbg5
Aliases:
CVE-2022-46882
Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could result in arbitrary code execution. There are no reported fixed by versions.
VCID-e4nx-qfam-cfaj
Aliases:
CVE-2022-46872
Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could result in arbitrary code execution. There are no reported fixed by versions.
VCID-fxnj-rr7h-ryb5
Aliases:
CVE-2022-46880
Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could result in arbitrary code execution. There are no reported fixed by versions.
VCID-hp32-swmr-qqdy
Aliases:
CVE-2022-46878
Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could result in arbitrary code execution. There are no reported fixed by versions.
VCID-q494-zvyn-quge
Aliases:
CVE-2022-46881
Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could result in arbitrary code execution. There are no reported fixed by versions.
VCID-x4b1-wug7-wuex
Aliases:
CVE-2022-45414
If a Thunderbird user quoted from an HTML email, for example by replying to the email, and the email contained either a VIDEO tag with the POSTER attribute or an OBJECT tag with a DATA attribute, a network request to the referenced remote URL was performed, regardless of a configuration to block remote content. An image loaded from the POSTER attribute was shown in the composer window. These issues could have given an attacker additional capabilities when targeting releases that did not yet have a fix for CVE-2022-3033 which was reported around three months ago. There are no reported fixed by versions.
VCID-yxy6-s185-myc9
Aliases:
CVE-2022-46874
Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could result in arbitrary code execution. There are no reported fixed by versions.
Vulnerabilities fixed by this package (0)
Vulnerability Summary Aliases
This package is not known to fix vulnerabilities.

Date Actor Action Vulnerability Source VulnerableCode Version
2026-04-01T13:56:12.671902+00:00 RedHat Importer Affected by VCID-x4b1-wug7-wuex https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-45414.json 38.0.0
2026-04-01T13:56:05.567427+00:00 RedHat Importer Affected by VCID-362f-1bn1-mbg5 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-46882.json 38.0.0
2026-04-01T13:56:04.980509+00:00 RedHat Importer Affected by VCID-q494-zvyn-quge https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-46881.json 38.0.0
2026-04-01T13:56:04.399442+00:00 RedHat Importer Affected by VCID-fxnj-rr7h-ryb5 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-46880.json 38.0.0
2026-04-01T13:56:03.808517+00:00 RedHat Importer Affected by VCID-hp32-swmr-qqdy https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-46878.json 38.0.0
2026-04-01T13:56:03.206726+00:00 RedHat Importer Affected by VCID-yxy6-s185-myc9 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-46874.json 38.0.0
2026-04-01T13:56:02.643760+00:00 RedHat Importer Affected by VCID-e4nx-qfam-cfaj https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-46872.json 38.0.0