{"id":"CVE-2022-3034","aliases":["ALSA-2022:6708","ALSA-2022:6717","DEBIAN-CVE-2022-3034","EUVD-2022-42467","GHSA-wrfx-qxxc-92rj","RHSA-2022:6708","RHSA-2022:6710","RHSA-2022:6713","RHSA-2022:6715","RHSA-2022:6716","RHSA-2022:6717","RLSA-2022:6708","SUSE-SU-2022:3281-1","UBUNTU-CVE-2022-3034","USN-5663-1","openSUSE-SU-2024:12299-1"],"status":"published","title":"When receiving an HTML email that specified to load an \u003ccode\u003eiframe\u003c/code\u003e element from a remote...","description":"When receiving an HTML email that specified to load an \u003ccode\u003eiframe\u003c/code\u003e element from a remote location, a request to the remote document was sent. However, Thunderbird didn't display the document. This vulnerability affects Thunderbird \u003c 102.2.1 and Thunderbird \u003c 91.13.1.","severity":{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.00569,"percentile":0.47406,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-1021"],"published":"2022-09-01T00:00:00Z","modified":"2026-11-03T08:04:07Z","fixes":[{"ecosystem":"Debian:12","package":"thunderbird","fixed_in":["1:102.2.1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"thunderbird","fixed_in":["1:102.2.1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"thunderbird","fixed_in":["1:102.2.1-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"thunderbird","fixed_in":["1:102.2.2+build1-0ubuntu0.18.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"thunderbird","fixed_in":["1:102.2.2+build1-0ubuntu0.20.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"thunderbird","fixed_in":["1:102.2.2+build1-0ubuntu0.22.04.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"AlmaLinux:8","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"102.3.0-3.el8_6.alma"}]}],"bundled":10},{"source":"osv","ecosystem":"AlmaLinux:9","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"102.3.0-3.el9_0.alma"}]}],"bundled":10},{"source":"osv","ecosystem":"Debian:12","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:102.2.1-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:102.2.1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:102.2.1-1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:102.3.0-3.el8_6"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"thunderbird-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:102.3.0-3.el8_6"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"thunderbird-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:102.3.0-3.el8_6"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:102.3.0-3.el7_9"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"thunderbird-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:102.3.0-3.el7_9"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:102.3.0-3.el7_9"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"thunderbird-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:102.3.0-3.el7_9"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:102.3.0-3.el7_9"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"thunderbird-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:102.3.0-3.el7_9"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::appstream","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:102.3.0-3.el8_4"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::appstream","package":"thunderbird-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:102.3.0-3.el8_4"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::appstream","package":"thunderbird-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:102.3.0-3.el8_4"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::appstream","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:102.3.0-3.el8_2"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::appstream","package":"thunderbird-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:102.3.0-3.el8_2"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::appstream","package":"thunderbird-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:102.3.0-3.el8_2"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.1::appstream","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:102.3.0-3.el8_1"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.1::appstream","package":"thunderbird-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:102.3.0-3.el8_1"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.1::appstream","package":"thunderbird-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:102.3.0-3.el8_1"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:102.3.0-3.el9_0"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"thunderbird-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:102.3.0-3.el9_0"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"thunderbird-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:102.3.0-3.el9_0"}]}],"bundled":11},{"source":"osv","ecosystem":"Rocky