Description
If a Thunderbird user quoted from an HTML email, for example by replying to the email, and the email contained either a VIDEO tag with the POSTER attribute or an OBJECT tag with a DATA attribute, a network request to the referenced remote URL was performed, regardless of a configuration to block remote content. An image loaded from the POSTER attribute was shown in the composer window. These issues could have given an attacker additional capabilities when targetting releases that did not yet have a fix for CVE-2022-3033 which was reported around three months ago. This vulnerability affects Thunderbird < 102.5.1.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Mozilla | Thunderbird | unspecified – < 102.5.1 | 102.5.1 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | thunderbird | 1:102.5.1-1 | — |
| Debian 13 | thunderbird | 1:102.5.1-1 | — |
| Debian 12 | thunderbird | 1:102.5.1-1 | — |
| Debian 11 | thunderbird | 1:102.6.0-1~deb11u1 | DSA-5303-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 22.04 LTS | thunderbird | 1:102.7.1+build2-0ubuntu0.22.04.1 | USN-5824-1 |
| Ubuntu 20.04 LTS | thunderbird | 1:102.7.1+build2-0ubuntu0.20.04.1 | USN-5824-1 |
| Ubuntu 18.04 LTS | thunderbird | 1:102.7.1+build2-0ubuntu0.18.04.1 | USN-5824-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9 | thunderbird | 102.6.0-2.el9_1 | RHSA-2022:9080 |
| RHEL 8 | thunderbird | 102.6.0-2.el8_7 | RHSA-2022:9074 |
| RHEL 7 | thunderbird | 102.6.0-2.el7_9 | RHSA-2022:9079 |
Show 7 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9.0 EUS | thunderbird | 102.6.0-2.el9_0 | RHSA-2022:9081 |
| RHEL 8.6 EUS | thunderbird | 102.6.0-2.el8_6 | RHSA-2022:9078 |
| RHEL 8.4 EUS | thunderbird | 102.6.0-2.el8_4 | RHSA-2022:9075 |
| RHEL 8.2 TUS | thunderbird | 102.6.0-2.el8_2 | RHSA-2022:9076 |
| RHEL 8.2 E4S | thunderbird | 102.6.0-2.el8_2 | RHSA-2022:9076 |
| RHEL 8.2 AUS | thunderbird | 102.6.0-2.el8_2 | RHSA-2022:9076 |
| RHEL 8.1 E4S | thunderbird | 102.6.0-2.el8_1 | RHSA-2022:9077 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 9 | thunderbird | 102.6.0-2.el9_1.alma | ALSA-2022:9080 |
| AlmaLinux 8 | thunderbird | 102.6.0-2.el8_7.alma | ALSA-2022:9074 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP4 | MozillaThunderbird | 102.5.1-150200.8.93.1 | SUSE-SU-2022:4334-1 |
| SLES 15 SP3 | MozillaThunderbird | 102.5.1-150200.8.93.1 | SUSE-SU-2022:4334-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | MozillaThunderbird | 102.5.1-1.1 | openSUSE-SU-2024:12544-1 |
| openSUSE Leap 15.4 | MozillaThunderbird | 102.5.1-150200.8.93.1 | SUSE-SU-2022:4334-1 |
| openSUSE Leap 15.3 | MozillaThunderbird | 102.5.1-150200.8.93.1 | SUSE-SU-2022:4334-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2 | thunderbird | 102.7.1-1.amzn2.0.1 | ALAS2-2023-1951 |
Advisories 17
- ALSA-2022:9080 Important: thunderbird security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2022:9074 Important: thunderbird security update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2022:9079 Red Hat Security Advisory: thunderbird security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- USN-5824-1 thunderbird vulnerabilities Ubuntu Security Notices (USN) · Apr 27, 2026
- DSA-5303-1 thunderbird - security update Debian Security (DSA / DLA) · Mar 9, 2026
- SUSE-SU-2022:4334-1 Security update for MozillaThunderbird SUSE / openSUSE Security Updates · Feb 4, 2026
- RHSA-2022:9081 Red Hat Security Advisory: thunderbird security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- RHSA-2022:9080 Red Hat Security Advisory: thunderbird security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- RHSA-2022:9078 Red Hat Security Advisory: thunderbird security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- RHSA-2022:9077 Red Hat Security Advisory: thunderbird security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- RHSA-2022:9075 Red Hat Security Advisory: thunderbird security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- RHSA-2022:9076 Red Hat Security Advisory: thunderbird security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- RHSA-2022:9074 Red Hat Security Advisory: thunderbird security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- openSUSE-SU-2024:12544-1 MozillaThunderbird-102.5.1-1.1 on GA media SUSE / openSUSE Security Updates · May 7, 2025
- ALAS2-2023-1951 Important: thunderbird security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Jan 30, 2025
- WID-SEC-2023-0561 Xerox FreeFlow Print Server: Mehrere Schwachstellen BSI CERT-Bund (WID) · May 18, 2023
- WID-SEC-2022-2203 Mozilla Thunderbird: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen BSI CERT-Bund (WID) · Feb 22, 2023