=====================================================================

                               CERT-Renater

                   Note d'Information No. 2023/VULN020

_____________________________________________________________________

DATE                : 24/01/2023

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running Thunderbird versions prior to
                                           102.7.

=====================================================================
https://www.mozilla.org/en-US/security/advisories/mfsa2023-03/
_____________________________________________________________________


Mozilla Foundation Security Advisory 2023-03
Security Vulnerabilities fixed in Thunderbird 102.7

Announced        January 18, 2023
Impact           high
Products         Thunderbird
Fixed in
         Thunderbird 102.7

In general, these flaws cannot be exploited through email in the
Thunderbird product because scripting is disabled when reading mail,
but are potentially risks in browser or browser-like contexts.
#CVE-2022-46871: libusrsctp library out of date

Reporter        Mozilla Developers
Impact          high

Description

An out of date library (libusrsctp) contained vulnerabilities that
could potentially be exploited.

References

     Bug 1795697


#CVE-2023-23598: Arbitrary file read from GTK drag and drop on
Linux

Reporter        Tom Schuster
Impact          high

Description

Due to the Thunderbird GTK wrapper code's use of text/plain for
drag data and GTK treating all text/plain MIMEs containing file
URLs as being dragged a website could arbitrarily read a file via
a call to DataTransfer.setData.

References

     Bug 1800425


#CVE-2023-23599: Malicious command could be hidden in devtools
output on Windows

Reporter        Vadim
Impact          moderate

Description

When copying a network request from the developer tools panel as
a curl command the output was not being properly sanitized and
could allow arbitrary commands to be hidden within.

References

     Bug 1777800


#CVE-2023-23601: URL being dragged from cross-origin iframe into
same tab triggers navigation

Reporter        Luan Herrera
Impact          moderate

Description

Navigations were being allowed when dragging a URL from a
cross-origin iframe into the same tab which could lead to
website spoofing attacks
References

     Bug 1794268


#CVE-2023-23602: Content Security Policy wasn't being correctly
applied to WebSockets in WebWorkers

Reporter        Dave Vandyke
Impact          moderate

Description

A mishandled security check when creating a WebSocket in a
WebWorker caused the Content Security Policy connect-src header
to be ignored. This could lead to connections to restricted
origins from inside WebWorkers.

References

     Bug 1800890


#CVE-2022-46877: Fullscreen notification bypass

Reporter        Hafiizh
Impact          low

Description

By confusing the browser, the fullscreen notification could have
been delayed or suppressed, resulting in potential user confusion
or spoofing attacks.

References

     Bug 1795139


#CVE-2023-23603: Calls to <code>console.log</code> allowed bypasing
Content Security Policy via format directive

Reporter        Dan Veditz
Impact          low

Description

Regular expressions used to filter out forbidden properties and
values from style directives in calls to console.log weren't accounting
for external URLs. Data could then be potentially exfiltrated from
the browser.

References

     Bug 1800832


#CVE-2023-23605: Memory safety bugs fixed in Thunderbird 102.7

Reporter        Mozilla developers and community
Impact          high

Description

Mozilla developers and the Mozilla Fuzzing Team reported memory safety
bugs present in Thunderbird 102.6. Some of these bugs showed evidence
of memory corruption and we presume that with enough effort some of
these could have been exploited to run arbitrary code.

References

     Memory safety bugs fixed in Thunderbird 102.7



=========================================================
+ CERT-RENATER        |    tel : 01-53-94-20-44         +
+ 23/25 Rue Daviel    |    fax : 01-53-94-20-41         +
+ 75013 Paris         |   email:cert@support.renater.fr +
=========================================================