Linux:8","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:102.3.0-3.el8_6"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP3","package":"MozillaThunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"102.2.2-150200.8.82.1"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP4","package":"MozillaThunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"102.2.2-150200.8.82.1"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP3","package":"MozillaThunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"102.2.2-150200.8.82.1"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP4","package":"MozillaThunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"102.2.2-150200.8.82.1"}]}],"bundled":23},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"MozillaThunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"102.2.2-150200.8.82.1"}]}],"bundled":23},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"MozillaThunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"102.2.2-150200.8.82.1"}]}],"bundled":23},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:102.2.2+build1-0ubuntu0.18.04.1"}]}],"versions":["1:52.4.0+build1-0ubuntu2","1:52.6.0+build1-0ubuntu1","1:52.7.0+build1-0ubuntu1","1:52.8.0+build1-0ubuntu0.18.04.1","1:52.9.1+build3-0ubuntu0.18.04.1","1:60.2.1+build1-0ubuntu0.18.04.2","1:60.4.0+build2-0ubuntu0.18.04.1","1:60.5.1+build2-0ubuntu0.18.04.1","1:60.6.1+build2-0ubuntu0.18.04.1","1:60.7.0+build1-0ubuntu0.18.04.1","1:60.7.1+build1-0ubuntu0.18.04.1","1:60.7.2+build2-0ubuntu0.18.04.1","1:60.8.0+build1-0ubuntu0.18.04.1","1:60.9.0+build1-0ubuntu0.18.04.1","1:68.2.1+build1-0ubuntu0.18.04.1","1:68.2.2+build1-0ubuntu0.18.04.1","1:68.4.1+build1-0ubuntu0.18.04.1","1:68.7.0+build1-0ubuntu0.18.04.1","1:68.8.0+build2-0ubuntu0.18.04.2","1:68.10.0+build1-0ubuntu0.18.04.1","1:78.8.1+build1-0ubuntu0.18.04.1","1:78.11.0+build1-0ubuntu0.18.04.2","1:78.13.0+build1-0ubuntu0.18.04.1","1:78.14.0+build1-0ubuntu0.18.04.1","1:78.14.0+build1-0ubuntu0.18.04.2","1:91.5.0+build1-0ubuntu0.18.04.1","1:91.7.0+build2-0ubuntu0.18.04.1","1:91.8.1+build1-0ubuntu0.18.04.1","1:91.9.1+build1-0ubuntu0.18.04.1","1:91.11.0+build2-0ubuntu0.18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:102.2.2+build1-0ubuntu0.20.04.1"}]}],"versions":["1:68.1.2+build1-0ubuntu1","1:68.1.2+build1-0ubuntu2","1:68.2.1+build1-0ubuntu1","1:68.2.2+build1-0ubuntu1","1:68.3.0+build2-0ubuntu1","1:68.3.1+build1-0ubuntu2","1:68.4.1+build1-0ubuntu1","1:68.4.2+build2-0ubuntu1","1:68.5.0+build1-0ubuntu1","1:68.6.0+build2-0ubuntu1","1:68.7.0+build1-0ubuntu1","1:68.7.0+build1-0ubuntu2","1:68.8.0+build2-0ubuntu0.20.04.2","1:68.10.0+build1-0ubuntu0.20.04.1","1:78.7.1+build1-0ubuntu0.20.04.1","1:78.8.1+build1-0ubuntu0.20.04.1","1:78.11.0+build1-0ubuntu0.20.04.2","1:78.13.0+build1-0ubuntu0.20.04.2","1:78.14.0+build1-0ubuntu0.20.04.1","1:78.14.0+build1-0ubuntu0.20.04.2","1:91.5.0+build1-0ubuntu0.20.04.1","1:91.7.0+build2-0ubuntu0.20.04.1","1:91.8.1+build1-0ubuntu0.20.04.1","1:91.9.1+build1-0ubuntu0.20.04.1","1:91.11.0+build2-0ubuntu0.20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:102.2.2+build1-0ubuntu0.22.04.1"}]}],"versions":["1:91.1.2+build1-0ubuntu1","1:91.3.0+build2-0ubuntu1","1:91.3.1+build1-0ubuntu1","1:91.3.2+build1-0ubuntu1","1:91.4.0+build1.1-0ubuntu1","1:91.4.0+build2-0ubuntu1","1:91.5.0+build1-0ubuntu1","1:91.5.1+build1-0ubuntu1","1:91.6.1+build1-0ubuntu1","1:91.7.0+build1-0ubuntu1","1:91.7.0+build2-0ubuntu1","1:91.8.0+build2-0ubuntu1","1:91.9.1+build1-0ubuntu0.22.04.1","1:91.11.0+build2-0ubuntu0.22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:102.2.2+build1-0ubuntu0.18.04.1"}]}],"versions":["1:52.4.0+build1-0ubuntu2","1:52.6.0+build1-0ubuntu1","1:52.7.0+build1-0ubuntu1","1:52.8.0+build1-0ubuntu0.18.04.1","1:52.9.1+build3-0ubuntu0.18.04.1","1:60.2.1+build1-0ubuntu0.18.04.2","1:60.4.0+build2-0ubuntu0.18.04.1","1:60.5.1+build2-0ubuntu0.18.04.1","1:60.6.1+build2-0ubuntu0.18.04.1","1:60.7.0+build1-0ubuntu0.18.04.1","1:60.7.1+build1-0ubuntu0.18.04.1","1:60.7.2+build2-0ubuntu0.18.04.1","1:60.8.0+build1-0ubuntu0.18.04.1","1:60.9.0+build1-0ubuntu0.18.04.1","1:68.2.1+build1-0ubuntu0.18.04.1","1:68.2.2+build1-0ubuntu0.18.04.1","1:68.4.1+build1-0ubuntu0.18.04.1","1:68.7.0+build1-0ubuntu0.18.04.1","1:68.8.0+build2-0ubuntu0.18.04.2","1:68.10.0+build1-0ubuntu0.18.04.1","1:78.8.1+build1-0ubuntu0.18.04.1","1:78.11.0+build1-0ubuntu0.18.04.2","1:78.13.0+build1-0ubuntu0.18.04.1","1:78.14.0+build1-0ubuntu0.18.04.1","1:78.14.0+build1-0ubuntu0.18.04.2","1:91.5.0+build1-0ubuntu0.18.04.1","1:91.7.0+build2-0ubuntu0.18.04.1","1:91.8.1+build1-0ubuntu0.18.04.1","1:91.9.1+build1-0ubuntu0.18.04.1","1:91.11.0+build2-0ubuntu0.18.04.1"],"bundled":12},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:102.2.2+build1-0ubuntu0.20.04.1"}]}],"versions":["1:68.1.2+build1-0ubuntu1","1:68.1.2+build1-0ubuntu2","1:68.2.1+build1-0ubuntu1","1:68.2.2+build1-0ubuntu1","1:68.3.0+build2-0ubuntu1","1:68.3.1+build1-0ubuntu2","1:68.4.1+build1-0ubuntu1","1:68.4.2+build2-0ubuntu1","1:68.5.0+build1-0ubuntu1","1:68.6.0+build2-0ubuntu1","1:68.7.0+build1-0ubuntu1","1:68.7.0+build1-0ubuntu2","1:68.8.0+build2-0ubuntu0.20.04.2","1:68.10.0+build1-0ubuntu0.20.04.1","1:78.7.1+build1-0ubuntu0.20.04.1","1:78.8.1+build1-0ubuntu0.20.04.1","1:78.11.0+build1-0ubuntu0.20.04.2","1:78.13.0+build1-0ubuntu0.20.04.2","1:78.14.0+build1-0ubuntu0.20.04.1","1:78.14.0+build1-0ubuntu0.20.04.2","1:91.5.0+build1-0ubuntu0.20.04.1","1:91.7.0+build2-0ubuntu0.20.04.1","1:91.8.1+build1-0ubuntu0.20.04.1","1:91.9.1+build1-0ubuntu0.20.04.1","1:91.11.0+build2-0ubuntu0.20.04.1"],"bundled":12},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:102.2.2+build1-0ubuntu0.22.04.1"}]}],"versions":["1:91.1.2+build1-0ubuntu1","1:91.3.0+build2-0ubuntu1","1:91.3.1+build1-0ubuntu1","1:91.3.2+build1-0ubuntu1","1:91.4.0+build1.1-0ubuntu1","1:91.4.0+build2-0ubuntu1","1:91.5.0+build1-0ubuntu1","1:91.5.1+build1-0ubuntu1","1:91.6.1+build1-0ubuntu1","1:91.7.0+build1-0ubuntu1","1:91.7.0+build2-0ubuntu1","1:91.8.0+build2-0ubuntu1","1:91.9.1+build1-0ubuntu0.22.04.1","1:91.11.0+build2-0ubuntu0.22.04.1"],"bundled":12},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"MozillaThunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"102.2.1-1.1"}]}],"bundled":4}],"products":[{"vendor":"mozilla","product":"thunderbird"}],"references":[{"url":"https://www.mozilla.org/security/advisories/mfsa2022-38/","tags":["x_transferred","Vendor Advisory","advisory"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2022-39/","tags":["x_transferred","Vendor Advisory","advisory"]},{"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=1745751","tags":["x_transferred","Issue Tracking","Permissions Required","Vendor Advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-3034","tags":["advisory"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2022-38"},{"url":"https://www.mozilla.org/security/advisories/mfsa2022-39"},{"url":"https://github.com/advisories/GHSA-wrfx-qxxc-92rj"},{"url":"https://access.redhat.com/errata/RHSA-2022:6708","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-3032","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-3033","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-3034","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-36059","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-40956","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-40957","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-40958","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-40959","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-40960","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-40962","tags":["report"]},{"url":"https://bugzilla.redhat.com/2123255","tags":["report"]},{"url":"https://bugzilla.redhat.com/2123256","tags":["report"]},{"url":"https://bugzilla.redhat.com/2123257","tags":["report"]},{"url":"https://bugzilla.redhat.com/2123258","tags":["report"]},{"url":"https://bugzilla.redhat.com/2128792","tags":["report"]},{"url":"https://bugzilla.redhat.com/2128793","tags":["report"]},{"url":"https://bugzilla.redhat.com/2128794","tags":["report"]},{"url":"https://bugzilla.redhat.com/2128795","tags":["report"]},{"url":"https://bugzilla.redhat.com/2128796","tags":["report"]},{"url":"https://bugzilla.redhat.com/2128797","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2022-6708.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2022:6717","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2022-6717.html","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-3034","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2123255","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2123256","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2123257","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2123258","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2128792","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2128793","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2128794","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2128795","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2128796","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2128797","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_6708.