CVE-2022-3155
When saving or opening an email attachment on macOS, Thunderbird did not set attribute com.apple.quarantine on the received file. If the received file was an application and the user attempted to open it, then the application was started immediately without asking the user to confirm. This vulnerability affects Thunderbird < 102.3.
- Affected products
- Alt Linux, Astra Linux, Suse, Thunderbird
- Mozilla Thunderbird
- < 102.3
- Fix
- Available
- CVSS 3.1
- 7.8 HIGH
- EPSS
- 0.2% (12th percentile)
- Weakness
- CWE-276
- NVD status
- Modified
- Published
- 2022-12-22
CVE-2022-3155 at NVD
No indexed exploits for CVE-2022-3155 yet
Our index is partial: it proves presence, never absence
No exploit for CVE-2022-3155 has been indexed yet. Our index is built from live traffic and upstream syncs, so this page can only say what it knows — not that no exploit exists.