CVE catalog

CVE-2022-3032

thunderbird: CVE-2022-3032

[CVE catalog]

Severity
Medium · CVSS 6.1CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Published
Source
[NVD] · [CVE record]
EPSS
0.71% · Oct 22, 2026

When receiving an HTML email that contained an <code>iframe</code> element, which used a <code>srcdoc</code> attribute to define the inner HTML document, remote objects specified in the nested document, for example images or videos, were not blocked. Rather, the network was accessed, the objects were loaded and displayed. This vulnerability affects Thunderbird < 102.2.1 and Thunderbird < 91.13.1.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianthunderbirdsid1:153.5.1esr-1fixed
Debianthunderbirdforky1:153.5.0esr-1fixed
Debianthunderbirdtrixie1:140.12.0esr-1~deb13u1fixed
Debianthunderbirdtrixie-security1:140.17.0esr-1~deb13u1fixed
Debianthunderbirdbookworm1:140.12.0esr-1~deb12u1fixed
Debianthunderbirdbookworm-security1:140.17.0esr-1~deb12u1fixed
Ubuntuthunderbird18.041:52.4.0+build1-0ubuntu2vulnerable
Ubuntuthunderbird18.041:52.6.0+build1-0ubuntu1vulnerable
Ubuntuthunderbird18.041:52.7.0+build1-0ubuntu1vulnerable
Ubuntuthunderbird18.041:52.8.0+build1-0ubuntu0.18.04.1vulnerable
Ubuntuthunderbird18.041:52.9.1+build3-0ubuntu0.18.04.1vulnerable
Ubuntuthunderbird18.041:60.2.1+build1-0ubuntu0.18.04.2vulnerable
Ubuntuthunderbird18.041:60.4.0+build2-0ubuntu0.18.04.1vulnerable
Ubuntuthunderbird18.041:60.5.1+build2-0ubuntu0.18.04.1vulnerable
Ubuntuthunderbird18.041:60.6.1+build2-0ubuntu0.18.04.1vulnerable
Ubuntuthunderbird18.041:60.7.0+build1-0ubuntu0.18.04.1vulnerable
Ubuntuthunderbird18.041:60.7.1+build1-0ubuntu0.18.04.1vulnerable
Ubuntuthunderbird18.041:60.7.2+build2-0ubuntu0.18.04.1vulnerable
Ubuntuthunderbird18.041:60.8.0+build1-0ubuntu0.18.04.1vulnerable
Ubuntuthunderbird18.041:60.9.0+build1-0ubuntu0.18.04.1vulnerable
Ubuntuthunderbird18.041:68.2.1+build1-0ubuntu0.18.04.1vulnerable
Ubuntuthunderbird18.041:68.2.2+build1-0ubuntu0.18.04.1vulnerable
Ubuntuthunderbird18.041:68.4.1+build1-0ubuntu0.18.04.1vulnerable
Ubuntuthunderbird18.041:68.7.0+build1-0ubuntu0.18.04.1vulnerable
Ubuntuthunderbird18.041:68.8.0+build2-0ubuntu0.18.04.2vulnerable
Ubuntuthunderbird18.041:68.10.0+build1-0ubuntu0.18.04.1vulnerable
Ubuntuthunderbird18.041:78.8.1+build1-0ubuntu0.18.04.1vulnerable
Ubuntuthunderbird18.041:78.11.0+build1-0ubuntu0.18.04.2vulnerable
Ubuntuthunderbird18.041:78.13.0+build1-0ubuntu0.18.04.1vulnerable
Ubuntuthunderbird18.041:78.14.0+build1-0ubuntu0.18.04.1vulnerable
Ubuntuthunderbird18.041:78.14.0+build1-0ubuntu0.18.04.2vulnerable
Ubuntuthunderbird18.041:91.5.0+build1-0ubuntu0.18.04.1vulnerable
Ubuntuthunderbird18.041:91.7.0+build2-0ubuntu0.18.04.1vulnerable
Ubuntuthunderbird18.041:91.8.1+build1-0ubuntu0.18.04.1vulnerable
Ubuntuthunderbird18.041:91.9.1+build1-0ubuntu0.18.04.1vulnerable
Ubuntuthunderbird18.041:91.11.0+build2-0ubuntu0.18.04.1vulnerable
Ubuntuthunderbird18.041:102.2.2+build1-0ubuntu0.18.04.1fixed
Ubuntuthunderbird20.041:68.1.2+build1-0ubuntu1vulnerable
Ubuntuthunderbird20.041:68.1.2+build1-0ubuntu2vulnerable
Ubuntuthunderbird20.041:68.2.1+build1-0ubuntu1vulnerable
