Mozilla Thunderbird and 1 other: Exposure of Sensitive Information to an Unauthorized Actor
CVE-2022-45414 is fixed in 7 products on 2 platforms, first by Mozilla Thunderbird (en-US) 102.6.0, released December 12, 2022. It is not reported as exploited. Patch Radar priority: High.
If a Thunderbird user quoted from an HTML email, for example by replying to the email, and the email contained either a VIDEO tag with the POSTER attribute or an OBJECT tag with a DATA attribute, a network request to the referenced remote URL was performed, regardless of a configuration to block remote content. An image loaded from the POSTER attribute was shown in the composer window. These issues could have given an attacker additional capabilities when targetting releases that did not yet have a fix for CVE-2022-3033 which was reported around three months ago. This vulnerability affects Thunderbird < 102.5.1.
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Windows apps | |||
| Mozilla Thunderbird (en-US) | 102.6.0 | Mozilla Thunderbird (en-US) 102.6.0 | Dec 12, 2022 |
| Linux | |||
| thunderbird · Debian 11.6 (bullseye) | 1:102.6.0-1~deb11u1 | DSA-5303-1 | Dec 16, 2022 |
| thunderbird · Debian 12.15 (bookworm) | 1:102.5.1-1 | DEBIAN-CVE-2022-45414 | Dec 22, 2022 |
| thunderbird · Debian 13.5 (trixie) | 1:102.5.1-1 | DEBIAN-CVE-2022-45414 | Dec 22, 2022 |
| thunderbird · Debian 14 | 1:102.5.1-1 | DEBIAN-CVE-2022-45414 | Dec 22, 2022 |
| thunderbird · RHEL 8 | 0:102.6.0-2.el8_7 | RHSA-2022:9074 | Dec 15, 2022 |
| thunderbird · RHEL 9 | 0:102.6.0-2.el9_1 | RHSA-2022:9080 | Dec 15, 2022 |
| thunderbird · Ubuntu 18.04.6 LTS (bionic) | 1:102.7.1+build2-0ubuntu0.18.04.1 | thunderbird 1:102.7.1+build2-0ubuntu0.18.04.1 | Jan 17, 2023 |
| thunderbird · Ubuntu 20.04 LTS (focal) | 1:102.7.1+build2-0ubuntu0.20.04.1 | thunderbird 1:102.7.1+build2-0ubuntu0.20.04.1 | Jan 17, 2023 |
| thunderbird · Ubuntu 22.04.1 LTS (jammy) | 1:102.7.1+build2-0ubuntu0.22.04.1 | thunderbird 1:102.7.1+build2-0ubuntu0.22.04.1 | Jan 17, 2023 |
| thunderbird · almalinux 8 | 102.6.0-2.el8_7.alma | ALSA-2022:9074 | Dec 15, 2022 |
| thunderbird · almalinux 9 | 102.6.0-2.el9_1.alma | ALSA-2022:9080 | Dec 15, 2022 |
| thunderbird · ol 8 | 0:102.6.0-2.0.1.el8_7 | ELSA-2022-9074-1 | Dec 16, 2022 |
| thunderbird · ol 9 | 0:102.6.0-2.0.1.el9_1 | ELSA-2022-9080-1 | Dec 16, 2022 |
| thunderbird-gnome-support · Ubuntu 18.04.6 LTS (bionic) | 1:102.7.1+build2-0ubuntu0.18.04.1 | thunderbird-gnome-support 1:102.7.1+build2-0ubuntu0.18.04.1 | Jan 17, 2023 |
| thunderbird-gnome-support · Ubuntu 20.04 LTS (focal) | 1:102.7.1+build2-0ubuntu0.20.04.1 | thunderbird-gnome-support 1:102.7.1+build2-0ubuntu0.20.04.1 | Jan 17, 2023 |
| thunderbird-gnome-support · Ubuntu 22.04.1 LTS (jammy) | 1:102.7.1+build2-0ubuntu0.22.04.1 | thunderbird-gnome-support 1:102.7.1+build2-0ubuntu0.22.04.1 | Jan 17, 2023 |
| thunderbird-mozsymbols · Ubuntu 18.04.6 LTS (bionic) | 1:102.7.1+build2-0ubuntu0.18.04.1 | thunderbird-mozsymbols 1:102.7.1+build2-0ubuntu0.18.04.1 | Jan 17, 2023 |
| thunderbird-mozsymbols · Ubuntu 20.04 LTS (focal) | 1:102.7.1+build2-0ubuntu0.20.04.1 | thunderbird-mozsymbols 1:102.7.1+build2-0ubuntu0.20.04.1 | Jan 17, 2023 |
| thunderbird-mozsymbols · Ubuntu 22.04.1 LTS (jammy) | 1:102.7.1+build2-0ubuntu0.22.04.1 | thunderbird-mozsymbols 1:102.7.1+build2-0ubuntu0.22.04.1 | Jan 17, 2023 |
| xul-ext-calendar-timezones · Ubuntu 18.04.6 LTS (bionic) | 1:102.7.1+build2-0ubuntu0.18.04.1 | xul-ext-calendar-timezones 1:102.7.1+build2-0ubuntu0.18.04.1 | Jan 17, 2023 |
| xul-ext-calendar-timezones · Ubuntu 20.04 LTS (focal) | 1:102.7.1+build2-0ubuntu0.20.04.1 | xul-ext-calendar-timezones 1:102.7.1+build2-0ubuntu0.20.04.1 | Jan 17, 2023 |
| xul-ext-calendar-timezones · Ubuntu 22.04.1 LTS (jammy) | 1:102.7.1+build2-0ubuntu0.22.04.1 | xul-ext-calendar-timezones 1:102.7.1+build2-0ubuntu0.22.04.1 | Jan 17, 2023 |
| xul-ext-gdata-provider · Ubuntu 18.04.6 LTS (bionic) | 1:102.7.1+build2-0ubuntu0.18.04.1 | xul-ext-gdata-provider 1:102.7.1+build2-0ubuntu0.18.04.1 | Jan 17, 2023 |
| xul-ext-gdata-provider · Ubuntu 20.04 LTS (focal) | 1:102.7.1+build2-0ubuntu0.20.04.1 | xul-ext-gdata-provider 1:102.7.1+build2-0ubuntu0.20.04.1 | Jan 17, 2023 |
| xul-ext-gdata-provider · Ubuntu 22.04.1 LTS (jammy) | 1:102.7.1+build2-0ubuntu0.22.04.1 | xul-ext-gdata-provider 1:102.7.1+build2-0ubuntu0.22.04.1 | Jan 17, 2023 |
| xul-ext-lightning · Ubuntu 18.04.6 LTS (bionic) | 1:102.7.1+build2-0ubuntu0.18.04.1 | xul-ext-lightning 1:102.7.1+build2-0ubuntu0.18.04.1 | Jan 17, 2023 |
| xul-ext-lightning · Ubuntu 20.04 LTS (focal) | 1:102.7.1+build2-0ubuntu0.20.04.1 | xul-ext-lightning 1:102.7.1+build2-0ubuntu0.20.04.1 | Jan 17, 2023 |
| xul-ext-lightning · Ubuntu 22.04.1 LTS (jammy) | 1:102.7.1+build2-0ubuntu0.22.04.1 | xul-ext-lightning 1:102.7.1+build2-0ubuntu0.22.04.1 | Jan 17, 2023 |
Patch Radar data is free to use with attribution. Terms and how to credit it.
Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.