CVE-2022-3033
published 2022-12-22CVE-2022-3033: If a Thunderbird user replied to a crafted HTML email containing a meta tag, with the meta tag having the http-equiv="refresh" attribute, and the content…
PriorityP339high8.1CVSS 3.1
AVNACLPRNUIRSUCHIHAN
EPSS
0.77%
51.4th percentile
If a Thunderbird user replied to a crafted HTML email containing a meta tag, with the meta tag having the http-equiv="refresh" attribute, and the content attribute specifying an URL, then Thunderbird started a network request to that URL, regardless of the configuration to block remote content. In combination with certain other HTML elements and attributes in the email, it was possible to execute JavaScript code included in the message in the context of the message compose document. The JavaScript code was able to perform actions including, but probably not limited to, read and modify the contents of the message compose document, including the quoted original message, which could potentially contain the decrypted plaintext of encrypted data in the crafted email. The contents could then be transmitted to the network, either to the URL specified in the META refresh tag, or to a different URL, as the JavaScript code could modify the URL specified in the document. This bug doesn't affect users who have changed the default Message Body display setting to 'simple html' or 'plain text'. This vulnerability affects Thunderbird < 102.2.1 and Thunderbird < 91.13.1.
Affected
17 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | thunderbird | < thunderbird 1:102.2.1-1 (bookworm) | thunderbird 1:102.2.1-1 (bookworm) |
| debian | thunderbird | < thunderbird 1:102.5.1-1 (bookworm) | thunderbird 1:102.5.1-1 (bookworm) |
| mozilla | firefox | — | — |
| mozilla | thunderbird | < 102.5.1 | 102.5.1 |
| mozilla | thunderbird | < 91.13.1 | 91.13.1 |
| mozilla | thunderbird | >= 0 < 1:102.6.0-1~deb11u1 | 1:102.6.0-1~deb11u1 |
| mozilla | thunderbird | >= 0 < 1:102.2.1-1 | 1:102.2.1-1 |
| mozilla | thunderbird | >= 0 < 1:102.5.1-1 | 1:102.5.1-1 |
| mozilla | thunderbird | >= 0 < 1:102.2.1-1 | 1:102.2.1-1 |
| mozilla | thunderbird | >= 0 < 1:102.5.1-1 | 1:102.5.1-1 |
| mozilla | thunderbird | >= 0 < 1:102.2.1-1 | 1:102.2.1-1 |
| mozilla | thunderbird | >= 0 < 1:102.5.1-1 | 1:102.5.1-1 |
| mozilla | thunderbird | >= 0 < 1:102.2.2+build1-0ubuntu0.18.04.1 | 1:102.2.2+build1-0ubuntu0.18.04.1 |
| mozilla | thunderbird | >= 0 < 1:102.2.2+build1-0ubuntu0.20.04.1 | 1:102.2.2+build1-0ubuntu0.20.04.1 |
| mozilla | thunderbird | >= 0 < 1:102.2.2+build1-0ubuntu0.22.04.1 | 1:102.2.2+build1-0ubuntu0.22.04.1 |
| mozilla | thunderbird | >= 102.0 < 102.2.1 | 102.2.1 |
| mozilla | thunderbird | >= unspecified < 102.5.1 | 102.5.1 |
CVSS provenance
nvdv3.18.1HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
osv8.8HIGH
vendor_ubuntu8.8HIGH
vendor_debian8.1HIGH
vendor_redhat8.1HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
Mozilla: Quoting from an HTML email with certain tags will trigger network requests and load remote content, regardless of a configuration to block remote content
vendor_redhat·2022-11-30·CVSS 8.1
CVE-2022-45414 [HIGH] CWE-200 Mozilla: Quoting from an HTML email with certain tags will trigger network requests and load remote content, regardless of a configuration to block remote content
Mozilla: Quoting from an HTML email with certain tags will trigger network requests and load remote content, regardless of a configuration to block remote content
If a Thunderbird user quoted from an HTML email, for example by replying to the email, and the email contained either a VIDEO tag with the POSTER attribute or an OBJECT tag with a DATA attribute, a network request to the referenced remote URL was performed, regardless of a configuration to block remote content. An image loaded from the POSTER attribute was shown in the composer window. These issues could have given an attacker additional capabilities when targetting releases that did not yet have a fix for CVE-2022-3033 which was reported around three months ago. This vulnerability affects Thunderbird < 102.5.1.
The Mozilla Fou
Ubuntu
Thunderbird vulnerabilities
vendor_ubuntu·2022-10-07·CVSS 8.8
CVE-2022-36059 [HIGH] Thunderbird vulnerabilities
Title: Thunderbird vulnerabilities
Summary: Several security issues were fixed in Thunderbird.
