CVE-2022-45414
Summary
| CVE | CVE-2022-45414 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2022-12-22 20:15:00 UTC |
| Updated | 2023-08-08 14:22:00 UTC |
| Description | If a Thunderbird user quoted from an HTML email, for example by replying to the email, and the email contained either a VIDEO tag with the POSTER attribute or an OBJECT tag with a DATA attribute, a network request to the referenced remote URL was performed, regardless of a configuration to block remote content. An image loaded from the POSTER attribute was shown in the composer window. These issues could have given an attacker additional capabilities when targetting releases that did not yet have a fix for CVE-2022-3033 which was reported around three months ago. This vulnerability affects Thunderbird < 102.5.1. |
Risk And Classification
Problem Types: NVD-CWE-Other
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Mozilla | Thunderbird | All | All | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Security Vulnerabilities fixed in Thunderbird 102.5.1 — Mozilla | MISC | www.mozilla.org | |
| Access Denied | MISC | bugzilla.mozilla.org | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 160357 Oracle Enterprise Linux Security Update for thunderbird (ELSA-2022-9079-1)
- 160359 Oracle Enterprise Linux Security Update for thunderbird (ELSA-2022-9080-1)
- 160362 Oracle Enterprise Linux Security Update for thunderbird (ELSA-2022-9074-1)
- 181335 Debian Security Update for thunderbird (CVE-2022-45414)
- 181336 Debian Security Update for thunderbird (DSA 5303-1)
- 199147 Ubuntu Security Notification for Thunderbird Vulnerabilities (USN-5824-1)
- 241014 Red Hat Update for thunderbird (RHSA-2022:9075)
- 241016 Red Hat Update for thunderbird (RHSA-2022:9081)
- 241018 Red Hat Update for thunderbird (RHSA-2022:9080)
- 241021 Red Hat Update for thunderbird (RHSA-2022:9079)
- 241025 Red Hat Update for thunderbird (RHSA-2022:9078)
- 241028 Red Hat Update for thunderbird (RHSA-2022:9074)
- 354760 Amazon Linux Security Advisory for thunderbird : ALAS2-2023-1951
- 377803 Mozilla Thunderbird Multiple Vulnerabilities (MFSA2022-50)
- 752974 SUSE Enterprise Linux Security Update for MozillaThunderbird (SUSE-SU-2022:4334-1)
- 940860 AlmaLinux Security Update for thunderbird (ALSA-2022:9074)
- 940863 AlmaLinux Security Update for thunderbird (ALSA-2022:9080)