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-3032","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-3032","tags":["advisory"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2022-38/#CVE-2022-3032","tags":["article"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2022-39/#CVE-2022-3032","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-3033","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-3033","tags":["advisory"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2022-38/#CVE-2022-3033","tags":["article"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2022-39/#CVE-2022-3033","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-3034","tags":["advisory","report"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2022-38/#CVE-2022-3034","tags":["article","report"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2022-39/#CVE-2022-3034","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-3266","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2157739","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-3266","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-3266","tags":["advisory"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2022-41/#CVE-2022-3266","tags":["article"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2022-42/#CVE-2022-3266","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-36059","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-36059","tags":["advisory"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2022-38/#CVE-2022-36059","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-40956","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-40956","tags":["advisory"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2022-41/#CVE-2022-40956","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-40957","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-40957","tags":["advisory"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2022-41/#CVE-2022-40957","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-40958","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-40958","tags":["advisory"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2022-41/#CVE-2022-40958","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-40959","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-40959","tags":["advisory"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2022-41/#CVE-2022-40959","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-40960","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-40960","tags":["advisory"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2022-41/#CVE-2022-40960","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-40962","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-40962","tags":["advisory"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2022-41/#CVE-2022-40962","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2022:6710","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_6710.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2022:6713","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_6713.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2022:6715","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_6715.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2022:6716","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_6716.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_6717.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2022:6708","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20223281-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1200793","tags":["report"]},{"url":"https://bugzilla.suse.com/1201758","tags":["report"]},{"url":"https://bugzilla.suse.com/1202645","tags":["report"]},{"url":"https://bugzilla.suse.com/1203007","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-2200","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-2226","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-2505","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-3032","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-3033","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-3034","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-31744","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-34468","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-34470","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-34472","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-34478","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-34479","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-34481","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-34484","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-36059","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-36314","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-36318","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-36319","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-38472","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-38473","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-38476","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-38477","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-38478","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2022-3034","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5663-