CVE-2022-45414

Name	CVE-2022-45414
Description	If a Thunderbird user quoted from an HTML email, for example by replying to the email, and the email contained either a VIDEO tag with the POSTER attribute or an OBJECT tag with a DATA attribute, a network request to the referenced remote URL was performed, regardless of a configuration to block remote content. An image loaded from the POSTER attribute was shown in the composer window. These issues could have given an attacker additional capabilities when targetting releases that did not yet have a fix for CVE-2022-3033 which was reported around three months ago. This vulnerability affects Thunderbird < 102.5.1.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DSA-5303-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
thunderbird (PTS)	jessie, jessie (lts)	1:68.9.0-1~deb8u2	vulnerable
	stretch (security), stretch (lts), stretch	1:91.10.0-1~deb9u1	vulnerable
	buster (security), buster, buster (lts)	1:115.12.0-1~deb10u1	fixed
	bullseye	1:115.12.0-1~deb11u1	fixed
	bullseye (security)	1:128.5.0esr-1~deb11u1	fixed
	bookworm	1:115.16.0esr-1~deb12u1	fixed
	bookworm (security)	1:128.5.0esr-1~deb12u1	fixed
	sid, trixie	1:128.5.2esr-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin
thunderbird	source	jessie	(unfixed)	end-of-life
thunderbird	source	stretch	(unfixed)	end-of-life
thunderbird	source	bullseye	1:102.6.0-1~deb11u1		DSA-5303-1
thunderbird	source	(unstable)	1:102.5.1-1

Notes

[bullseye] - thunderbird <postponed> (Minor issue, fix along in next ESR update)
[buster] - thunderbird <postponed> (Minor issue)
https://www.mozilla.org/en-US/security/advisories/mfsa2022-50/#CVE-2022-45414