Mozilla: An iframe element in an HTML email could trigger a network request
Published Dec 22, 2022
4.3
MEDIUMCVSS 3.1
EPSS 0.55%
Description
When receiving an HTML email that specified to load an <code>iframe</code> element from a remote location, a request to the remote document was sent. However, Thunderbird didn't display the document. This vulnerability affects Thunderbird < 102.2.1 and Thunderbird < 91.13.1.
Affected products
-
Affected
- ≥ unspecified, < 102.2.1
- ≥ unspecified, < 91.13.1
Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).
| Vendor | Product | Default status | Versions |
|---|---|---|---|
| Mozilla | Thunderbird | unknown | Affected
|
- < 91.31.1
- ≥ 102.0 · < 102.2.1
No data.
Red Hat Enterprise Linux 7
thunderbird-0:102.3.0-3.el7_9
Fixed · RHSA-2022:6710
Red Hat Enterprise Linux 8
thunderbird-0:102.3.0-3.el8_6
Fixed · RHSA-2022:6708
Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions
thunderbird-0:102.3.0-3.el8_1
Fixed · RHSA-2022:6716
Red Hat Enterprise Linux 8.2 Extended Update Support
thunderbird-0:102.3.0-3.el8_2
Fixed · RHSA-2022:6715
Red Hat Enterprise Linux 8.4 Extended Update Support
thunderbird-0:102.3.0-3.el8_4
Fixed · RHSA-2022:6713
Red Hat Enterprise Linux 9
thunderbird-0:102.3.0-3.el9_0
Fixed · RHSA-2022:6717
Red Hat Enterprise Linux 6
thunderbird
Out of support scope
| Product | Package | State | Advisory |
|---|---|---|---|
| Red Hat Enterprise Linux 7 | thunderbird-0:102.3.0-3.el7_9 | Fixed | RHSA-2022:6710 |
| Red Hat Enterprise Linux 8 | thunderbird-0:102.3.0-3.el8_6 | Fixed | RHSA-2022:6708 |
| Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions | thunderbird-0:102.3.0-3.el8_1 | Fixed | RHSA-2022:6716 |
| Red Hat Enterprise Linux 8.2 Extended Update Support | thunderbird-0:102.3.0-3.el8_2 | Fixed | RHSA-2022:6715 |
| Red Hat Enterprise Linux 8.4 Extended Update Support | thunderbird-0:102.3.0-3.el8_4 | Fixed | RHSA-2022:6713 |
| Red Hat Enterprise Linux 9 | thunderbird-0:102.3.0-3.el9_0 | Fixed | RHSA-2022:6717 |
| Red Hat Enterprise Linux 6 | thunderbird | Out of support scope | n/a |
No package ranges for this CVE.
Remediation
No remediation recorded yet.
References (10)
- https://access.redhat.com/security/cve/CVE-2022-3034 Vendor Advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=1745751 Issue TrackingPermissions RequiredVendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2123257 Issue Tracking
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-42467 Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2022-3034
- https://www.cve.org/CVERecord?id=CVE-2022-3034
- https://www.mozilla.org/en-US/security/advisories/mfsa2022-38/#CVE-2022-3034
- https://www.mozilla.org/en-US/security/advisories/mfsa2022-39/#CVE-2022-3034
- https://www.mozilla.org/security/advisories/mfsa2022-38/ Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2022-39/ Vendor Advisory
| Link | Providers | Tags |
|---|---|---|
| https://access.redhat.com/security/cve/CVE-2022-3034 | Vendor Advisory | |
| https://bugzilla.mozilla.org/show_bug.cgi?id=1745751 | Issue TrackingPermissions RequiredVendor Advisory | |
| https://bugzilla.redhat.com/show_bug.cgi?id=2123257 | Issue Tracking | |
| https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-42467 | Advisory | |
| https://nvd.nist.gov/vuln/detail/CVE-2022-3034 | ||
| https://www.cve.org/CVERecord?id=CVE-2022-3034 | ||
| https://www.mozilla.org/en-US/security/advisories/mfsa2022-38/#CVE-2022-3034 | ||
| https://www.mozilla.org/en-US/security/advisories/mfsa2022-39/#CVE-2022-3034 | ||
| https://www.mozilla.org/security/advisories/mfsa2022-38/ | Vendor Advisory | |
| https://www.mozilla.org/security/advisories/mfsa2022-39/ | Vendor Advisory |
Change history (0)
No recorded changes yet.
CVE.org / MITRE
CISA Vulnrichment
GitHub
No data