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2022-2505","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-3032","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-3033","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-36059","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-36318","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-36319","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-38472","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-38473","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-38476","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-38477","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-38478","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2022-3034","description":"When receiving an HTML email that specified to load an \u003ccode\u003eiframe\u003c/code\u003e element from a remote location, a request to the remote document was sent. However, Thunderbird didn't display the document. This vulnerability affects Thunderbird \u003c 102.2.1 and Thunderbird \u003c 91.13.1.","status":"published","published":"2022-12-22T00:00:00Z","modified":"2025-04-15T16:00:05.338Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-1021"],"updated_at":"2026-11-02T14:34:33.24035Z"}],"euvd":[{"id":"EUVD-2022-42467","description":"When receiving an HTML email that specified to load an \u003ccode\u003eiframe\u003c/code\u003e element from a remote location, a request to the remote document was sent. However, Thunderbird didn't display the document. This vulnerability affects Thunderbird \u003c 102.2.1 and Thunderbird \u003c 91.13.1.","status":"published","published":"2022-12-22T00:00:00Z","modified":"2025-04-15T16:00:05Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T20:52:28.317823Z"}],"ghsa":[{"id":"GHSA-wrfx-qxxc-92rj","title":"When receiving an HTML email that specified to load an \u003ccode\u003eiframe\u003c/code\u003e element from a remote...","description":"When receiving an HTML email that specified to load an \u003ccode\u003eiframe\u003c/code\u003e element from a remote location, a request to the remote document was sent. However, Thunderbird didn't display the document. This vulnerability affects Thunderbird \u003c 102.2.1 and Thunderbird \u003c 91.13.1.","status":"published","published":"2022-12-22T21:30:28Z","modified":"2025-04-15T18:32:38Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-1021"],"updated_at":"2026-11-02T15:01:33.159031Z"}],"nvd":[{"id":"CVE-2022-3034","description":"When receiving an HTML email that specified to load an \u003ccode\u003eiframe\u003c/code\u003e element from a remote location, a request to the remote document was sent. However, Thunderbird didn't display the document. This vulnerability affects Thunderbird \u003c 102.2.1 and Thunderbird \u003c 91.13.1.","status":"published","published":"2022-12-22T20:15:38.133Z","modified":"2026-06-17T04:58:40.747Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium","assessor":"primary"},{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-1021"],"updated_at":"2026-11-02T14:07:34.388163Z"}],"osv":[{"id":"CVE-2022-3034","description":"When receiving an HTML email that specified to load an \u003ccode\u003eiframe\u003c/code\u003e element from a remote location, a request to the remote document was sent. However, Thunderbird didn't display the document. This vulnerability affects Thunderbird \u003c 102.2.1 and Thunderbird \u003c 91.13.1.","status":"published","published":"2022-12-22T20:15:38.133Z","modified":"2026-03-14T14:59:47.386081Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:25.516981Z"},{"id":"DEBIAN-CVE-2022-3034","description":"When receiving an HTML email that specified to load an \u003ccode\u003eiframe\u003c/code\u003e element from a remote location, a request to the remote document was sent. However, Thunderbird didn't display the document. This vulnerability affects Thunderbird \u003c 102.2.1 and Thunderbird \u003c 91.13.1.","status":"published","published":"2022-12-22T20:15:38.133Z","modified":"2026-11-03T08:04:07.766569999Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-03T08:23:07.763774Z"},{"id":"RHSA-2022:6708","title":"Red Hat Security Advisory: thunderbird security update","status":"published","published":"2024-09-16T09:06:11Z","modified":"2025-11-22T12:38:31Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:10.139266Z"},{"id":"RHSA-2022:6710","title":"Red Hat Security Advisory: thunderbird security update","status":"published","published":"2024-09-16T09:06:36Z","modified":"2026-06-26T11:00:34Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:10.139266Z"},{"id":"RHSA-2022:6713","title":"Red Hat Security Advisory: thunderbird security update","status":"published","published":"2024-09-16T09:06:03Z","modified":"2025-11-22T12:38:33Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:10.139266Z"},{"id":"RHSA-2022:6715","title":"Red