PT-2022-2526 · Mozilla+10 · Thunderbird+10
Andrew Mccreight
·
Published
2022-05-03
·
Updated
2024-06-15
·
CVE-2022-29913
CVSS v3.1
9.8
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Thunderbird versions prior to 91.9
Description
The issue is related to insufficient input validation in the SpeechSynthesis feature of the Thunderbird email client. Exploitation of this issue may allow a remote attacker to disclose protected information. The parent process does not properly check whether the Speech Synthesis feature is enabled when receiving instructions from a child process. This can be exploited to bypass the check for the Speech Synthesis feature.
Recommendations
For versions prior to 91.9, update to version 91.9 or later to resolve the issue. As a temporary workaround, consider disabling the Speech Synthesis feature until a patch is available. Restrict access to the Speech Synthesis functionality to minimize the risk of exploitation.
Exploit
Fix
Improper Authorization
RCE
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Almalinux
Astra Linux
Centos
Linuxmint
Red Hat
Red Os
Rocky Linux
Suse
Thunderbird
Ubuntu