CVE-2022-1834
published 2022-12-22CVE-2022-1834: When displaying the sender of an email, and the sender name contained the Braille Pattern Blank space character multiple times, Thunderbird would have…
PriorityP432medium6.5CVSS 3.1
AVNACLPRNUIRSUCHINAN
EPSS
0.38%
30.7th percentile
When displaying the sender of an email, and the sender name contained the Braille Pattern Blank space character multiple times, Thunderbird would have displayed all the spaces. This could have been used by an attacker to send an email message with the attacker's digital signature, that was shown with an arbitrary sender email address chosen by the attacker. If the sender name started with a false email address, followed by many Braille space characters, the attacker's email address was not visible. Because Thunderbird compared the invisible sender address with the signature's email address, if the signing key or certificate was accepted by Thunderbird, the email was shown as having a valid digital signature. This vulnerability affects Thunderbird < 91.10.
Affected
11 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | thunderbird | < thunderbird 1:91.10.0-1 (bookworm) | thunderbird 1:91.10.0-1 (bookworm) |
| mozilla | firefox | — | — |
| mozilla | thunderbird | < 91.10 | 91.10 |
| mozilla | thunderbird | >= 0 < 1:91.10.0-1~deb11u1 | 1:91.10.0-1~deb11u1 |
| mozilla | thunderbird | >= 0 < 1:91.10.0-1 | 1:91.10.0-1 |
| mozilla | thunderbird | >= 0 < 1:91.10.0-1 | 1:91.10.0-1 |
| mozilla | thunderbird | >= 0 < 1:91.10.0-1 | 1:91.10.0-1 |
| mozilla | thunderbird | >= 0 < 1:91.11.0+build2-0ubuntu0.18.04.1 | 1:91.11.0+build2-0ubuntu0.18.04.1 |
| mozilla | thunderbird | >= 0 < 1:91.11.0+build2-0ubuntu0.20.04.1 | 1:91.11.0+build2-0ubuntu0.20.04.1 |
| mozilla | thunderbird | >= 0 < 1:91.11.0+build2-0ubuntu0.22.04.1 | 1:91.11.0+build2-0ubuntu0.22.04.1 |
| mozilla | thunderbird | >= unspecified < 91.10 | 91.10 |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
osv6.5MEDIUM
vendor_debian6.5MEDIUM
vendor_redhat6.5MEDIUM
vendor_ubuntu6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
kernel: mmc: vub300: fix warning - do not call blocking ops when !TASK_RUNNING
vendor_redhat·2025-10-01·CVSS 5.5
CVE-2022-50430 [MEDIUM] CWE-820 kernel: mmc: vub300: fix warning - do not call blocking ops when !TASK_RUNNING
kernel: mmc: vub300: fix warning - do not call blocking ops when !TASK_RUNNING
In the Linux kernel, the following vulnerability has been resolved:
mmc: vub300: fix warning - do not call blocking ops when !TASK_RUNNING
vub300_enable_sdio_irq() works with mutex and need TASK_RUNNING here.
Ensure that we mark current as TASK_RUNNING for sleepable context.
[ 77.554641] do not call blocking ops when !TASK_RUNNING; state=1 set at [] sdio_irq_thread+0x17d/0x5b0
[ 77.554652] WARNING: CPU: 2 PID: 1983 at kernel/sched/core.c:9813 __might_sleep+0x116/0x160
[ 77.554905] CPU: 2 PID: 1983 Comm: ksdioirqd/mmc1 Tainted: G OE 6.1.0-rc5 #1
[ 77.554910] Hardware name: Intel(R) Client Systems NUC8i7BEH/NUC8BEB, BIOS BECFL357.86A.0081.2020.0504.1834 05/04/2020
[ 77.554912] RIP: 0010:__might_sleep+0x116/0x160
Ubuntu
Thunderbird vulnerabilities
vendor_ubuntu·2022-07-14·CVSS 6.5
CVE-2022-34468 [MEDIUM] Thunderbird vulnerabilities
Title: Thunderbird vulnerabilities
Summary: Several security issues were fixed in Thunderbird.
Multiple security issues were discovered in Thunderbird. If a user were
tricked into opening a specially crafted website in a browsing context, an
attacker could potentially exploit these to cause a denial of service,
obtain sensitive information, spoof the UI, bypass CSP restrictions, or
execute arbitrary code. (CVE-2022-2200, CVE-2022-31736, CVE-2022-31737,
CVE-2022-31738, CVE-2022-31740, CVE-2022-31741, CVE-2022-31742,
CVE-2022-31744, CVE-2022-31747, CVE-2022-34468, CVE-2022-34470,
CVE-2022-34479, CVE-2022-34481, CVE-2022-34484)
It was discovered that an unavailable PAC file caused OCSP requests to
be blocked, resulting in incorrect error pages being displayed.
