QID 353193

Date Published: 2022-03-09

QID 353193: Amazon Linux Security Advisory for thunderbird : ALAS2-2022-1763

the mozilla foundation security advisory describes this flaw as: it was possible to construct specific xslt markup that would be able to bypass an iframe sandbox. (
( CVE-2021-4140) the mozilla foundation security advisory describes this flaw as: constructing audio sinks could have lead to a race condition when playing audio files and closing windows.
This could have lead to a use-after-free causing a potentially exploitable crash. (
( CVE-2022-22737) the mozilla foundation security advisory describes this flaw as: applying a css filter effect could have accessed out of bounds memory.
This could have lead to a heap-buffer-overflow causing a potentially exploitable crash. (
( CVE-2022-22738) the mozilla foundation security advisory describes this flaw as: malicious websites could have tricked users into accepting launching a program to handle an external url protocol. (
( CVE-2022-22739) the mozilla foundation security advisory describes this flaw as: certain network request objects were freed too early when releasing a network request handle.
( CVE-2022-22740) the mozilla foundation security advisory describes this flaw as: when resizing a popup while requesting fullscreen access, the popup would have become unable to leave fullscreen mode. (
( CVE-2022-22741) the mozilla foundation security advisory describes this flaw as: when inserting text while in edit mode, some characters might have lead to out-of-bounds memory access causing a potentially exploitable crash. .

Successful exploitation of this vulnerability could lead to a securitybreach or could affect integrity, availability, and confidentiality.

  • CVSS V3 rated as High - 6.2 severity.
  • CVSS V2 rated as Medium - 5.4 severity.
  • Solution
    Please refer to Amazon advisory: ALAS2-2022-1763 for affected packages and patching details, or update with your package manager.
    Vendor References
    Software Advisories
    Advisory ID Software Component Link
    ALAS2-2022-1763 Amazon Linux 2 URL Logo alas.aws.amazon.com/AL2/ALAS-2022-1763.html