CVE-2022-1520
Publication date 7 May 2022
Last updated 25 August 2025
Ubuntu priority
Description
When viewing an email message A, which contains an attached message B, where B is encrypted or digitally signed or both, Thunderbird may show an incorrect encryption or signature status. After opening and viewing the attached message B, when returning to the display of message A, the message A might be shown with the security status of message B. This vulnerability affects Thunderbird < 91.9.
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| thunderbird | ||
| 22.04 LTS jammy |
Fixed 1:91.9.1+build1-0ubuntu0.22.04.1
|
|
| 20.04 LTS focal |
Fixed 1:91.9.1+build1-0ubuntu0.20.04.1
|
|
| 18.04 LTS bionic |
Fixed 1:91.9.1+build1-0ubuntu0.18.04.1
|
Severity score breakdown
CVSS version: CVSS v3.0
Base score
4.3 · Medium
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
References
Related Ubuntu Security Notices (USN)
- USN-5435-1
- Thunderbird vulnerabilities
- 25 May 2022