Ubuntuthunderbird20.041:68.2.2+build1-0ubuntu1vulnerable
Ubuntuthunderbird20.041:68.3.0+build2-0ubuntu1vulnerable
Ubuntuthunderbird20.041:68.3.1+build1-0ubuntu2vulnerable
Ubuntuthunderbird20.041:68.4.1+build1-0ubuntu1vulnerable
Ubuntuthunderbird20.041:68.4.2+build2-0ubuntu1vulnerable
Ubuntuthunderbird20.041:68.5.0+build1-0ubuntu1vulnerable
Ubuntuthunderbird20.041:68.6.0+build2-0ubuntu1vulnerable
Ubuntuthunderbird20.041:68.7.0+build1-0ubuntu1vulnerable
Ubuntuthunderbird20.041:68.7.0+build1-0ubuntu2vulnerable
Ubuntuthunderbird20.041:68.8.0+build2-0ubuntu0.20.04.2vulnerable
Ubuntuthunderbird20.041:68.10.0+build1-0ubuntu0.20.04.1vulnerable
Ubuntuthunderbird20.041:78.7.1+build1-0ubuntu0.20.04.1vulnerable
Ubuntuthunderbird20.041:78.8.1+build1-0ubuntu0.20.04.1vulnerable
Ubuntuthunderbird20.041:78.11.0+build1-0ubuntu0.20.04.2vulnerable
Ubuntuthunderbird20.041:78.13.0+build1-0ubuntu0.20.04.2vulnerable
Ubuntuthunderbird20.041:78.14.0+build1-0ubuntu0.20.04.1vulnerable
Ubuntuthunderbird20.041:78.14.0+build1-0ubuntu0.20.04.2vulnerable
Ubuntuthunderbird20.041:91.5.0+build1-0ubuntu0.20.04.1vulnerable
Ubuntuthunderbird20.041:91.7.0+build2-0ubuntu0.20.04.1vulnerable
Ubuntuthunderbird20.041:91.8.1+build1-0ubuntu0.20.04.1vulnerable
Ubuntuthunderbird20.041:91.9.1+build1-0ubuntu0.20.04.1vulnerable
Ubuntuthunderbird20.041:91.11.0+build2-0ubuntu0.20.04.1vulnerable
Ubuntuthunderbird20.041:102.2.2+build1-0ubuntu0.20.04.1fixed
Ubuntuthunderbird22.041:91.1.2+build1-0ubuntu1vulnerable
Ubuntuthunderbird22.041:91.3.0+build2-0ubuntu1vulnerable
Ubuntuthunderbird22.041:91.3.1+build1-0ubuntu1vulnerable
Ubuntuthunderbird22.041:91.3.2+build1-0ubuntu1vulnerable
Ubuntuthunderbird22.041:91.4.0+build1.1-0ubuntu1vulnerable
Ubuntuthunderbird22.041:91.4.0+build2-0ubuntu1vulnerable
Ubuntuthunderbird22.041:91.5.0+build1-0ubuntu1vulnerable
Ubuntuthunderbird22.041:91.5.1+build1-0ubuntu1vulnerable
Ubuntuthunderbird22.041:91.6.1+build1-0ubuntu1vulnerable
Ubuntuthunderbird22.041:91.7.0+build1-0ubuntu1vulnerable
Ubuntuthunderbird22.041:91.7.0+build2-0ubuntu1vulnerable
Ubuntuthunderbird22.041:91.8.0+build2-0ubuntu1vulnerable
Ubuntuthunderbird22.041:91.9.1+build1-0ubuntu0.22.04.1vulnerable
Ubuntuthunderbird22.041:91.11.0+build2-0ubuntu0.22.04.1vulnerable
Ubuntuthunderbird22.041:102.2.2+build1-0ubuntu0.22.04.1fixed
OpensuseMozillaThunderbirdtumbleweed102.2.1-1.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianthunderbirdsourcesid1:102.2.1-1not yet assignedNot reportedNot reported
Debianthunderbirdsourceforky1:102.2.1-1not yet assignedNot reportedNot reported
Debianthunderbirdsourcetrixie1:102.2.1-1not yet assignedNot reportedNot reported
Debianthunderbirdsourcebookworm1:102.2.1-1not yet assignedNot reportedNot reported
Ubuntuthunderbirddeb18.041:102.2.2+build1-0ubuntu0.18.04.1Not reportedUBUNTU-CVE-2022-3032Not reported
Ubuntuthunderbirddeb20.041:102.2.2+build1-0ubuntu0.20.04.1Not reportedUBUNTU-CVE-2022-3032Not reported
Ubuntuthunderbirddeb22.041:102.2.2+build1-0ubuntu0.22.04.1Not reportedUBUNTU-CVE-2022-3032Not reported
OpensuseMozillaThunderbirdrpmtumbleweed102.2.1-1.1Not reportedOPENSUSE-SU-2024:12299-1Not reported