Hat Security Advisory: thunderbird security update","status":"published","published":"2024-09-16T09:06:43Z","modified":"2025-11-22T12:38:34Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:10.139266Z"},{"id":"RHSA-2022:6716","title":"Red Hat Security Advisory: thunderbird security update","status":"published","published":"2024-09-16T09:06:27Z","modified":"2025-11-22T12:38:34Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:10.139266Z"},{"id":"RHSA-2022:6717","title":"Red Hat Security Advisory: thunderbird security update","status":"published","published":"2024-09-16T09:06:20Z","modified":"2025-11-22T12:38:35Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:10.139266Z"},{"id":"RLSA-2022:6708","title":"Important: thunderbird security update","description":"Mozilla Thunderbird is a standalone mail and newsgroup client.\n\nThis update upgrades Thunderbird to version 102.3.0.\n\nSecurity Fix(es):\n\n* Mozilla: Leaking of sensitive information when composing a response to an HTML email with a META refresh tag (CVE-2022-3033)\n\n* Mozilla: Bypassing FeaturePolicy restrictions on transient pages (CVE-2022-40959)\n\n* Mozilla: Data-race when parsing non-UTF-8 URLs in threads (CVE-2022-40960)\n\n* Mozilla: Memory safety bugs fixed in Firefox 105 and Firefox ESR 102.3 (CVE-2022-40962)\n\n* Mozilla: Remote content specified in an HTML document that was nested inside an iframe's srcdoc attribute was not blocked (CVE-2022-3032)\n\n* Mozilla: An iframe element in an HTML email could trigger a network request (CVE-2022-3034)\n\n* Mozilla: Matrix SDK bundled with Thunderbird vulnerable to denial-of-service attack (CVE-2022-36059)\n\n* Mozilla: Bypassing Secure Context restriction for cookies with __Host and __Secure prefix (CVE-2022-40958)\n\n* Mozilla: Content-Security-Policy base-uri bypass (CVE-2022-40956)\n\n* Mozilla: Incoherent instruction cache when building WASM on ARM64 (CVE-2022-40957)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2022-09-26T13:56:07Z","modified":"2026-02-04T10:30:04.992457Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:24.322216Z"},{"id":"UBUNTU-CVE-2022-3034","description":"When receiving an HTML email that specified to load an \u003ccode\u003eiframe\u003c/code\u003e element from a remote location, a request to the remote document was sent. However, Thunderbird didn't display the document. This vulnerability affects Thunderbird \u003c 102.2.1 and Thunderbird \u003c 91.13.1.","status":"published","published":"2022-09-01T00:00:00Z","modified":"2026-04-22T13:17:36.517506Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium"},{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T16:53:53.899276Z"},{"id":"ALSA-2022:6708","title":"Important: thunderbird security update","description":"Mozilla Thunderbird is a standalone mail and newsgroup client.\n\nThis update upgrades Thunderbird to version 102.3.0.\n\nSecurity Fix(es):\n\n* Mozilla: Leaking of sensitive information when composing a response to an HTML email with a META refresh tag (CVE-2022-3033)\n* Mozilla: Bypassing FeaturePolicy restrictions on transient pages (CVE-2022-40959)\n* Mozilla: Data-race when parsing non-UTF-8 URLs in threads (CVE-2022-40960)\n* Mozilla: Memory safety bugs fixed in Firefox 105 and Firefox ESR 102.3 (CVE-2022-40962)\n* Mozilla: Remote content specified in an HTML document that was nested inside an iframe's srcdoc attribute was not blocked (CVE-2022-3032)\n* Mozilla: An iframe element in an HTML email could trigger a network request (CVE-2022-3034)\n* Mozilla: Matrix SDK bundled with Thunderbird vulnerable to denial-of-service attack (CVE-2022-36059)\n* Mozilla: Bypassing Secure Context restriction for cookies with __Host and __Secure prefix (CVE-2022-40958)\n* Mozilla: Content-Security-Policy base-uri bypass (CVE-2022-40956)\n* Mozilla: Incoherent instruction cache when building WASM on ARM64 (CVE-2022-40957)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2022-09-26T00:00:00Z","modified":"2026-10-29T11:01:46.956986822Z","updated_at":"2026-11-02T15:27:51.655726Z"},{"id":"ALSA-2022:6717","title":"Important: thunderbird security update","description":"Mozilla Thunderbird is a standalone mail and newsgroup client.\n\nThis update upgrades Thunderbird to version 102.3.0.