QID 354131

a flaw was found in mozilla.
The mozilla foundation security advisory describes the issue of when receiving an html email that contained an iframe element, which used a srcdoc attribute to define the internal html document, remote objects specified in the nested document (for example, images or videos), were not blocked.
Rather, the network was accessed, and the objects were loaded and displayed. (
( CVE-2022-3032) a flaw was found in mozilla.
The mozilla foundation security advisory describes the issue of a thunderbird user replying to a crafted html email containing a meta tag, with the meta tag having the http-equiv=refresh attribute and the content attribute specifying an url.
Thunderbird started a network request to that url, regardless of the configuration, to block remote content.
In combination with certain other html elements and attributes in the email, it was possible to execute javascript code included in the message in the context of the message compose document.
The javascript code was able to perform actions including, but probably not limited to, reading and modifying the contents of the message compose document, including the quoted original message, which could potentially contain the decrypted plaintext of encrypted data in the crafted email.
The contents could then be transmitted to the network, either to the url specified in the meta refresh tag or to a different url, as the javascript code could modify the url specified in the document.
This bug doesnt affect users who have changed the default message body display setting to simple html or plain text. (
( CVE-2022-3033) a flaw was found in mozilla.
However, thunderbird didnt display the document. (

Note: The preceding description block is extracted directly from the security advisory. Using automation, we have attempted to clean and format it as much as possible without introducing additional issues.

Successful exploitation of this vulnerability could lead to a securitybreach or could affect integrity, availability, and confidentiality.