CVE-2022-1520

CVE Details

Release Date:	2022-12-22
Impact:	None	What is this?

Description

When viewing an email message A, which contains an attached message B, where B is encrypted or digitally signed or both, Thunderbird may show an incorrect encryption or signature status. After opening and viewing the attached message B, when returning to the display of message A, the message A might be shown with the security status of message B. This vulnerability affects Thunderbird < 91.9.

See more information about CVE-2022-1520 from MITRE CVE dictionary and NIST NVD

NOTE: The following CVSS metrics and score provided are preliminary and subject to review.

CVSS v3 metrics

Base Score:	4.3
Vector String:	CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Version:	3.0
Attack Vector:	Network
Attack Complexity:	Low
Privileges Required:	None
User Interaction:	Required
Scope:	Unchanged
Confidentiality Impact:	None
Integrity Impact:	Low
Availability Impact:	None

Errata information

Platform	Errata	Release Date
Oracle Linux version 7 (thunderbird)	ELSA-2022-1725	2022-05-05
Oracle Linux version 8 (thunderbird)	ELSA-2022-1730	2022-05-05
Oracle Linux version 9 (thunderbird)	ELSA-2022-4589	2022-06-30