medium4.3
CVE-2018-5170
It is possible to spoof the filename of an attachment and display an arbitrary attachment name.
Impact
It is possible to spoof the filename of an attachment and display an arbitrary attachment name. This could lead to a user opening a remote attachment which is a different file type than expected. This vulnerability affects Thunderbird ESR < 52.8 and Thunderbird < 52.8.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Redhat | Enterprise Linux Desktop | Versions 6.0, 7.0 |
| Redhat | Enterprise Linux Server | Versions 6.0, 7.0 |
| Redhat | Enterprise Linux Server Aus | Version 7.6 |
| Redhat | Enterprise Linux Server Eus | Versions 7.5, 7.6 |
| Redhat | Enterprise Linux Server Tus | Version 7.6 |
| Redhat | Enterprise Linux Workstation | Versions 6.0, 7.0 |
| Mozilla | Thunderbird | before 52.8.0 |
| Mozilla | Thunderbird Esr | before 52.8.0 |
| Debian | Debian Linux | Versions 7.0, 8.0, 9.0 |
| Canonical | Ubuntu Linux | Versions 14.04, 16.04, 17.10, 18.04 |
Weakness classification
References
- NVD record
- CVE.org record
- http://www.securitytracker.com/id/1040946
- https://access.redhat.com/errata/RHSA-2018:1725
- https://access.redhat.com/errata/RHSA-2018:1726
- https://bugzilla.mozilla.org/show_bug.cgi?id=1411732
- https://lists.debian.org/debian-lts-announce/2018/05/msg00013.html
- https://security.gentoo.org/glsa/201811-13
- https://usn.ubuntu.com/3660-1/
- https://www.debian.org/security/2018/dsa-4209
- https://www.mozilla.org/security/advisories/mfsa2018-13/
- http://www.securitytracker.com/id/1040946
- https://access.redhat.com/errata/RHSA-2018:1725
- https://access.redhat.com/errata/RHSA-2018:1726
- https://bugzilla.mozilla.org/show_bug.cgi?id=1411732
- https://lists.debian.org/debian-lts-announce/2018/05/msg00013.html
- https://security.gentoo.org/glsa/201811-13
- https://usn.ubuntu.com/3660-1/
- https://www.debian.org/security/2018/dsa-4209
- https://www.mozilla.org/security/advisories/mfsa2018-13/