## mfsa2022-46.yml
announced: October 18, 2022
impact: high
fixed_in:
- Thunderbird 102.4
title: Security Vulnerabilities fixed in Thunderbird 102.4
description: |
   *In general, these flaws cannot be exploited through email in the Thunderbird product because scripting is disabled when reading mail, but are potentially risks in browser or browser-like contexts.*
advisories:
  CVE-2022-42927:
    title: Same-origin policy violation could have leaked cross-origin URLs
    impact: high
    reporter: James Lee
    description: |
      A same-origin policy violation could have allowed the theft of cross-origin URL entries, leaking the result of a redirect, via <code>performance.getEntries()</code>.
    bugs:
      - url: 1789128
  CVE-2022-42928:
    title: Memory Corruption in JS Engine
    impact: high
    reporter: Samuel Groß
    description: |
      Certain types of allocations were missing annotations that, if the Garbage Collector was in a specific state, could have lead to memory corruption and a potentially exploitable crash.
    bugs:
      - url: 1791520
  CVE-2022-42929:
    title: Denial of Service via window.print
    impact: moderate
    reporter: Andrei Enache
    description: |
      If a website called <code>window.print()</code> in a particular way, it could cause a denial of service of the browser, which may persist beyond browser restart depending on the user's session restore settings.
    bugs:
      - url: 1789439
  CVE-2022-42932:
    title: Memory safety bugs fixed in Thunderbird 102.4
    impact: moderate
    reporter: Mozilla developers and community
    description: |
      Mozilla developers Ashley Hale and the Mozilla Fuzzing Team reported memory safety bugs present in Thunderbird 102.3. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.
    bugs:
      - url: 1789729, 1791363, 1792041
        desc: Memory safety bugs fixed in Thunderbird 102.4

Add advisories for Thunderbird 102.4
Add advisories for Thunderbird 102.4