Multiple security issues were discovered in Thunderbird. If a user were
tricked into opening a specially crafted website in a browsing context, an
attacker could potentially exploit these to cause a denial of service,
spoof the mouse pointer position, obtain sensitive information, spoof the
contents of the addressbar, bypass security restrictions, or execute
arbitrary code. (CVE-2022-2505, CVE-2022-36318, CVE-2022-36319,
CVE-2022-38472, CVE-2022-38473, CVE-2022-38476 CVE-2022-38477,
CVE-2022-38478)
Multiple security issues were discovered in Thunderbird. An attacker could
potentially exploit these in order to determine when a user opens a
specially crafted message. (CVE-2022-3032, CVE-2022-303
Red Hat
Mozilla: Leaking of sensitive information when composing a response to an HTML email with a META refresh tag
vendor_redhat·2022-08-31·CVSS 8.1
CVE-2022-3033 [HIGH] CWE-200 Mozilla: Leaking of sensitive information when composing a response to an HTML email with a META refresh tag
Mozilla: Leaking of sensitive information when composing a response to an HTML email with a META refresh tag
If a Thunderbird user replied to a crafted HTML email containing a meta tag, with the meta tag having the http-equiv="refresh" attribute, and the content attribute specifying an URL, then Thunderbird started a network request to that URL, regardless of the configuration to block remote content. In combination with certain other HTML elements and attributes in the email, it was possible to execute JavaScript code included in the message in the context of the message compose document. The JavaScript code was able to perform actions including, but probably not limited to, read and modify the contents of the message compose document, including the quoted original message, which could p
Debian
CVE-2022-3033: thunderbird - If a Thunderbird user replied to a crafted HTML email containing a <code>meta</c...
vendor_debian·2022·CVSS 8.1
CVE-2022-3033 [HIGH] CVE-2022-3033: thunderbird - If a Thunderbird user replied to a crafted HTML email containing a <code>meta</c...
If a Thunderbird user replied to a crafted HTML email containing a meta tag, with the meta tag having the http-equiv="refresh" attribute, and the content attribute specifying an URL, then Thunderbird started a network request to that URL, regardless of the configuration to block remote content. In combination with certain other HTML elements and attributes in the email, it was possible to execute JavaScript code included in the message in the context of the message compose document. The JavaScript code was able to perform actions including, but probably not limited to, read and modify the contents of the message compose document, including the quoted original message, which could potentially contain the decrypted plaintext of encrypted data in the crafted email. The contents could then be
Debian
CVE-2022-45414: thunderbird - If a Thunderbird user quoted from an HTML email, for example by replying to the ...
vendor_debian·2022·CVSS 8.1
CVE-2022-45414 [HIGH] CVE-2022-45414: thunderbird - If a Thunderbird user quoted from an HTML email, for example by replying to the ...
If a Thunderbird user quoted from an HTML email, for example by replying to the email, and the email contained either a VIDEO tag with the POSTER attribute or an OBJECT tag with a DATA attribute, a network request to the referenced remote URL was performed, regardless of a configuration to block remote content. An image loaded from the POSTER attribute was shown in the composer window. These issues could have given an attacker additional capabilities when targetting releases that did not yet have a fix for CVE-2022-3033 which was reported around three months ago. This vulnerability affects Thunderbird < 102.5.1.
Scope: local
bookworm: resolved (fixed in 1:102.5.1-1)
bullseye: resolved (fixed in 1:102.6.0-1~deb11u1)
forky: resolved (fixed in 1:102.5.1-1)
sid: resolved (fixed in 1:102.5.1-1)
Mozilla
Mozilla Foundation Security Advisory 2022-50: CVE-2022-3033
vendor_mozilla·CVSS 8.1
CVE-2022-3033 [HIGH] Mozilla Foundation Security Advisory 2022-50: CVE-2022-3033
Mozilla Foundation Security Advisory 2022-50
CVE: CVE-2022-3033
Product: Thunderbird
Impact: moderate
Fixed in: Thunderbird 102.5.1
Mozilla
Mozilla Foundation Security Advisory 2022-39: CVE-2022-3033
vendor_mozilla·CVSS 8.1
CVE-2022-3033 [HIGH] Mozilla Foundation Security Advisory 2022-39: CVE-2022-3033
Mozilla Foundation Security Advisory 2022-39
CVE: CVE-2022-3033
Product: Thunderbird
Impact: moderate
Fixed in: Thunderbird 91.13.1
Mozilla
Mozilla Foundation Security Advisory 2022-38: CVE-2022-3033
vendor_mozilla·CVSS 8.1
CVE-2022-3033 [HIGH] Mozilla Foundation Security Advisory 2022-38: CVE-2022-3033
Mozilla Foundation Security Advisory 2022-38
CVE: CVE-2022-3033
Product: Thunderbird
Impact: moderate
Fixed in: Thunderbird 102.2.1
OSV
CVE-2022-3033: If a Thunderbird user replied to a crafted HTML email containing a meta tag, with the meta tag having the http-equiv="refresh" attribute, and the cont
osv·2022-12-22·CVSS 8.1
CVE-2022-3033 [HIGH] CVE-2022-3033: If a Thunderbird user replied to a crafted HTML email containing a meta tag, with the meta tag having the http-equiv="refresh" attribute, and the cont
