{"schemaVersion":3,"id":"USN-5435-1","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"thunderbird vulnerabilities\n\nMultiple security issues were discovered in Thunderbird. If a user were\ntricked into opening a specially crafted website in a browsing context, an\nattacker could potentially exploit these to cause a denial of service,\nbypass permission prompts, obtain sensitive information, bypass security\nrestrictions, cause user confusion, or execute arbitrary code.\n(CVE-2022-29909, CVE-2022-29911, CVE-2022-29912, CVE-2022-29913,\nCVE-2022-29914, CVE-2022-29916, CVE-2022-29917)\n\nIt was discovered that Thunderbird would show the wrong security status\nafter viewing an attached message that is signed or encrypted. An attacker\ncould potentially exploit this by tricking the user into trusting the\nauthenticity of a message. (CVE-2022-1520)\n\nIt was discovered that the methods of an Array object could be corrupted\nas a result of prototype pollution by sending a message to the parent\nprocess. If a user were tricked into opening a specially crafted website\nin a browsing context, an attacker could exploit this to execute\nJavaScript in a privileged context. (CVE-2022-1529, CVE-2022-1802)","dates":{"published":"2022-05-25T07:47:27.000Z","modified":"2026-04-22T10:24:30.175Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":null,"severity":"unknown","version":null,"versionLabel":null,"source":null,"vector":null,"computed":false,"selection":"none"},"metrics":[]},"epss":{"probability":null,"percentile":null,"severity":"unknown","asOf":null,"change":{"pp":null,"baselineDate":null,"baselineScore":null},"history":[],"last30":[]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[],"affected":[{"vendor":"ubuntu","product":"thunderbird","name":"thunderbird","label":"thunderbird","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/thunderbird","purlType":"deb","versions":[{"text":"< 1:91.9.1+build1-0ubuntu0.18.04.1","noFixRecorded":false,"fixedIn":null},{"text":"< 1:91.9.1+build1-0ubuntu0.20.04.1","noFixRecorded":false,"fixedIn":null},{"text":"< 1:91.9.1+build1-0ubuntu0.22.04.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1:91.9.1+build1-0ubuntu0.18.04.1 | < 1:91.9.1+build1-0ubuntu0.20.04.1 | < 1:91.9.1+build1-0ubuntu0.22.04.1","eol":null,"hubHref":null}],"affectedCount":1,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://ubuntu.com/security/notices/USN-5435-1","label":"ubuntu.com/security/notices/USN-5435-1","hostname":"ubuntu.com","tags":["Advisory"]},{"url":"https://ubuntu.com/security/CVE-2022-1520","label":"ubuntu.com/security/CVE-2022-1520","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2022-1529","label":"ubuntu.com/security/CVE-2022-1529","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2022-1802","label":"ubuntu.com/security/CVE-2022-1802","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2022-29909","label":"ubuntu.com/security/CVE-2022-29909","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2022-29911","label":"ubuntu.com/security/CVE-2022-29911","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2022-29912","label":"ubuntu.com/security/CVE-2022-29912","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2022-29913","label":"ubuntu.com/security/CVE-2022-29913","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2022-29914","label":"ubuntu.com/security/CVE-2022-29914","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2022-29916","label":"ubuntu.com/security/CVE-2022-29916","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2022-29917","label":"ubuntu.com/security/CVE-2022-29917","hostname":"ubuntu.com","tags":["REPORT"]}],"lineage":{"upstream":["CVE-2022-1520","CVE-2022-1529","CVE-2022-1802","CVE-2022-29909","CVE-2022-29911","CVE-2022-29912","CVE-2022-29913","CVE-2022-29914","CVE-2022-29916","CVE-2022-29917"],"downstream":[],"duplicates":[],"related":["CVE-2022-1520","CVE-2022-1529","CVE-2022-1802","CVE-2022-29909","CVE-2022-29911","CVE-2022-29912","CVE-2022-29913","CVE-2022-29914","CVE-2022-29916","CVE-2022-29917"]},"timeline":[{"kind":"published","date":"2022-05-25T07:47:27.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-04-22T10:24:30.175Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":0,"level":"minimal","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-19T18:37:07.465Z","stale":false,"partial":false}}