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

  • [thunderbird]Unknown
    Details (4)
    • 1:140.12.0esr-1~deb12u1 · amd64 · bookworm

      Fixed · Fixed: 1:102.2.1-1

      dsa · thunderbird · debian · bookworm

    • 1:140.12.0esr-1~deb12u1 · arm64 · bookworm

      Fixed · Fixed: 1:102.2.1-1

      dsa · thunderbird · debian · bookworm

    • 1:140.14.0esr-1~deb12u1 · amd64 · bookworm-security

      Fixed · Fixed: 1:102.2.1-1

      dsa · thunderbird · debian · bookworm

    • 1:140.14.0esr-1~deb12u1 · arm64 · bookworm-security

      Fixed · Fixed: 1:102.2.1-1

      dsa · thunderbird · debian · bookworm

  • Source package: [thunderbird]

    Details (4)
    • 1:140.12.0esr-1~deb12u1 · all · bookworm

      Fixed · Fixed: 1:102.2.1-1

      dsa · thunderbird · debian · bookworm

    • 1:140.12.0esr-1~deb12u1 · all · bookworm

      Fixed · Fixed: 1:102.2.1-1

      dsa · thunderbird · debian · bookworm

    • 1:140.14.0esr-1~deb12u1 · all · bookworm-security

      Fixed · Fixed: 1:102.2.1-1

      dsa · thunderbird · debian · bookworm

    • 1:140.14.0esr-1~deb12u1 · all · bookworm-security

      Fixed · Fixed: 1:102.2.1-1

      dsa · thunderbird · debian · bookworm

  • Source package: [thunderbird]

    Details (4)
    • 1:140.12.0esr-1~deb12u1 · all · bookworm

      Fixed · Fixed: 1:102.2.1-1

      dsa · thunderbird · debian · bookworm

    • 1:140.12.0esr-1~deb12u1 · all · bookworm

      Fixed · Fixed: 1:102.2.1-1

      dsa · thunderbird · debian · bookworm

    • 1:140.14.0esr-1~deb12u1 · all · bookworm-security

      Fixed · Fixed: 1:102.2.1-1

      dsa · thunderbird · debian · bookworm

    • 1:140.14.0esr-1~deb12u1 · all · bookworm-security

      Fixed · Fixed: 1:102.2.1-1

      dsa · thunderbird · debian · bookworm

  • Source package: [thunderbird]

    Details (4)
    • 1:140.12.0esr-1~deb12u1 · all · bookworm

      Fixed · Fixed: 1:102.2.1-1

      dsa · thunderbird · debian · bookworm

    • 1:140.12.0esr-1~deb12u1 · all · bookworm

      Fixed · Fixed: 1:102.2.1-1

      dsa · thunderbird · debian · bookworm

    • 1:140.14.0esr-1~deb12u1 · all · bookworm-security

      Fixed · Fixed: 1:102.2.1-1

      dsa · thunderbird · debian · bookworm

    • 1:140.14.0esr-1~deb12u1 · all · bookworm-security

      Fixed · Fixed: 1:102.2.1-1

      dsa · thunderbird · debian · bookworm

  • Source package: [thunderbird]

