CVE-2022-45414
High · 8.1CVSS
8.1
EPSS
0.6%
Published
Dec 22, 2022
CISA due date
—
Cloudanix analysis
A bug in the email program could let outside images or content load when you reply to certain messages even if you turned off automatic loading of remote pictures.
- Exploitation
- Requires User Interaction
- Attacker needs
- User Interaction
- Complexity
- Low
- Impact
- Data Exposure
- Component
- Application
- Class
- Improper Input Validation
- Remediation
- Upgrade
- Effort
- Medium
- Patch risk
- Low
What it actually does
When quoting HTML email content containing VIDEO POSTER or OBJECT DATA attributes, the client issues network requests to the referenced remote URLs despite remote-content blocking settings, and may render the referenced image in the composer.
Why it matters to the business
Attackers can obtain additional information about email recipients or deliver malicious content even when users have configured privacy protections, increasing exposure to tracking or follow-on attacks.
How an attack unfolds
An attacker crafts an HTML email containing a VIDEO tag with a POSTER attribute or an OBJECT tag with a DATA attribute pointing to an attacker-controlled URL and sends it to a target. When the recipient replies or quotes the message, the client performs the network request regardless of blocking settings, allowing the attacker to observe the request or serve content.
How to fix it
Upgrade Thunderbird to version 102.5.1 or later; apply the equivalent fix in any downstream packages that embed the affected email-rendering code.
How to confirm the fix worked
Confirm client version is 102.5.1 or newer; test by composing a reply to a synthetic message containing the VIDEO POSTER or OBJECT DATA pattern while monitoring outbound network traffic.
Typical attack path
- Craft HTML email with VIDEO/OBJECT tags referencing attacker URL
- Deliver email to target
- Target replies or quotes the message
- Client leaks network request to attacker-controlled endpoint
How to detect it
Inspect email-client process logs and network flow records for outbound requests triggered immediately after reply or quote actions on HTML messages; correlate with unexpected domains referenced in email bodies.
What your security team should do
- Prioritize upgrade of all Thunderbird installations to 102.5.1 or newer within the next patch cycle
- Review email-client remote-content policies and enforce updates via centralized management
- Add SIEM rules to detect unexpected outbound requests originating from the email client process
The record
If a Thunderbird user quoted from an HTML email, for example by replying to the email, and the email contained either a VIDEO tag with the POSTER attribute or an OBJECT tag with a DATA attribute, a network request to the referenced remote URL was performed, regardless of a configuration to block remote content. An image loaded from the POSTER attribute was shown in the composer window. These issues could have given an attacker additional capabilities when targetting releases that did not yet have a fix for CVE-2022-3033 which was reported around three months ago. This vulnerability affects Thunderbird < 102.5.1.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| AlmaLinux:8 | thunderbird | 0 | 102.6.0-2.el8_7.alma |
| AlmaLinux:9 | thunderbird | 0 | 102.6.0-2.el9_1.alma |
| Debian:11 | thunderbird | 0 | 1:102.6.0-1~deb11u1 |
| Debian:12 | thunderbird | 0 | 1:102.5.1-1 |
| Debian:13 | thunderbird | 0 | 1:102.5.1-1 |
| Mageia:8 | thunderbird | 0 | 102.5.1-1.mga8 |
| Mageia:8 | thunderbird-l10n | 0 | 102.5.1-1.mga8 |
| Red Hat:enterprise_linux:7::client | thunderbird | 0 | 0:102.6.0-2.el7_9 |
| Red Hat:enterprise_linux:7::client | thunderbird-debuginfo | 0 | 0:102.6.0-2.el7_9 |
| Red Hat:enterprise_linux:7::server | thunderbird | 0 | 0:102.6.0-2.el7_9 |
| Red Hat:enterprise_linux:7::server | thunderbird-debuginfo | 0 | 0:102.6.0-2.el7_9 |
| Red Hat:enterprise_linux:7::workstation | thunderbird | 0 | 0:102.6.0-2.el7_9 |
