CVE-2022-3032: Medium severity Mozilla Thunderbird vulnerability
When receiving an HTML email that contained an iframe element, which used a srcdoc attribute to define the inner HTML document, remote objects specified in the nested document, for example images or videos, were not blocked. Rather, the network was accessed, the objects were loaded and displayed.
External References: https://www.mozilla.org/en-US/security/advisories/mfsa2022-38/#CVE-2022-3032 https://www.mozilla.org/en-US/security/advisories/mfsa2022-39/#CVE-2022-3032
Other sources
When receiving an HTML email that contained an <code>iframe</code> element, which used a <code>srcdoc</code> attribute to define the inner HTML document, remote objects specified in the nested document, for example images or videos, were not blocked. Rather, the network was accessed, the objects were loaded and displayed. This vulnerability affects Thunderbird < 102.2.1 and Thunderbird < 91.13.1.
— MITRE
When receiving an HTML email that contained an iframe element, which used a srcdoc attribute to define the inner HTML document, remote objects specified in the nested document, for example images or videos, were not blocked. Rather, the network was accessed, the objects were loaded and displayed.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Thunderbirdto a version that resolves this vulnerability.Fixed in 91.13.1 - Upgrade
Upgrade
debian/thunderbirdto a version that resolves this vulnerability.Fixed in 1:140.12.0esr-1~deb12u1Fixed in 1:153.6.0esr-1~deb12u2Fixed in 1:140.12.0esr-1~deb13u1Fixed in 1:153.6.0esr-1~deb13u1Fixed in 1:153.5.0esr-1Fixed in 1:153.6.0esr-1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 102.2.1 - Upgrade
Upgrade
debian/thunderbirdto a version that resolves this vulnerability.Fixed in 1:102.2.1-1 - Upgrade
Upgrade
redhat/thunderbirdto a version that resolves this vulnerability.Fixed in 91.13.1 - Upgrade
Upgrade
redhat/thunderbirdto a version that resolves this vulnerability.Fixed in 102.2.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 91.13.1
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is CVE-2022-3032?
CVE-2022-3032 is a vulnerability that allows remote objects specified in an iframe element's nested document to be accessed without blocking access to the network.
Which software is affected by CVE-2022-3032?
Mozilla Thunderbird versions up to 91.13.1 and 102.2.1 are affected by CVE-2022-3032.
How severe is CVE-2022-3032?
CVE-2022-3032 has a severity rating of 6.5 (medium).
How can I fix CVE-2022-3032?
To fix CVE-2022-3032, update Mozilla Thunderbird to version 91.13.1 or higher.
Where can I find more information about CVE-2022-3032?
You can find more information about CVE-2022-3032 in the following references: [link1](https://bugzilla.mozilla.org/show_bug.cgi?id=1783831), [link2](https://www.mozilla.org/en-US/security/advisories/mfsa2022-39/), [link3](https://www.mozilla.org/en-US/security/advisories/mfsa2022-38/).