{"schemaVersion":3,"id":"USN-5512-1","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"thunderbird vulnerabilities\n\nMultiple security issues were discovered in Thunderbird. If a user were\ntricked into opening a specially crafted website in a browsing context, an\nattacker could potentially exploit these to cause a denial of service,\nobtain sensitive information, spoof the UI, bypass CSP restrictions, or\nexecute arbitrary code. (CVE-2022-2200, CVE-2022-31736, CVE-2022-31737,\nCVE-2022-31738, CVE-2022-31740, CVE-2022-31741, CVE-2022-31742,\nCVE-2022-31744, CVE-2022-31747, CVE-2022-34468, CVE-2022-34470,\nCVE-2022-34479, CVE-2022-34481, CVE-2022-34484)\n\nIt was discovered that an unavailable PAC file caused OCSP requests to\nbe blocked, resulting in incorrect error pages being displayed.\n(CVE-2022-34472)\n\nIt was discovered that the Braille space character could be used to\ncause Thunderbird to display the wrong sender address for signed messages.\nAn attacker could potentially exploit this to trick the user into\nbelieving a message had been sent from somebody they trusted.\n(CVE-2022-1834)\n\nIt was discovered that Thunderbird would consider an email with a\nmismatched OpenPGP signature date as valid. An attacker could potentially\nexploit this by replaying an older message in order to trick the user into\nbelieving that the statements in the message are current. (CVE-2022-2226)","dates":{"published":"2022-07-14T09:28:00.000Z","modified":"2026-04-22T10:25:10.210Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":null,"severity":"unknown","version":null,"versionLabel":null,"source":null,"vector":null,"computed":false,"selection":"none"},"metrics":[]},"epss":{"probability":null,"percentile":null,"severity":"unknown","asOf":null,"change":{"pp":null,"baselineDate":null,"baselineScore":null},"history":[],"last30":[]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[],"affected":[{"vendor":"ubuntu","product":"thunderbird","name":"thunderbird","label":"thunderbird","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/thunderbird","purlType":"deb","versions":[{"text":"< 1:91.11.0+build2-0ubuntu0.18.04.1","noFixRecorded":false,"fixedIn":null},{"text":"< 1:91.11.0+build2-0ubuntu0.20.04.1","noFixRecorded":false,"fixedIn":null},{"text":"< 1:91.11.0+build2-0ubuntu0.22.04.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1:91.11.0+build2-0ubuntu0.18.04.1 | < 1:91.11.0+build2-0ubuntu0.20.04.1 | < 1:91.11.0+build2-0ubuntu0.22.04.1","eol":null,"hubHref":null}],"affectedCount":1,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://ubuntu.com/security/notices/USN-5512-1","label":"ubuntu.com/security/notices/USN-5512-1","hostname":"ubuntu.com","tags":["Advisory"]},{"url":"https://ubuntu.com/security/CVE-2022-1834","label":"ubuntu.com/security/CVE-2022-1834","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2022-2200","label":"ubuntu.com/security/CVE-2022-2200","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2022-2226","label":"ubuntu.com/security/CVE-2022-2226","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2022-31736","label":"ubuntu.com/security/CVE-2022-31736","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2022-31737","label":"ubuntu.com/security/CVE-2022-31737","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2022-31738","label":"ubuntu.com/security/CVE-2022-31738","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2022-31740","label":"ubuntu.com/security/CVE-2022-31740","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2022-31741","label":"ubuntu.com/security/CVE-2022-31741","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2022-31742","label":"ubuntu.com/security/CVE-2022-31742","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2022-31744","label":"ubuntu.com/security/CVE-2022-31744","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2022-31747","label":"ubuntu.com/security/CVE-2022-31747","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2022-34468","label":"ubuntu.com/security/CVE-2022-34468","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2022-34470","label":"ubuntu.com/security/CVE-2022-34470","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2022-34472","label":"ubuntu.com/security/CVE-2022-34472","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2022-34479","label":"ubuntu.com/security/CVE-2022-34479","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2022-34481","label":"ubuntu.com/security/CVE-2022-34481","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2022-34484","label":"ubuntu.com/security/CVE-2022-34484","hostname":"ubuntu.com","tags":["REPORT"]}],"lineage":{"upstream":["CVE-2022-1834","CVE-2022-2200","CVE-2022-2226","CVE-2022-31736","CVE-2022-31737","CVE-2022-31738","CVE-2022-31740","CVE-2022-31741","CVE-2022-31742","CVE-2022-31744","CVE-2022-31747","CVE-2022-34468","CVE-2022-34470","CVE-2022-34472","CVE-2022-34479","CVE-2022-34481","CVE-2022-34484"],"downstream":[],"duplicates":[],"related":["CVE-2022-1834","CVE-2022-2200","CVE-2022-2226","CVE-2022-31736","CVE-2022-31737","CVE-2022-31738","CVE-2022-31740","CVE-2022-31741","CVE-2022-31742","CVE-2022-31744","CVE-2022-31747","CVE-2022-34468","CVE-2022-34470","CVE-2022-34472","CVE-2022-34479","CVE-2022-34481","CVE-2022-34484"]},"timeline":[{"kind":"published","date":"2022-07-14T09:28:00.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-04-22T10:25:10.210Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":0,"level":"minimal","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-20T08:14:35.307Z","stale":false,"partial":false}}