| Red Hat:enterprise_linux:7::workstation | thunderbird-debuginfo | 0 | 0:102.6.0-2.el7_9 |
| Red Hat:enterprise_linux:8::appstream | thunderbird | 0 | 0:102.6.0-2.el8_7 |
| Red Hat:enterprise_linux:8::appstream | thunderbird-debuginfo | 0 | 0:102.6.0-2.el8_7 |
| Red Hat:enterprise_linux:8::appstream | thunderbird-debugsource | 0 | 0:102.6.0-2.el8_7 |
| Red Hat:enterprise_linux:9::appstream | thunderbird | 0 | 0:102.6.0-2.el9_1 |
| Red Hat:enterprise_linux:9::appstream | thunderbird-debuginfo | 0 | 0:102.6.0-2.el9_1 |
| Red Hat:enterprise_linux:9::appstream | thunderbird-debugsource | 0 | 0:102.6.0-2.el9_1 |
| Red Hat:rhel_aus:8.2::appstream | thunderbird | 0 | 0:102.6.0-2.el8_2 |
| Red Hat:rhel_aus:8.2::appstream | thunderbird-debuginfo | 0 | 0:102.6.0-2.el8_2 |
| Red Hat:rhel_aus:8.2::appstream | thunderbird-debugsource | 0 | 0:102.6.0-2.el8_2 |
| Red Hat:rhel_e4s:8.1::appstream | thunderbird | 0 | 0:102.6.0-2.el8_1 |
| Red Hat:rhel_e4s:8.1::appstream | thunderbird-debuginfo | 0 | 0:102.6.0-2.el8_1 |
| Red Hat:rhel_e4s:8.1::appstream | thunderbird-debugsource | 0 | 0:102.6.0-2.el8_1 |
| Red Hat:rhel_e4s:8.2::appstream | thunderbird | 0 | 0:102.6.0-2.el8_2 |
| Red Hat:rhel_e4s:8.2::appstream | thunderbird-debuginfo | 0 | 0:102.6.0-2.el8_2 |
| Red Hat:rhel_e4s:8.2::appstream | thunderbird-debugsource | 0 | 0:102.6.0-2.el8_2 |
| Red Hat:rhel_eus:8.4::appstream | thunderbird | 0 | 0:102.6.0-2.el8_4 |
| Red Hat:rhel_eus:8.4::appstream | thunderbird-debuginfo | 0 | 0:102.6.0-2.el8_4 |
| Red Hat:rhel_eus:8.4::appstream | thunderbird-debugsource | 0 | 0:102.6.0-2.el8_4 |
| Red Hat:rhel_eus:8.6::appstream | thunderbird | 0 | 0:102.6.0-2.el8_6 |
| Red Hat:rhel_eus:8.6::appstream | thunderbird-debuginfo | 0 | 0:102.6.0-2.el8_6 |
| Red Hat:rhel_eus:8.6::appstream | thunderbird-debugsource | 0 | 0:102.6.0-2.el8_6 |
| Red Hat:rhel_eus:9.0::appstream | thunderbird | 0 | 0:102.6.0-2.el9_0 |
| Red Hat:rhel_eus:9.0::appstream | thunderbird-debuginfo | 0 | 0:102.6.0-2.el9_0 |
| Red Hat:rhel_eus:9.0::appstream | thunderbird-debugsource | 0 | 0:102.6.0-2.el9_0 |
| Red Hat:rhel_tus:8.2::appstream | thunderbird | 0 | 0:102.6.0-2.el8_2 |
| Red Hat:rhel_tus:8.2::appstream | thunderbird-debuginfo | 0 | 0:102.6.0-2.el8_2 |
| Red Hat:rhel_tus:8.2::appstream | thunderbird-debugsource | 0 | 0:102.6.0-2.el8_2 |
| SUSE:Linux Enterprise Module for Package Hub 15 SP3 | MozillaThunderbird | 0 | 102.5.1-150200.8.93.1 |
| SUSE:Linux Enterprise Module for Package Hub 15 SP4 | MozillaThunderbird | 0 | 102.5.1-150200.8.93.1 |
| SUSE:Linux Enterprise Workstation Extension 15 SP3 | MozillaThunderbird | 0 | 102.5.1-150200.8.93.1 |
| SUSE:Linux Enterprise Workstation Extension 15 SP4 | MozillaThunderbird | 0 | 102.5.1-150200.8.93.1 |
| Ubuntu:18.04:LTS | thunderbird | 0 | 1:102.7.1+build2-0ubuntu0.18.04.1 |
| Ubuntu:20.04:LTS | thunderbird | 0 | 1:102.7.1+build2-0ubuntu0.20.04.1 |
| Ubuntu:22.04:LTS | thunderbird | 0 | 1:102.7.1+build2-0ubuntu0.22.04.1 |
| openSUSE:Leap 15.3 | MozillaThunderbird | 0 | 102.5.1-150200.8.93.1 |
| openSUSE:Leap 15.4 | MozillaThunderbird | 0 | 102.5.1-150200.8.93.1 |
| openSUSE:Tumbleweed | MozillaThunderbird | 0 | 102.5.1-1.1 |
Related vulnerabilities
- CVE-2025-14331 Same-origin policy bypass in the Request Handling component. Also affects thunderbird
- CVE-2025-14325 JIT miscompilation in the JavaScript Engine: JIT component. Also affects thunderbird
- CVE-2025-14330 JIT miscompilation in the JavaScript Engine: JIT component. Also affects thunderbird
- CVE-2025-14333 Memory safety bugs present in Firefox ESR 140.5, Thunderbird ESR 140.5, Firefox 145 and… Also affects thunderbird
- CVE-2025-14328 Privilege escalation in the Netmonitor component. Also affects thunderbird
- CVE-2025-14329 Privilege escalation in the Netmonitor component. Also affects thunderbird
- CVE-2025-14323 Privilege escalation in the DOM: Notifications component. Also affects thunderbird
- CVE-2025-14321 Use-after-free in the WebRTC: Signaling component. Also affects thunderbird