diff --git a/D158770.diff b/D158770.diff
new file mode 100644
index 0000000000000000000000000000000000000000..1d769955ec3b2873ffe50c4efc2842f708ab7b11
--- /dev/null
+++ b/D158770.diff
@@ -0,0 +1,25 @@
+diff --git a/parser/expat/lib/xmlparse.c b/parser/expat/lib/xmlparse.c
+--- a/parser/expat/lib/xmlparse.c
++++ b/parser/expat/lib/xmlparse.c
+@@ -5652,12 +5652,18 @@
+   else
+ #endif /* XML_DTD */
+   {
+     processor = contentProcessor;
+     /* see externalEntityContentProcessor vs contentProcessor */
+-    return doContent(parser, parentParser ? 1 : 0, encoding, s, end,
+-                     nextPtr, (XML_Bool)!ps_finalBuffer);
++    result = doContent(parser, parser->m_parentParser ? 1 : 0,
++                       parser->m_encoding, s, end, nextPtr,
++                       (XML_Bool)! parser->m_parsingStatus.finalBuffer);
++    if (result == XML_ERROR_NONE) {
++      if (! storeRawNames(parser))
++        return XML_ERROR_NO_MEMORY;
++    }
++    return result;
+   }
+ }
+ 
+ static enum XML_Error PTRCALL
+ errorProcessor(XML_Parser parser,
+
diff --git a/download b/download
index 403cceba59cd3497bf0347fd9d291fc41737e32a..0023877d3698f55492af6fc93979cc86f84dab3f 100644
--- a/download
+++ b/download
@@ -1,5 +1,5 @@
 a9f32342fcac2b79f76860ee742d6ff1  cbindgen-vendor.tar.xz
-0e68157d26a74ca5e8852c94adb8ee29  thunderbird-102.3.0.processed-source.tar.xz
+8a20c9f97ecc00de5eb8a01456fb939a  thunderbird-102.3.0.processed-source.tar.xz
 60a6a764b4a1feaa4cd6f89f8d165166  thunderbird-langpacks-102.3.0-20220916.tar.xz
 75157f5e77e1a4f460645a57ff54e552  nspr-4.34.0-3.el8_1.src.rpm
 04f69b8baa7bd8ddc49d786b04307df8  nss-3.79.0-6.el8_1.src.rpm
diff --git a/thunderbird-anolis-default-prefs.js b/thunderbird-redhat-default-prefs.js
similarity index 96%
rename from thunderbird-anolis-default-prefs.js
rename to thunderbird-redhat-default-prefs.js
index 1d192b118c3400135cd8897caa6ecbc6cc25feba..4d01b7833b018d0bf5fe31dab6d5e578aadc53ec 100644
--- a/thunderbird-anolis-default-prefs.js
+++ b/thunderbird-redhat-default-prefs.js
@@ -2,7 +2,7 @@ pref("app.update.enabled", false);
 pref("app.update.autoInstallEnabled", false);
 /* Allow users to set custom colors*/
 /* pref("browser.display.use_system_colors",   true);*/
-pref("general.useragent.vendor", "Anolis");
+pref("general.useragent.vendor", "Red Hat");
 pref("general.useragent.vendorSub", "THUNDERBIRD_RPM_VR");
 pref("intl.locale.matchOS", true);
 pref("mail.shell.checkDefaultClient", false);
diff --git a/thunderbird.spec b/thunderbird.spec
index 2438335975614d4cff82b208d0a97568008412d4..2383bb9430ced42efa5c2adc46ffb733ecdd12a0 100644
--- a/thunderbird.spec
+++ b/thunderbird.spec
@@ -1,4 +1,3 @@
-%define anolis_release .0.1
 # Set for local builds only
 %global disable_toolsets  0
 
@@ -160,7 +159,7 @@ end}
 Summary:        Mozilla Thunderbird mail/newsgroup client
 Name:           thunderbird
 Version:        102.3.0
-Release:        3%{anolis_release}%{?dist}
+Release:        4%{?dist}
 URL:            http://www.mozilla.org/projects/thunderbird/
 License:        MPLv1.1 or GPLv2+ or LGPLv2+
 
@@ -175,7 +174,7 @@ ExcludeArch:    %{ix86}
   %endif
 %endif
 %if 0%{?rhel} == 7
-ExcludeArch:    s390 ppc
+ExcludeArch:    aarch64 s390 ppc
 %endif
 
 #Source0:        https://archive.mozilla.org/pub/thunderbird/releases/%{version}%{?pre_version}/source/thunderbird-%{version}%{?pre_version}.processed-source.tar.xz
@@ -186,7 +185,7 @@ Source1:        thunderbird-langpacks-%{version}-20220916.tar.xz
 Source2:        cbindgen-vendor.tar.xz
 Source3:        process-official-tarball
 Source10:       thunderbird-mozconfig
-Source12:       thunderbird-anolis-default-prefs.js
+Source12:       thunderbird-redhat-default-prefs.js
 Source20:       thunderbird.desktop
 Source21:       thunderbird.sh.in
 Source24:       mozilla-api-key
@@ -238,6 +237,7 @@ Patch421:        mozilla-s390-context.patch
 Patch422:        mozilla-s390x-skia-gradient.patch
 Patch423:        one_swizzle_to_rule_them_all.patch
 Patch424:        svg-rendering.patch
+Patch425:        D158770.diff
 