    Details (4)
    • 1:140.12.0esr-1~deb12u1 · all · bookworm

      Fixed · Fixed: 1:102.2.1-1

      dsa · thunderbird · debian · bookworm

    • 1:140.12.0esr-1~deb12u1 · all · bookworm

      Fixed · Fixed: 1:102.2.1-1

      dsa · thunderbird · debian · bookworm

    • 1:140.14.0esr-1~deb12u1 · all · bookworm-security

      Fixed · Fixed: 1:102.2.1-1

      dsa · thunderbird · debian · bookworm

    • 1:140.14.0esr-1~deb12u1 · all · bookworm-security

      Fixed · Fixed: 1:102.2.1-1

      dsa · thunderbird · debian · bookworm

  • Source package: [thunderbird]

    Details (4)
    • 1:140.12.0esr-1~deb12u1 · all · bookworm

      Fixed · Fixed: 1:102.2.1-1

      dsa · thunderbird · debian · bookworm

    • 1:140.12.0esr-1~deb12u1 · all · bookworm

      Fixed · Fixed: 1:102.2.1-1

      dsa · thunderbird · debian · bookworm

    • 1:140.14.0esr-1~deb12u1 · all · bookworm-security

      Fixed · Fixed: 1:102.2.1-1

      dsa · thunderbird · debian · bookworm

    • 1:140.14.0esr-1~deb12u1 · all · bookworm-security

      Fixed · Fixed: 1:102.2.1-1

      dsa · thunderbird · debian · bookworm

  • Source package: [thunderbird]

    Details (4)
    • 1:140.12.0esr-1~deb12u1 · all · bookworm

      Fixed · Fixed: 1:102.2.1-1

      dsa · thunderbird · debian · bookworm

    • 1:140.12.0esr-1~deb12u1 · all · bookworm

      Fixed · Fixed: 1:102.2.1-1

      dsa · thunderbird · debian · bookworm

    • 1:140.14.0esr-1~deb12u1 · all · bookworm-security

      Fixed · Fixed: 1:102.2.1-1

      dsa · thunderbird · debian · bookworm

    • 1:140.14.0esr-1~deb12u1 · all · bookworm-security

      Fixed · Fixed: 1:102.2.1-1

      dsa · thunderbird · debian · bookworm

  • Source package: [thunderbird]

    Details (4)
    • 1:140.12.0esr-1~deb12u1 · all · bookworm

      Fixed · Fixed: 1:102.2.1-1

      dsa · thunderbird · debian · bookworm

    • 1:140.12.0esr-1~deb12u1 · all · bookworm

      Fixed · Fixed: 1:102.2.1-1

      dsa · thunderbird · debian · bookworm

    • 1:140.14.0esr-1~deb12u1 · all · bookworm-security

      Fixed · Fixed: 1:102.2.1-1

      dsa · thunderbird · debian · bookworm

    • 1:140.14.0esr-1~deb12u1 · all · bookworm-security

      Fixed · Fixed: 1:102.2.1-1

      dsa · thunderbird · debian · bookworm

  • Source package: [thunderbird]

    Details (4)
    • 1:140.12.0esr-1~deb12u1 · all · bookworm

      Fixed · Fixed: 1:102.2.1-1

      dsa · thunderbird · debian · bookworm

    • 1:140.12.0esr-1~deb12u1 · all · bookworm

      Fixed · Fixed: 1:102.2.1-1

      dsa · thunderbird · debian · bookworm

    • 1:140.14.0esr-1~deb12u1 · all · bookworm-security

      Fixed · Fixed: 1:102.2.1-1

      dsa · thunderbird · debian · bookworm

    • 1:140.14.0esr-1~deb12u1 · all · bookworm-security

      Fixed · Fixed: 1:102.2.1-1

      dsa · thunderbird · debian · bookworm

  • Source package: [thunderbird]

