MediumFix available
firefox-esr, thunderbird — security advisory
Use tables inside of an iframe, an attacker could have caused iframe contents to be rendered outside the boundaries of the iframe, resulting in potential user confusion or spoofing attacks. This vulnerability affects Firefox ESR < 102.5, Thunderbird < 102.5, and Firefox < 107.
- Products
- firefox-esr, thunderbird
- Affected versions
- Not specified
- Fixed versions
- 102.5.0esr-1, 1:102.5.0-1
- CVEs
- CVE-2022-45420
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 30 Oct 2026, 15:32 UTC · Revision 1
Source evidence
Use tables inside of an iframe, an attacker could have caused iframe contents to be rendered outside the boundaries of the iframe, resulting in potential user confusion or spoofing attacks. This vulnerability affects Firefox ESR < 102.5, Thunderbird < 102.5, and Firefox < 107.
osv:DEBIAN-CVE-2022-45420
firefox-esr
Fixed versions: 102.5.0esr-1
firefox-esr
Fixed versions: 102.5.0esr-1
firefox-esr
Fixed versions: 102.5.0esr-1
thunderbird
Fixed versions: 1:102.5.0-1
thunderbird
Fixed versions: 1:102.5.0-1
thunderbird
Fixed versions: 1:102.5.0-1
Complete source record
{
"id": "cae08c499c3875ff9699b66bb19b2c3fe9c6387f7eec33f05bbec9256f48a235",
"url": "https://osv.dev/vulnerability/DEBIAN-CVE-2022-45420",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "DEBIAN-CVE-2022-45420",
"summary": "Use tables inside of an iframe, an attacker could have caused iframe contents to be rendered outside the boundaries of the iframe, resulting in potential user confusion or spoofing attacks. This vulnerability affects Firefox ESR < 102.5, Thunderbird < 102.5, and Firefox < 107.",
"evidence": "osv:DEBIAN-CVE-2022-45420",
"products": [
{
"name": {
"value": "firefox-esr",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "102.5.0esr-1",
"evidence": "/affected/0/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "firefox-esr",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "102.5.0esr-1",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "firefox-esr",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "102.5.0esr-1",
"evidence": "/affected/2/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "thunderbird",
"evidence": "/affected/3/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1:102.5.0-1",
"evidence": "/affected/3/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "thunderbird",
"evidence": "/affected/4/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1:102.5.0-1",
"evidence": "/affected/4/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "thunderbird",
"evidence": "/affected/5/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1:102.5.0-1",
"evidence": "/affected/5/ranges"
}
],
"affected_versions": []
}
],
"severity": "medium",
"structured": {
"id": "DEBIAN-CVE-2022-45420",
"aliases": [
"DEBIAN-CVE-2022-45420"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "102.5.0esr-1"
}
]
}
],
"package": {
"name": "firefox-esr",
"purl": "pkg:deb/debian/firefox-esr?arch=source&distro=bookworm",
"ecosystem": "Debian:12"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2022-45420.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "102.5.0esr-1"
}
]
}
],
"package": {
"name": "firefox-esr",
"purl": "pkg:deb/debian/firefox-esr?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2022-45420.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "102.5.0esr-1"
}
]
}
],
"package": {
"name": "firefox-esr",
"purl": "pkg:deb/debian/firefox-esr?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2022-45420.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1:102.5.0-1"
}
]
}
],
"package": {
"name": "thunderbird",
"purl": "pkg:deb/debian/thunderbird?arch=source&distro=bookworm",
"ecosystem": "Debian:12"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2022-45420.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1:102.5.0-1"
}
]
}
],
"package": {
"name": "thunderbird",
"purl": "pkg:deb/debian/thunderbird?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2022-45420.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1:102.5.0-1"
}
]
}
],
"package": {
"name": "thunderbird",
"purl": "pkg:deb/debian/thunderbird?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2022-45420.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
}
],
"modified": "2026-10-15T08:03:06.297102013Z",
"provider": "osv",
"upstream": [
"CVE-2022-45420"
],
"references": [
"https://security-tracker.debian.org/tracker/CVE-2022-45420"
]
},
"related_cves": [
{
"value": "CVE-2022-45420",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 325172,
"published_at": "2022-12-22T20:15:45.203+00:00"
}