\n\nSecurity Fix(es):\n\n* Mozilla: Leaking of sensitive information when composing a response to an HTML email with a META refresh tag (CVE-2022-3033)\n* Mozilla: Bypassing FeaturePolicy restrictions on transient pages (CVE-2022-40959)\n* Mozilla: Data-race when parsing non-UTF-8 URLs in threads (CVE-2022-40960)\n* Mozilla: Memory safety bugs fixed in Firefox 105 and Firefox ESR 102.3 (CVE-2022-40962)\n* Mozilla: Remote content specified in an HTML document that was nested inside an iframe's srcdoc attribute was not blocked (CVE-2022-3032)\n* Mozilla: An iframe element in an HTML email could trigger a network request (CVE-2022-3034)\n* Mozilla: Matrix SDK bundled with Thunderbird vulnerable to denial-of-service attack (CVE-2022-36059)\n* Mozilla: Bypassing Secure Context restriction for cookies with __Host and __Secure prefix (CVE-2022-40958)\n* Mozilla: Content-Security-Policy base-uri bypass (CVE-2022-40956)\n* Mozilla: Incoherent instruction cache when building WASM on ARM64 (CVE-2022-40957)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2022-09-26T00:00:00Z","modified":"2026-10-29T11:31:16.025844668Z","updated_at":"2026-11-02T15:27:51.655726Z"},{"id":"openSUSE-SU-2024:12299-1","title":"MozillaThunderbird-102.2.1-1.1 on GA media","description":"These are all security issues fixed in the MozillaThunderbird-102.2.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:32:14.175013Z","updated_at":"2026-11-02T16:58:35.485255Z"},{"id":"SUSE-SU-2022:3281-1","title":"Security update for MozillaThunderbird","description":"This update for MozillaThunderbird fixes the following issues:\n\nUpdated to Mozilla Thunderbird 102.2.2:\n- CVE-2022-3033: Fixed leaking of sensitive information when composing a response to an HTML email with a META refresh tag (bsc#1203007).\n- CVE-2022-3032: Fixed missing blocking of remote content specified in an HTML document that was nested inside an iframe's srcdoc attribute (bsc#1203007).\n- CVE-2022-3034: Fixed issue where iframe element in an HTML email could trigger a network request (bsc#1203007).\n- CVE-2022-36059: Fixed DoS in Matrix SDK bundled with Thunderbird service attack (bsc#1203007).\n \n- CVE-2022-38472: Fixed Address bar spoofing via XSLT error handling (bsc#1202645).\n- CVE-2022-38473: Fixed cross-origin XSLT Documents inheriting the parent's permissions (bsc#1202645).\n- CVE-2022-38476: Fixed data race and potential use-after-free in PK11_ChangePW (bsc#1202645).\n- CVE-2022-38477: Fixed memory safety bugs (bsc#1202645).\n- CVE-2022-38478: Fixed memory safety bugs (bsc#1202645).\n\n- CVE-2022-36319: Fixed mouse position spoofing with CSS transforms (bsc#1201758).\n- CVE-2022-36318: Fixed directory indexes for bundled resources reflected URL parameters (bsc#1201758).\n- CVE-2022-36314: Fixed unexpected network loads when opening local .lnk files (bsc#1201758).\n- CVE-2022-2505: Fixed memory safety bugs (bsc#1201758).\n\n- CVE-2022-34479: Fixed vulnerability which could overlay the address bar with web content (bsc#1200793).\n- CVE-2022-34470: Fixed use-after-free in nsSHistory (bsc#1200793).\n- CVE-2022-34468: Fixed CSP sandbox header without `allow-scripts` bypass via retargeted javascript (bsc#1200793).\n- CVE-2022-2226: Fixed emails with a mismatching OpenPGP signature date incorrectly accepted as valid (bsc#1200793).\n- CVE-2022-34481: Fixed integer overflow in ReplaceElementsAt (bsc#1200793).\n- CVE-2022-31744: Fixed CSP bypass enabling stylesheet injection (bsc#1200793).\n- CVE-2022-34472: Fixed unavailable PAC file resulting in OCSP requests being blocked (bsc#1200793).\n- CVE-2022-34478: Fixed Microsoft protocols attacks if a user accepts a prompt (bsc#1200793).\n- CVE-2022-2200: Fixed vulnerability where undesired attributes could be set as part of prototype pollution (bsc#1200793).\n- CVE-2022-34484: Fixed memory safety bugs (bsc#1200793).\n","status":"published","published":"2022-09-15T13:33:15Z","modified":"2026-02-04T03:29:06.527695Z","updated_at":"2026-11-02T15:53:51.440565Z"},{"id":"USN-5663-1","title":"thunderbird vulnerabilities","description":"Multiple security issues were discovered in Thunderbird. If a user were\ntricked into opening a specially crafted website in a browsing context, an\nattacker could potentially exploit these to cause a denial of service, \nspoof the mouse pointer position, obtain sensitive information, spoof the\ncontents of the addressbar, bypass security restrictions, or execute\narbitrary code. (CVE-2022-2505, CVE-2022-36318, CVE-2022-36319,\nCVE-2022-38472, CVE-2022-38473, CVE-2022-38476 CVE-2022-38477,\nCVE-2022-38478)\n\nMultiple security issues were discovered in Thunderbird. An attacker could\npotentially exploit these in order to determine when a user opens a\nspecially crafted message. (CVE-2022-3032, CVE-2022-3034)\n\nIt was discovered that Thunderbird did not correctly handle HTML messages\nthat contain a meta tag in some circumstances. If a user were tricked into\nreplying to a specially crafted message, an attacker could potentially\nexploit this to obtain sensitive information. (CVE-2022-3033)\n\nA security issue was discovered with the Matrix SDK in Thunderbird. An\nattacker sharing a room with a user could potentially exploit this to\ncause a denial of service. (CVE-2022-36059)\n","status":"published","published":"2022-10-07T20:33:15Z","modified":"2026-04-27T16:32:21.104985651Z","updated_at":"2026-11-02T16:58:16.20937Z"}]}}