    Details (4)
    • 1:140.12.0esr-1~deb12u1 · all · bookworm

      Fixed · Fixed: 1:102.2.1-1

      dsa · thunderbird · debian · bookworm

    • 1:140.12.0esr-1~deb12u1 · all · bookworm

      Fixed · Fixed: 1:102.2.1-1

      dsa · thunderbird · debian · bookworm

    • 1:140.14.0esr-1~deb12u1 · all · bookworm-security

      Fixed · Fixed: 1:102.2.1-1

      dsa · thunderbird · debian · bookworm

    • 1:140.14.0esr-1~deb12u1 · all · bookworm-security

      Fixed · Fixed: 1:102.2.1-1

      dsa · thunderbird · debian · bookworm

  • Source package: [thunderbird]

    Details (4)
    • 1:140.12.0esr-1~deb12u1 · all · bookworm

      Fixed · Fixed: 1:102.2.1-1

      dsa · thunderbird · debian · bookworm

    • 1:140.12.0esr-1~deb12u1 · all · bookworm

      Fixed · Fixed: 1:102.2.1-1

      dsa · thunderbird · debian · bookworm

    • 1:140.14.0esr-1~deb12u1 · all · bookworm-security

      Fixed · Fixed: 1:102.2.1-1

      dsa · thunderbird · debian · bookworm

    • 1:140.14.0esr-1~deb12u1 · all · bookworm-security

      Fixed · Fixed: 1:102.2.1-1

      dsa · thunderbird · debian · bookworm

  • Source package: [thunderbird]

    Details (4)
    • 1:140.12.0esr-1~deb12u1 · all · bookworm

      Fixed · Fixed: 1:102.2.1-1

      dsa · thunderbird · debian · bookworm

    • 1:140.12.0esr-1~deb12u1 · all · bookworm

      Fixed · Fixed: 1:102.2.1-1

      dsa · thunderbird · debian · bookworm

    • 1:140.14.0esr-1~deb12u1 · all · bookworm-security

      Fixed · Fixed: 1:102.2.1-1

      dsa · thunderbird · debian · bookworm

    • 1:140.14.0esr-1~deb12u1 · all · bookworm-security

      Fixed · Fixed: 1:102.2.1-1

      dsa · thunderbird · debian · bookworm

  • Source package: [thunderbird]

    Details (4)
    • 1:140.12.0esr-1~deb12u1 · all · bookworm

      Fixed · Fixed: 1:102.2.1-1

      dsa · thunderbird · debian · bookworm

    • 1:140.12.0esr-1~deb12u1 · all · bookworm

      Fixed · Fixed: 1:102.2.1-1

      dsa · thunderbird · debian · bookworm

    • 1:140.14.0esr-1~deb12u1 · all · bookworm-security

      Fixed · Fixed: 1:102.2.1-1

      dsa · thunderbird · debian · bookworm

    • 1:140.14.0esr-1~deb12u1 · all · bookworm-security

      Fixed · Fixed: 1:102.2.1-1

      dsa · thunderbird · debian · bookworm

  • Source package: [thunderbird]

    Details (4)
    • 1:140.12.0esr-1~deb12u1 · all · bookworm

      Fixed · Fixed: 1:102.2.1-1

      dsa · thunderbird · debian · bookworm

    • 1:140.12.0esr-1~deb12u1 · all · bookworm

      Fixed · Fixed: 1:102.2.1-1

      dsa · thunderbird · debian · bookworm

    • 1:140.14.0esr-1~deb12u1 · all · bookworm-security

      Fixed · Fixed: 1:102.2.1-1

      dsa · thunderbird · debian · bookworm

    • 1:140.14.0esr-1~deb12u1 · all · bookworm-security

      Fixed · Fixed: 1:102.2.1-1

      dsa · thunderbird · debian · bookworm

  • Source package: [thunderbird]

    Details (4)
    • 1:140.12.0esr-1~deb12u1 · all · bookworm

      Fixed · Fixed: 1:102.2.1-1

      dsa · thunderbird · debian · bookworm

    • 1:140.12.0esr-1~deb12u1 · all · bookworm

      Fixed · Fixed: 1:102.2.1-1

      dsa · thunderbird · debian · bookworm

    • 1:140.14.0esr-1~deb12u1 · all · bookworm-security

      Fixed · Fixed: 1:102.2.1-1

      dsa · thunderbird · debian · bookworm

    • 1:140.14.0esr-1~deb12u1 · all · bookworm-security

      Fixed · Fixed: 1:102.2.1-1

      dsa · thunderbird · debian · bookworm

  • Source package: [thunderbird]