 # PGO/LTO patches
 Patch600:        pgo.patch
@@ -448,52 +448,76 @@ BuildRequires: gcc-toolset-12-annobin-plugin-gcc
 %endif
 %endif
 
+
 # Bundled libraries
 Provides: bundled(angle)
+Provides: bundled(audioipc-2)
+Provides: bundled(brotli)
+Provides: bundled(bzip2)
 Provides: bundled(cairo)
+Provides: bundled(cfworker)
+Provides: bundled(d3.js)
+Provides: bundled(double-conversion)
+Provides: bundled(expat)
+Provides: bundled(fdlibm)
+Provides: bundled(ffvpx)
+Provides: bundled(freetype2)
 Provides: bundled(graphite2)
 Provides: bundled(harfbuzz)
-Provides: bundled(ots)
-Provides: bundled(sfntly)
-Provides: bundled(skia)
-Provides: bundled(thebes)
-Provides: bundled(WebRender)
-Provides: bundled(audioipc-2)
-Provides: bundled(ffvpx)
+Provides: bundled(highway)
+Provides: bundled(intgemm)
+Provides: bundled(json-c)
 Provides: bundled(kissfft)
 Provides: bundled(libaom)
 Provides: bundled(libcubeb)
 Provides: bundled(libdav1d)
+Provides: bundled(libgcrypt)
+Provides: bundled(libgpg-error)
 Provides: bundled(libjpeg)
+Provides: bundled(libjxl)
+Provides: bundled(libjxl)
+Provides: bundled(libmar)
 Provides: bundled(libmkv)
 Provides: bundled(libnestegg)
 Provides: bundled(libogg)
 Provides: bundled(libopus)
+Provides: bundled(libotr)
 Provides: bundled(libpng)
+Provides: bundled(libprio)
 Provides: bundled(libsoundtouch)
 Provides: bundled(libspeex_resampler)
+Provides: bundled(libsrtp)
 Provides: bundled(libtheora)
 Provides: bundled(libtremor)
 Provides: bundled(libvorbis)
 Provides: bundled(libvpx)
 Provides: bundled(libwebp)
+Provides: bundled(libwebrtc)
 Provides: bundled(libyuv)
 Provides: bundled(mp4parse-rust)
+Provides: bundled(mp4parse-rust)
+Provides: bundled(msgpack-c)
+Provides: bundled(msgpack-c)
 Provides: bundled(mtransport)
+Provides: bundled(niwcompat)
 Provides: bundled(openmax_dl)
-Provides: bundled(double-conversion)
-Provides: bundled(brotli)
-Provides: bundled(fdlibm)
-Provides: bundled(freetype2)
-Provides: bundled(libmar)
+Provides: bundled(openmax_il)
+Provides: bundled(openmax_il)
+Provides: bundled(ots)
+Provides: bundled(qcms)
+Provides: bundled(rlbox_sandboxing_api)
+Provides: bundled(rnp)
+Provides: bundled(sfntly)
+Provides: bundled(sipcc)
+Provides: bundled(skia)
+Provides: bundled(sqlite3)
+Provides: bundled(thebes)
+Provides: bundled(wasm2c)
+Provides: bundled(WebRender)
 Provides: bundled(woff2)
 Provides: bundled(xz-embedded)
+Provides: bundled(ycbcr)
 Provides: bundled(zlib)
-Provides: bundled(expat)
-Provides: bundled(msgpack-c)
-Provides: bundled(libprio)
-Provides: bundled(rlbox_sandboxing_api)
-Provides: bundled(sqlite3)
 
 %if 0%{?bundle_nss}
 Provides: bundled(nss) = 3.79.0
@@ -578,6 +602,7 @@ echo "use_rustts            %{?use_rustts}"
 %patch422 -p1 -b .mozilla-s390x-skia-gradient
 %patch423 -p1 -b .one_swizzle_to_rule_them_all
 %patch424 -p1 -b .svg-rendering
+%patch425 -p1 -b .D158770.diff
 
 # PGO patches
 %if %{build_with_pgo}
@@ -1199,9 +1224,8 @@ gtk-update-icon-cache %{_datadir}/icons/hicolor &>/dev/null || :
 #===============================================================================
 
 %changelog
-* Tue Oct 18 2022 Liwei Ge <geliwei@openanolis.org> - 102.3.0-3.0.1
-- Rebrand to Anolis 
-- Cherry-pick [f298858] 
+* Wed Oct 12 2022 Jan Horak <jhorak@redhat.com> - 102.3.0-4
+- Fix for expat CVE-2022-40674
 
 * Fri Sep 16 2022 Jan Horak <jhorak@redhat.com> - 102.3.0-3
 - Update to 102.3.0 build1