medium5.3
CVE-2017-7829
It is possible to spoof the sender's email address and display an arbitrary sender address to the email recipient.
Impact
It is possible to spoof the sender's email address and display an arbitrary sender address to the email recipient. The real sender's address is not displayed if preceded by a null character in the display string. This vulnerability affects Thunderbird < 52.5.2.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Mozilla | Thunderbird | before 52.5.2 |
| Redhat | Enterprise Linux Aus | Version 7.4 |
| Redhat | Enterprise Linux Desktop | Versions 6.0, 7.0 |
| Redhat | Enterprise Linux Eus | Versions 7.4, 7.5 |
| Redhat | Enterprise Linux Server | Versions 6.0, 7.0 |
| Redhat | Enterprise Linux Workstation | Versions 6.0, 7.0 |
| Debian | Debian Linux | Versions 7.0, 8.0, 9.0 |
| Canonical | Ubuntu Linux | Versions 14.04, 16.04, 17.10 |
Weakness classification
References
- NVD record
- CVE.org record
- http://www.securityfocus.com/bid/102258
- http://www.securitytracker.com/id/1040123
- https://access.redhat.com/errata/RHSA-2018:0061
- https://bugzilla.mozilla.org/show_bug.cgi?id=1423432
- https://lists.debian.org/debian-lts-announce/2017/12/msg00026.html
- https://usn.ubuntu.com/3529-1/
- https://www.debian.org/security/2017/dsa-4075
- https://www.mozilla.org/security/advisories/mfsa2017-30/
- http://www.securityfocus.com/bid/102258
- http://www.securitytracker.com/id/1040123
- https://access.redhat.com/errata/RHSA-2018:0061
- https://bugzilla.mozilla.org/show_bug.cgi?id=1423432
- https://lists.debian.org/debian-lts-announce/2017/12/msg00026.html
- https://usn.ubuntu.com/3529-1/
- https://www.debian.org/security/2017/dsa-4075
- https://www.mozilla.org/security/advisories/mfsa2017-30/