    Details (4)
    • 1:140.12.0esr-1~deb12u1 · all · bookworm

      Fixed · Fixed: 1:102.2.1-1

      dsa · thunderbird · debian · bookworm

    • 1:140.12.0esr-1~deb12u1 · all · bookworm

      Fixed · Fixed: 1:102.2.1-1

      dsa · thunderbird · debian · bookworm

    • 1:140.14.0esr-1~deb12u1 · all · bookworm-security

      Fixed · Fixed: 1:102.2.1-1

      dsa · thunderbird · debian · bookworm

    • 1:140.14.0esr-1~deb12u1 · all · bookworm-security

      Fixed · Fixed: 1:102.2.1-1

      dsa · thunderbird · debian · bookworm

  • Source package: [thunderbird]

    Details (4)
    • 1:140.12.0esr-1~deb12u1 · all · bookworm

      Fixed · Fixed: 1:102.2.1-1

      dsa · thunderbird · debian · bookworm

    • 1:140.12.0esr-1~deb12u1 · all · bookworm

      Fixed · Fixed: 1:102.2.1-1

      dsa · thunderbird · debian · bookworm

    • 1:140.14.0esr-1~deb12u1 · all · bookworm-security

      Fixed · Fixed: 1:102.2.1-1

      dsa · thunderbird · debian · bookworm

    • 1:140.14.0esr-1~deb12u1 · all · bookworm-security

      Fixed · Fixed: 1:102.2.1-1

      dsa · thunderbird · debian · bookworm

  • Source package: [thunderbird]

    Details (4)
    • 1:140.12.0esr-1~deb12u1 · all · bookworm

      Fixed · Fixed: 1:102.2.1-1

      dsa · thunderbird · debian · bookworm

    • 1:140.12.0esr-1~deb12u1 · all · bookworm

      Fixed · Fixed: 1:102.2.1-1

      dsa · thunderbird · debian · bookworm

    • 1:140.14.0esr-1~deb12u1 · all · bookworm-security

      Fixed · Fixed: 1:102.2.1-1

      dsa · thunderbird · debian · bookworm

    • 1:140.14.0esr-1~deb12u1 · all · bookworm-security

      Fixed · Fixed: 1:102.2.1-1

      dsa · thunderbird · debian · bookworm

  • Source package: [thunderbird]

    Details (4)
    • 1:140.12.0esr-1~deb12u1 · all · bookworm

      Fixed · Fixed: 1:102.2.1-1

      dsa · thunderbird · debian · bookworm

    • 1:140.12.0esr-1~deb12u1 · all · bookworm

      Fixed · Fixed: 1:102.2.1-1

      dsa · thunderbird · debian · bookworm

    • 1:140.14.0esr-1~deb12u1 · all · bookworm-security

      Fixed · Fixed: 1:102.2.1-1

      dsa · thunderbird · debian · bookworm

    • 1:140.14.0esr-1~deb12u1 · all · bookworm-security

      Fixed · Fixed: 1:102.2.1-1

      dsa · thunderbird · debian · bookworm

  • Source package: [thunderbird]

    Details (4)
    • 1:140.12.0esr-1~deb12u1 · all · bookworm

      Fixed · Fixed: 1:102.2.1-1

      dsa · thunderbird · debian · bookworm

    • 1:140.12.0esr-1~deb12u1 · all · bookworm

      Fixed · Fixed: 1:102.2.1-1

      dsa · thunderbird · debian · bookworm

    • 1:140.14.0esr-1~deb12u1 · all · bookworm-security

      Fixed · Fixed: 1:102.2.1-1

      dsa · thunderbird · debian · bookworm

    • 1:140.14.0esr-1~deb12u1 · all · bookworm-security

      Fixed · Fixed: 1:102.2.1-1

      dsa · thunderbird · debian · bookworm

Next results

Observed:

References