(CVE-2022-34472)
It was disc
Red Hat
Mozilla: Braille space character caused incorrect sender email to be shown for a digitally signed email
vendor_redhat·2022-05-31·CVSS 6.5
CVE-2022-1834 [MEDIUM] CWE-349 Mozilla: Braille space character caused incorrect sender email to be shown for a digitally signed email
Mozilla: Braille space character caused incorrect sender email to be shown for a digitally signed email
When displaying the sender of an email, and the sender name contained the Braille Pattern Blank space character multiple times, Thunderbird would have displayed all the spaces. This could have been used by an attacker to send an email message with the attacker's digital signature, that was shown with an arbitrary sender email address chosen by the attacker. If the sender name started with a false email address, followed by many Braille space characters, the attacker's email address was not visible. Because Thunderbird compared the invisible sender address with the signature's email address, if the signing key or certificate was accepted by Thunderbird, the email was shown as having a va
Debian
CVE-2022-1834: thunderbird - When displaying the sender of an email, and the sender name contained the Braill...
vendor_debian·2022·CVSS 6.5
CVE-2022-1834 [MEDIUM] CVE-2022-1834: thunderbird - When displaying the sender of an email, and the sender name contained the Braill...
When displaying the sender of an email, and the sender name contained the Braille Pattern Blank space character multiple times, Thunderbird would have displayed all the spaces. This could have been used by an attacker to send an email message with the attacker's digital signature, that was shown with an arbitrary sender email address chosen by the attacker. If the sender name started with a false email address, followed by many Braille space characters, the attacker's email address was not visible. Because Thunderbird compared the invisible sender address with the signature's email address, if the signing key or certificate was accepted by Thunderbird, the email was shown as having a valid digital signature. This vulnerability affects Thunderbird < 91.10.
Scope: local
bookworm: resolved (f
Mozilla
Mozilla Foundation Security Advisory 2022-22: CVE-2022-1834
vendor_mozilla·CVSS 6.5
CVE-2022-1834 [MEDIUM] Mozilla Foundation Security Advisory 2022-22: CVE-2022-1834
Mozilla Foundation Security Advisory 2022-22
CVE: CVE-2022-1834
Product: Thunderbird
Impact: high
Fixed in: Thunderbird 91.10
GHSA
GHSA-qq6h-hx9q-4fxv: When displaying the sender of an email, and the sender name contained the Braille Pattern Blank space character multiple times, Thunderbird would have
ghsa_unreviewed·2022-12-22
CVE-2022-1834 [MEDIUM] CWE-295 GHSA-qq6h-hx9q-4fxv: When displaying the sender of an email, and the sender name contained the Braille Pattern Blank space character multiple times, Thunderbird would have
When displaying the sender of an email, and the sender name contained the Braille Pattern Blank space character multiple times, Thunderbird would have displayed all the spaces. This could have been used by an attacker to send an email message with the attacker's digital signature, that was shown with an arbitrary sender email address chosen by the attacker. If the sender name started with a false email address, followed by many Braille space characters, the attacker's email address was not visible. Because Thunderbird compared the invisible sender address with the signature's email address, if the signing key or certificate was accepted by Thunderbird, the email was shown as having a valid digital signature. This vulnerability affects Thunderbird < 91.10.
OSV
CVE-2022-1834: When displaying the sender of an email, and the sender name contained the Braille Pattern Blank space character multiple times, Thunderbird would have
osv·2022-12-22·CVSS 6.5
CVE-2022-1834 [MEDIUM] CVE-2022-1834: When displaying the sender of an email, and the sender name contained the Braille Pattern Blank space character multiple times, Thunderbird would have
When displaying the sender of an email, and the sender name contained the Braille Pattern Blank space character multiple times, Thunderbird would have displayed all the spaces. This could have been used by an attacker to send an email message with the attacker's digital signature, that was shown with an arbitrary sender email address chosen by the attacker. If the sender name started with a false email address, followed by many Braille space characters, the attacker's email address was not visible. Because Thunderbird compared the invisible sender address with the signature's email address, if the signing key or certificate was accepted by Thunderbird, the email was shown as having a valid digital signature. This vulnerability affects Thunderbird < 91.10.
OSV
thunderbird vulnerabilities
osv·2022-07-14·CVSS 6.5
CVE-2022-2200 [MEDIUM] thunderbird vulnerabilities
thunderbird vulnerabilities
Multiple security issues were discovered in Thunderbird. If a user were
tricked into opening a specially crafted website in a browsing context, an
attacker could potentially exploit these to cause a denial of service,
obtain sensitive information, spoof the UI, bypass CSP restrictions, or
execute arbitrary code. (CVE-2022-2200, CVE-2022-31736, CVE-2022-31737,
CVE-2022-31738, CVE-2022-31740, CVE-2022-31741, CVE-2022-31742,
CVE-2022-31744, CVE-2022-31747, CVE-2022-34468, CVE-2022-34470,
CVE-2022-34479, CVE-2022-34481, CVE-2022-34484)
It was discovered that an unavailable PAC file caused OCSP requests to
be blocked, resulting in incorrect error pages being displayed.
(CVE-2022-34472)
It was discovered that the Braille space character could be used to
cause Thund
No detection rules found.
No public exploits indexed.
2022-12-22
Published