{"schemaVersion":3,"id":"USN-5724-1","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"thunderbird vulnerabilities\n\nMultiple security issues were discovered in Thunderbird. If a user were\ntricked into opening a specially crafted website in a browsing context, an\nattacker could potentially exploit these to cause a denial of service,\nbypass Content Security Policy (CSP) or other security restrictions, or\nexecute arbitrary code. These issues only affect Ubuntu 18.04 LTS, Ubuntu\n20.04 LTS and Ubuntu 22.04 LTS. (CVE-2022-3266, CVE-2022-40956,\nCVE-2022-40957, CVE-2022-40958, CVE-2022-40959, CVE-2022-40960,\nCVE-2022-40962)\n\nMultiple security issues were discovered in the Matrix SDK bundled with\nThunderbird. An attacker could potentially exploit these in order to\nimpersonate another user. These issues only affect Ubuntu 18.04 LTS,\nUbuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2022-39236, CVE-2022-39249,\nCVE-2022-39250, CVE-2022-39251)\n\nMultiple security issues were discovered in Thunderbird. If a user were\ntricked into opening a specially crafted website in a browsing context, an\nattacker could potentially exploit these to cause a denial of service,\nobtain sensitive information, or execute arbitrary code. (CVE-2022-42927,\nCVE-2022-42928, CVE-2022-42929, CVE-2022-42932)","dates":{"published":"2022-11-11T20:28:26.000Z","modified":"2026-04-27T16:32:21.916Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":null,"severity":"unknown","version":null,"versionLabel":null,"source":null,"vector":null,"computed":false,"selection":"none"},"metrics":[]},"epss":{"probability":null,"percentile":null,"severity":"unknown","asOf":null,"change":{"pp":null,"baselineDate":null,"baselineScore":null},"history":[],"last30":[]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[],"affected":[{"vendor":"ubuntu","product":"thunderbird","name":"thunderbird","label":"thunderbird","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/thunderbird","purlType":"deb","versions":[{"text":"< 1:102.4.2+build2-0ubuntu0.18.04.1","noFixRecorded":false,"fixedIn":null},{"text":"< 1:102.4.2+build2-0ubuntu0.20.04.1","noFixRecorded":false,"fixedIn":null},{"text":"< 1:102.4.2+build2-0ubuntu0.22.04.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1:102.4.2+build2-0ubuntu0.18.04.1 | < 1:102.4.2+build2-0ubuntu0.20.04.1 | < 1:102.4.2+build2-0ubuntu0.22.04.1","eol":null,"hubHref":null}],"affectedCount":1,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://ubuntu.com/security/notices/USN-5724-1","label":"ubuntu.com/security/notices/USN-5724-1","hostname":"ubuntu.com","tags":["Advisory"]},{"url":"https://ubuntu.com/security/CVE-2022-3266","label":"ubuntu.com/security/CVE-2022-3266","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2022-39236","label":"ubuntu.com/security/CVE-2022-39236","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2022-39249","label":"ubuntu.com/security/CVE-2022-39249","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2022-39250","label":"ubuntu.com/security/CVE-2022-39250","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2022-39251","label":"ubuntu.com/security/CVE-2022-39251","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2022-40956","label":"ubuntu.com/security/CVE-2022-40956","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2022-40957","label":"ubuntu.com/security/CVE-2022-40957","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2022-40958","label":"ubuntu.com/security/CVE-2022-40958","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2022-40959","label":"ubuntu.com/security/CVE-2022-40959","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2022-40960","label":"ubuntu.com/security/CVE-2022-40960","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2022-40962","label":"ubuntu.com/security/CVE-2022-40962","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2022-42927","label":"ubuntu.com/security/CVE-2022-42927","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2022-42928","label":"ubuntu.com/security/CVE-2022-42928","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2022-42929","label":"ubuntu.com/security/CVE-2022-42929","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2022-42932","label":"ubuntu.com/security/CVE-2022-42932","hostname":"ubuntu.com","tags":["REPORT"]}],"lineage":{"upstream":["CVE-2022-3266","CVE-2022-39236","CVE-2022-39249","CVE-2022-39250","CVE-2022-39251","CVE-2022-40956","CVE-2022-40957","CVE-2022-40958","CVE-2022-40959","CVE-2022-40960","CVE-2022-40962","CVE-2022-42927","CVE-2022-42928","CVE-2022-42929","CVE-2022-42932"],"downstream":[],"duplicates":[],"related":["CVE-2022-3266","CVE-2022-39236","CVE-2022-39249","CVE-2022-39250","CVE-2022-39251","CVE-2022-40956","CVE-2022-40957","CVE-2022-40958","CVE-2022-40959","CVE-2022-40960","CVE-2022-40962","CVE-2022-42927","CVE-2022-42928","CVE-2022-42929","CVE-2022-42932"]},"timeline":[{"kind":"published","date":"2022-11-11T20:28:26.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-04-27T16:32:21.916Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":0,"level":"minimal","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-20T12:00:03.440Z","stale":false,"partial":false}}