CVE-2022-45414

NameCVE-2022-45414
DescriptionIf a Thunderbird user quoted from an HTML email, for example by replying to the email, and the email contained either a VIDEO tag with the POSTER attribute or an OBJECT tag with a DATA attribute, a network request to the referenced remote URL was performed, regardless of a configuration to block remote content. An image loaded from the POSTER attribute was shown in the composer window. These issues could have given an attacker additional capabilities when targetting releases that did not yet have a fix for CVE-2022-3033 which was reported around three months ago. This vulnerability affects Thunderbird < 102.5.1.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDSA-5303-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
thunderbird (PTS)buster1:91.12.0-1~deb10u1vulnerable
buster (security)1:115.8.0-1~deb10u1fixed
bullseye1:115.7.0-1~deb11u1fixed
bullseye (security)1:115.8.0-1~deb11u1fixed
bookworm1:115.7.0-1~deb12u1fixed
bookworm (security)1:115.8.0-1~deb12u1fixed
trixie1:115.7.0-1fixed
sid1:115.8.0-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
thunderbirdsourcebullseye1:102.6.0-1~deb11u1DSA-5303-1
thunderbirdsource(unstable)1:102.5.1-1

Notes

[bullseye] - thunderbird <postponed> (Minor issue, fix along in next ESR update)
[buster] - thunderbird <postponed> (Minor issue)
https://www.mozilla.org/en-US/security/advisories/mfsa2022-50/#CVE-2022-45414

Search for package or bug name: Reporting problems