Most recent entries from all

ALSA-2022:6708 — Important: thunderbird security update

2026-10-03T03:31:42.864986+00:00

Affected: AlmaLinux:8: thunderbird

Mozilla Thunderbird is a standalone mail and newsgroup client.

This update upgrades Thunderbird to version 102.3.0.

Security Fix(es):

* Mozilla: Leaking of sensitive information when composing a response to an HTML email with a META refresh tag (CVE-2022-3033) * Mozilla: Bypassing FeaturePolicy restrictions on transient pages (CVE-2022-40959) * Mozilla: Data-race when parsing non-UTF-8 URLs in threads (CVE-2022-40960) * Mozilla: Memory safety bugs fixed in Firefox 105 and Firefox ESR 102.3 (CVE-2022-40962) * Mozilla: Remote content specified in an HTML document that was nested inside an iframe's srcdoc attribute was not blocked (CVE-2022-3032) * Mozilla: An iframe element in an HTML email could trigger a network request (CVE-2022-3034) * Mozilla: Matrix SDK bundled with Thunderbird vulnerable to denial-of-service attack (CVE-2022-36059) * Mozilla: Bypassing Secure Context restriction for cookies with __Host and __Secure prefix (CVE-2022-40958) * Mozilla: Content-Security-Policy base-uri bypass (CVE-2022-40956) * Mozilla: Incoherent instruction cache when building WASM on ARM64 (CVE-2022-40957)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2022-05486

2026-10-03T03:31:42.865076+00:00

bdu:2022-05486

certfr-2022-avi-786 — De multiples vulnérabilités ont été découvertes dans Mozilla Thunderbird. Elles permettent à un attaquant de provoquer…

2026-10-03T03:31:42.865104+00:00

certfr-2022-avi-786

CLEANSTART-2024-IV81629 — matrix-js-sdk is a Matrix messaging protocol Client-Server SDK for JavaScript

2026-10-03T03:31:42.865132+00:00

Affected: CleanStart: element-web

Security vulnerability affects the element-web package. matrix-js-sdk is a Matrix messaging protocol Client-Server SDK for JavaScript.

EUVD-2026-218134

2026-10-03T03:31:42.865169+00:00

EUVD-2026-218134

fkie_cve-2022-36059

2026-10-03T03:31:42.865191+00:00

matrix-js-sdk is a Matrix messaging protocol Client-Server SDK for JavaScript. In versions prior to 19.4.0 events sent with special strings in key places can temporarily disrupt or impede the matrix-js-sdk from functioning properly, potentially impacting the consumer's ability to process data safely. Note that the matrix-js-sdk can appear to be operating normally but be excluding or corrupting runtime data presented to the consumer. This issue has been fixed in matrix-js-sdk 19.4.0 and users are advised to upgrade. Users unable to upgrade may mitigate this issue by redacting applicable events, waiting for the sync processor to store data, and restarting the client. Alternatively, redacting the applicable events and clearing all storage will often fix most perceived issues. In some cases, no workarounds are possible.

GHSA-rfv9-x7hh-xc32 — matrix-js-sdk Prototype Pollution vulnerability

2026-10-03T03:31:42.865235+00:00

Affected: npm: matrix-js-sdk

### Impact Events sent with special strings in key places can temporarily disrupt or impede the matrix-js-sdk from functioning properly, potentially impacting the consumer's ability to process data safely. Note that the matrix-js-sdk can appear to be operating normally but be excluding or corrupting runtime data presented to the consumer.

### Patches This is fixed in matrix-js-sdk 19.4.0.

### Workarounds Redacting applicable events, waiting for the sync processor to store data, and restarting the client can often fix it. Alternatively, redacting the applicable events and clearing all storage will often fix most perceived issues.

In some cases, no workarounds are possible.

### References https://learn.snyk.io/lessons/prototype-pollution/javascript/

### For more information If you have any questions or comments about this advisory please email us at [security at matrix.org](mailto:security@matrix.org).

gsd-2022-36059

2026-10-03T03:31:42.865285+00:00

gsd-2022-36059

openSUSE-SU-2024:12294-1 — element-desktop-1.11.4-1.1 on GA media

2026-10-03T03:31:42.865306+00:00

element-desktop-1.11.4-1.1 on GA media

RHSA-2022:6713 — Red Hat Security Advisory: thunderbird security update

2026-10-03T03:31:42.865334+00:00

Mozilla: Remote content specified in an HTML document that was nested inside an iframe's srcdoc attribute was not blocked Mozilla: Leaking of sensitive information when composing a response to an HTML email with a META refresh tag Mozilla: An iframe element in an HTML email could trigger a network request Mozilla: Out of bounds read when decoding H264 Mozilla: Matrix SDK bundled with Thunderbird vulnerable to denial-of-service attack Mozilla: Content-Security-Policy base-uri bypass Mozilla: Incoherent instruction cache when building WASM on ARM64 Mozilla: Bypassing Secure Context restriction for cookies with __Host and __Secure prefix Mozilla: Bypassing FeaturePolicy restrictions on transient pages Mozilla: Data-race when parsing non-UTF-8 URLs in threads Mozilla: Memory safety bugs fixed in Firefox 105 and Firefox ESR 102.3

UBUNTU-CVE-2022-36059

2026-10-03T03:31:42.865385+00:00

Affected: Ubuntu:18.04:LTS: thunderbird, Ubuntu:20.04:LTS: thunderbird, Ubuntu:20.04:LTS: node-matrix-js-sdk, Ubuntu:22.04:LTS: node-matrix-js-sdk, Ubuntu:22.04:LTS: thunderbird, Ubuntu:24.04:LTS: node-matrix-js-sdk

WID-SEC-W-2022-1246 — Mozilla Thunderbird: Mehrere Schwachstellen

2026-10-03T03:31:42.865440+00:00

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Mozilla Thunderbird ausnutzen, um Sicherheitsvorkehrungen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand zu verursachen.