VulnerableCode Package Details - pkg:alpm/archlinux/thunderbird@91.8.0-1

Search for packages

Vulnerability	Summary	Fixed by
This package is not known to be affected by vulnerabilities.

Vulnerability

Summary

Fixed by

This package is not known to be affected by vulnerabilities.

Vulnerability	Summary	Aliases
VCID-1ent-pcg9-zyfx	By using a link with rel="localization" a use-after-free could have been triggered by destroying an object during JavaScript execution and then referencing the object through a freed pointer, leading to a potential exploitable crash.	CVE-2022-28282
VCID-84bu-kea9-1bhu	When generating the assembly code for MLoadTypedArrayElementHole, an incorrect AliasSet was used. In conjunction with another vulnerability this could have been used for an out of bounds memory read.	CVE-2022-28285
VCID-dmxj-tg17-tbg7	When importing a revoked key that specified key compromise as the revocation reason, Thunderbird did not update the existing copy of the key that was not yet revoked, and the existing key was kept as non-revoked. Revocation statements that used another revocation reason, or that didn't specify a revocation reason, were unaffected.	CVE-2022-1197
VCID-msgg-jv2j-z7ds	Mozilla developers and community members Nika Layzell, Andrew McCreight, Gabriele Svelto, and the Mozilla Fuzzing Team reported memory safety bugs present in Thunderbird 91.7. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.	CVE-2022-28289
VCID-nfeu-9pc9-h7ak	Due to a layout change, iframe contents could have been rendered outside of its border. This could have led to user confusion or spoofing attacks.	CVE-2022-28286
VCID-qgzj-g3xe-rkem	If a compromised content process sent an unexpected number of WebAuthN Extensions in a Register command to the parent process, an out of bounds write would have occurred leading to memory corruption and a potentially exploitable crash.	CVE-2022-28281
VCID-tm8s-s5ws-nubr	The rust regex crate did not properly prevent crafted regular expressions from taking an arbitrary amount of time during parsing. If an attacker was able to supply input to this crate, they could have caused a denial of service in the browser.	CVE-2022-24713 GHSA-m5pq-gvj9-9vr8
VCID-u4wr-4q1y-4qcc	After a VR Process is destroyed, a reference to it may have been retained and used, leading to a use-after-free and potentially exploitable crash.	CVE-2022-1196
VCID-u773-rs2e-c7cn	NSSToken objects were referenced via direct points, and could have been accessed in an unsafe way on different threads, leading to a use-after-free and potentially exploitable crash.	CVE-2022-1097

Vulnerability

Summary

Aliases

VCID-1ent-pcg9-zyfx

By using a link with rel="localization" a use-after-free could have been triggered by destroying an object during JavaScript execution and then referencing the object through a freed pointer, leading to a potential exploitable crash.

CVE-2022-28282

VCID-84bu-kea9-1bhu

When generating the assembly code for MLoadTypedArrayElementHole, an incorrect AliasSet was used. In conjunction with another vulnerability this could have been used for an out of bounds memory read.

CVE-2022-28285

VCID-dmxj-tg17-tbg7

When importing a revoked key that specified key compromise as the revocation reason, Thunderbird did not update the existing copy of the key that was not yet revoked, and the existing key was kept as non-revoked. Revocation statements that used another revocation reason, or that didn't specify a revocation reason, were unaffected.

CVE-2022-1197

VCID-msgg-jv2j-z7ds

Mozilla developers and community members Nika Layzell, Andrew McCreight, Gabriele Svelto, and the Mozilla Fuzzing Team reported memory safety bugs present in Thunderbird 91.7. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.

CVE-2022-28289

VCID-nfeu-9pc9-h7ak

Due to a layout change, iframe contents could have been rendered outside of its border. This could have led to user confusion or spoofing attacks.

CVE-2022-28286

VCID-qgzj-g3xe-rkem

If a compromised content process sent an unexpected number of WebAuthN Extensions in a Register command to the parent process, an out of bounds write would have occurred leading to memory corruption and a potentially exploitable crash.

CVE-2022-28281

VCID-tm8s-s5ws-nubr

The rust regex crate did not properly prevent crafted regular expressions from taking an arbitrary amount of time during parsing. If an attacker was able to supply input to this crate, they could have caused a denial of service in the browser.

CVE-2022-24713
GHSA-m5pq-gvj9-9vr8

VCID-u4wr-4q1y-4qcc

After a VR Process is destroyed, a reference to it may have been retained and used, leading to a use-after-free and potentially exploitable crash.

CVE-2022-1196

VCID-u773-rs2e-c7cn

NSSToken objects were referenced via direct points, and could have been accessed in an unsafe way on different threads, leading to a use-after-free and potentially exploitable crash.

CVE-2022-1097

Date	Actor	Action	Vulnerability	Source	VulnerableCode Version
2025-07-31T11:36:03.140595+00:00	Arch Linux Importer	Fixing	VCID-u773-rs2e-c7cn	https://security.archlinux.org/AVG-2712	37.0.0
2025-07-31T11:36:03.115736+00:00	Arch Linux Importer	Fixing	VCID-u4wr-4q1y-4qcc	https://security.archlinux.org/AVG-2712	37.0.0
2025-07-31T11:36:03.090328+00:00	Arch Linux Importer	Fixing	VCID-dmxj-tg17-tbg7	https://security.archlinux.org/AVG-2712	37.0.0
2025-07-31T11:36:03.063076+00:00	Arch Linux Importer	Fixing	VCID-tm8s-s5ws-nubr	https://security.archlinux.org/AVG-2712	37.0.0
2025-07-31T11:36:03.036497+00:00	Arch Linux Importer	Fixing	VCID-qgzj-g3xe-rkem	https://security.archlinux.org/AVG-2712	37.0.0
2025-07-31T11:36:03.009869+00:00	Arch Linux Importer	Fixing	VCID-1ent-pcg9-zyfx	https://security.archlinux.org/AVG-2712	37.0.0
2025-07-31T11:36:02.984348+00:00	Arch Linux Importer	Fixing	VCID-84bu-kea9-1bhu	https://security.archlinux.org/AVG-2712	37.0.0
2025-07-31T11:36:02.957648+00:00	Arch Linux Importer	Fixing	VCID-nfeu-9pc9-h7ak	https://security.archlinux.org/AVG-2712	37.0.0
2025-07-31T11:36:02.932203+00:00	Arch Linux Importer	Fixing	VCID-msgg-jv2j-z7ds	https://security.archlinux.org/AVG-2712	37.0.0