If a Thunderbird user replied to a crafted HTML email containing a meta tag, with the meta tag having the http-equiv="refresh" attribute, and the content attribute specifying an URL, then Thunderbird started a network request to that URL, regardless of the configuration to block remote content. In combination with certain other HTML elements and attributes in the email, it was possible to execute JavaScript code included in the message in the context of the message compose document. The JavaScript code was able to perform actions including, but probably not limited to, read and modify the contents of the message compose document, including the quoted original message, which could potentially contain the decrypted plaintext of encrypted data in the crafted email. The contents could then be
GHSA
GHSA-gvhr-fq94-q7h9: If a Thunderbird user quoted from an HTML email, for example by replying to the email, and the email contained either a VIDEO tag with the POSTER attr
ghsa_unreviewed·2022-12-22·CVSS 8.1
CVE-2022-45414 [HIGH] CWE-200 GHSA-gvhr-fq94-q7h9: If a Thunderbird user quoted from an HTML email, for example by replying to the email, and the email contained either a VIDEO tag with the POSTER attr
If a Thunderbird user quoted from an HTML email, for example by replying to the email, and the email contained either a VIDEO tag with the POSTER attribute or an OBJECT tag with a DATA attribute, a network request to the referenced remote URL was performed, regardless of a configuration to block remote content. An image loaded from the POSTER attribute was shown in the composer window. These issues could have given an attacker additional capabilities when targetting releases that did not yet have a fix for CVE-2022-3033 which was reported around three months ago. This vulnerability affects Thunderbird < 102.5.1.
GHSA
GHSA-q68w-fq74-6jp9: If a Thunderbird user replied to a crafted HTML email containing a meta tag, with the meta tag having the http-equiv="refresh" attribute, and the cont
ghsa_unreviewed·2022-12-22
CVE-2022-3033 [HIGH] CWE-79 GHSA-q68w-fq74-6jp9: If a Thunderbird user replied to a crafted HTML email containing a meta tag, with the meta tag having the http-equiv="refresh" attribute, and the cont
If a Thunderbird user replied to a crafted HTML email containing a meta tag, with the meta tag having the http-equiv="refresh" attribute, and the content attribute specifying an URL, then Thunderbird started a network request to that URL, regardless of the configuration to block remote content. In combination with certain other HTML elements and attributes in the email, it was possible to execute JavaScript code included in the message in the context of the message compose document. The JavaScript code was able to perform actions including, but probably not limited to, read and modify the contents of the message compose document, including the quoted original message, which could potentially contain the decrypted plaintext of encrypted data in the crafted email. The contents could then be
OSV
CVE-2022-45414: If a Thunderbird user quoted from an HTML email, for example by replying to the email, and the email contained either a VIDEO tag with the POSTER attr
osv·2022-12-22·CVSS 8.1
CVE-2022-45414 [HIGH] CVE-2022-45414: If a Thunderbird user quoted from an HTML email, for example by replying to the email, and the email contained either a VIDEO tag with the POSTER attr
If a Thunderbird user quoted from an HTML email, for example by replying to the email, and the email contained either a VIDEO tag with the POSTER attribute or an OBJECT tag with a DATA attribute, a network request to the referenced remote URL was performed, regardless of a configuration to block remote content. An image loaded from the POSTER attribute was shown in the composer window. These issues could have given an attacker additional capabilities when targetting releases that did not yet have a fix for CVE-2022-3033 which was reported around three months ago. This vulnerability affects Thunderbird < 102.5.1.
OSV
thunderbird vulnerabilities
osv·2022-10-07·CVSS 8.8
CVE-2022-2505 [HIGH] thunderbird vulnerabilities
thunderbird vulnerabilities
Multiple security issues were discovered in Thunderbird. If a user were
tricked into opening a specially crafted website in a browsing context, an
attacker could potentially exploit these to cause a denial of service,
spoof the mouse pointer position, obtain sensitive information, spoof the
contents of the addressbar, bypass security restrictions, or execute
arbitrary code. (CVE-2022-2505, CVE-2022-36318, CVE-2022-36319,
CVE-2022-38472, CVE-2022-38473, CVE-2022-38476 CVE-2022-38477,
CVE-2022-38478)
Multiple security issues were discovered in Thunderbird. An attacker could
potentially exploit these in order to determine when a user opens a
specially crafted message. (CVE-2022-3032, CVE-2022-3034)
It was discovered that Thunderbird did not correctly handle HTML
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://bugzilla.mozilla.org/show_bug.cgi?id=1784838https://www.mozilla.org/security/advisories/mfsa2022-38/https://www.mozilla.org/security/advisories/mfsa2022-39/https://bugzilla.mozilla.org/show_bug.cgi?id=1784838https://www.mozilla.org/security/advisories/mfsa2022-38/https://www.mozilla.org/security/advisories/mfsa2022-39/
2022-12-22
Published