CVE-2022-45403: Medium severity Mozilla Thunderbird vulnerability

Q: What is CVE-2022-45403?

CVE-2022-45403 is a vulnerability that allows Service Workers to infer information about opaque cross-origin responses, potentially leading to the determination of the presence or length of a media file.

Q: What software is affected by CVE-2022-45403?

CVE-2022-45403 affects Firefox ESR versions prior to 102.5, Thunderbird versions prior to 102.5, and Firefox versions prior to 107.0.

Q: How can this vulnerability be exploited?

This vulnerability can be exploited by Service Workers combined with Range requests and timing information for cross-origin media.

Q: What is the severity of CVE-2022-45403?

CVE-2022-45403 has a severity rating of 6.5 (high).

Q: How can I fix CVE-2022-45403?

To fix CVE-2022-45403, update Firefox ESR to version 102.5 or later, Thunderbird to version 102.5 or later, or Firefox to version 107.0 or later.

Published Nov 15, 2022

Updated

Service Workers should not be able to infer information about opaque cross-origin responses; but timing information for cross-origin media combined with Range requests might have allowed them to determine the presence or length of a media file.

Affected Software

23 affected componentsFixes available

Mozilla Thunderbird<102.5

102.5

Mozilla Firefox<107.0

Mozilla Firefox ESR<102.5

Mozilla Thunderbird<102.5

Mozilla Firefox ESR<102.5

102.5

Mozilla Firefox<107

107

alpine/firefox-esr<102.5.0-r0

102.5.0-r0

alpine/firefox-esr<102.5.0-r0

102.5.0-r0

alpine/firefox-esr<102.5.0-r0

102.5.0-r0

alpine/firefox-esr<102.5.0-r0

102.5.0-r0

alpine/firefox-esr<102.5.0-r0

102.5.0-r0

alpine/firefox-esr<102.5.0-r0

102.5.0-r0

debian/firefox-esr<102.5.0esr-1

102.5.0esr-1

debian/firefox-esr<102.5.0esr-1

102.5.0esr-1

debian/firefox-esr<102.5.0esr-1

102.5.0esr-1

debian/thunderbird<1:102.5.0-1

1:102.5.0-1

debian/thunderbird<1:102.5.0-1

1:102.5.0-1

debian/thunderbird<1:102.5.0-1

1:102.5.0-1

debian/firefox

159.0.1-1

debian/firefox-esr

140.12.0esr-1~deb12u1153.6.0esr-1~deb12u2140.15.0esr-1~deb13u1153.6.0esr-1~deb13u1153.5.1esr-1153.6.0esr-1

debian/thunderbird

1:140.12.0esr-1~deb12u11:153.6.0esr-1~deb12u21:140.12.0esr-1~deb13u11:153.6.0esr-1~deb13u11:153.5.0esr-11:153.6.0esr-1

redhat/thunderbird<102.5

102.5

redhat/firefox<102.5

102.5

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Thunderbird to a version that resolves this vulnerability.
Fixed in 102.5
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 102.5
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 107
Upgrade
Upgrade alpine/firefox-esr to a version that resolves this vulnerability.
Fixed in 102.5.0-r0
Upgrade
Upgrade debian/firefox-esr to a version that resolves this vulnerability.
Fixed in 102.5.0esr-1
Upgrade
Upgrade debian/thunderbird to a version that resolves this vulnerability.
Fixed in 1:102.5.0-1
Upgrade
Upgrade debian/firefox to a version that resolves this vulnerability.
Fixed in 159.0.1-1
Upgrade
Upgrade debian/firefox-esr to a version that resolves this vulnerability.
Fixed in 140.12.0esr-1~deb12u1Fixed in 153.6.0esr-1~deb12u2Fixed in 140.15.0esr-1~deb13u1Fixed in 153.6.0esr-1~deb13u1Fixed in 153.5.1esr-1Fixed in 153.6.0esr-1
Upgrade
Upgrade debian/thunderbird to a version that resolves this vulnerability.
Fixed in 1:140.12.0esr-1~deb12u1Fixed in 1:153.6.0esr-1~deb12u2Fixed in 1:140.12.0esr-1~deb13u1Fixed in 1:153.6.0esr-1~deb13u1Fixed in 1:153.5.0esr-1Fixed in 1:153.6.0esr-1
Upgrade
Upgrade redhat/thunderbird to a version that resolves this vulnerability.
Fixed in 102.5
Upgrade
Upgrade redhat/firefox to a version that resolves this vulnerability.
Fixed in 102.5

Event History

Nov 15, 2022

CVE Published

12:00 AM

Data Sourced

via Mozilla·12:00 AM

DescriptionSeverityAffected Software

Nov 16, 2022

Data Sourced

via Red Hat·10:55 AM

DescriptionSeverityAffected Software

Dec 22, 2022

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

DescriptionWeakness

Data Sourced

via NVD·08:15 PM

DescriptionSeverityWeaknessAffected Software

Data Sourced

via OSV·08:15 PM

DescriptionSeverityAffected Software

Parent advisories

This vulnerability appears in the following advisories.

Peer vulnerabilities

Found alongside the following vulnerabilities.

Frequently Asked Questions

What is CVE-2022-45403?

CVE-2022-45403 is a vulnerability that allows Service Workers to infer information about opaque cross-origin responses, potentially leading to the determination of the presence or length of a media file.

What software is affected by CVE-2022-45403?

CVE-2022-45403 affects Firefox ESR versions prior to 102.5, Thunderbird versions prior to 102.5, and Firefox versions prior to 107.0.

How can this vulnerability be exploited?

This vulnerability can be exploited by Service Workers combined with Range requests and timing information for cross-origin media.

What is the severity of CVE-2022-45403?

CVE-2022-45403 has a severity rating of 6.5 (high).

How can I fix CVE-2022-45403?

To fix CVE-2022-45403, update Firefox ESR to version 102.5 or later, Thunderbird to version 102.5 or later, or Firefox to version 107.0 or later.

CVE-2022-45403: Medium severity Mozilla Thunderbird vulnerability

Affected Software

Remediation

Event History

Parent advisories

Peer vulnerabilities

Frequently Asked Questions

What is CVE-2022-45403?

What software is affected by CVE-2022-45403?

How can this vulnerability be exploited?

What is the severity of CVE-2022-45403?

How can I fix CVE-2022-45403?

Company

Resources

Contact