Skip to content
OpenAdvisories
High · 8.1 CVE-2022-3033 EUVD-2022-42466GHSA-q68w-fq74-6jp9

If a Thunderbird user replied to a crafted HTML email containing a <code>meta</code> tag, with the <code>meta</code> tag having the <code>h…

Published Dec 22, 2022 · Updated Apr 15, 2025 · Assigned by mozilla

Vendor: Mozilla Product: Thunderbird Package: thunderbird Package: thunderbird Ecosystem: Debian Ecosystem: Ubuntu

Description

If a Thunderbird user replied to a crafted HTML email containing a <code>meta</code> tag, with the <code>meta</code> tag having the <code>http-equiv="refresh"</code> attribute, and the content attribute specifying an URL, then Thunderbird started a network request to that URL, regardless of the configuration to block remote content. In combination with certain other HTML elements and attributes in the email, it was possible to execute JavaScript code included in the message in the context of the message compose document. The JavaScript code was able to perform actions including, but probably not limited to, read and modify the contents of the message compose document, including the quoted original message, which could potentially contain the decrypted plaintext of encrypted data in the crafted email. The contents could then be transmitted to the network, either to the URL specified in the META refresh tag, or to a different URL, as the JavaScript code could modify the URL specified in the document. This bug doesn't affect users who have changed the default Message Body display setting to 'simple html' or 'plain text'. This vulnerability affects Thunderbird < 102.2.1 and Thunderbird < 91.13.1.

Affected products

VendorProductAffectedFixed
Mozilla Thunderbird unspecified – < 102.2.1, unspecified – < 91.13.1 102.2.1

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 thunderbird 1:102.2.1-1 —
Debian 13 thunderbird 1:102.2.1-1 —
Debian 12 thunderbird 1:102.2.1-1 —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 22.04 LTS thunderbird 1:102.2.2+build1-0ubuntu0.22.04.1 USN-5663-1
Ubuntu 20.04 LTS thunderbird 1:102.2.2+build1-0ubuntu0.20.04.1 USN-5663-1
Ubuntu 18.04 LTS thunderbird 1:102.2.2+build1-0ubuntu0.18.04.1 USN-5663-1

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
RHEL 9 thunderbird 102.3.0-3.el9_0 RHSA-2022:6717
RHEL 8 thunderbird 102.3.0-3.el8_6 RHSA-2022:6708
RHEL 7 thunderbird 102.3.0-3.el7_9 RHSA-2022:6710
Show 3 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
RHEL 8.4 EUS thunderbird 102.3.0-3.el8_4 RHSA-2022:6713
RHEL 8.2 EUS thunderbird 102.3.0-3.el8_2 RHSA-2022:6715
RHEL 8.1 E4S thunderbird 102.3.0-3.el8_1 RHSA-2022:6716

AlmaLinux

Errata ↗
ReleasePackageFixed inAdvisory
AlmaLinux 9 thunderbird 102.3.0-3.el9_0.alma ALSA-2022:6717
AlmaLinux 8 thunderbird 102.3.0-3.el8_6.alma ALSA-2022:6708

Rocky Linux

Errata ↗
ReleasePackageFixed inAdvisory
Rocky Linux 8 thunderbird 102.3.0-3.el8_6 RLSA-2022:6708

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP4 MozillaThunderbird 102.2.2-150200.8.82.1 SUSE-SU-2022:3281-1
SLES 15 SP3 MozillaThunderbird 102.2.2-150200.8.82.1 SUSE-SU-2022:3281-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed MozillaThunderbird 102.2.1-1.1 openSUSE-SU-2024:12299-1
openSUSE Leap 15.4 MozillaThunderbird 102.2.2-150200.8.82.1 SUSE-SU-2022:3281-1
openSUSE Leap 15.3 MozillaThunderbird 102.2.2-150200.8.82.1 SUSE-SU-2022:3281-1

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2 thunderbird 102.4.0-1.amzn2.0.1 ALAS2-2022-1900

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 9 thunderbird 102.3.0-3.0.1.el9_0 ELSA-2022-6717
Oracle Linux 8 thunderbird 102.3.0-3.0.1.el8_6 ELSA-2022-6708
Oracle Linux 7 thunderbird 102.3.0-3.0.1.el7_9 ELSA-2022-6710

Advisories 18

References