high7.5
CVE-2023-3417
Thunderbird allowed the Text Direction Override Unicode Character in filenames.
Impact
Thunderbird allowed the Text Direction Override Unicode Character in filenames. An email attachment could be incorrectly shown as being a document file, while in fact it was an executable file. Newer versions of Thunderbird will strip the character and show the correct file extension. This vulnerability affects Thunderbird < 115.0.1 and Thunderbird < 102.13.1.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Mozilla | Thunderbird | before 102.13.1 from 115.0 before 115.0.1 |
| Debian | Debian Linux | Versions 10.0, 11.0, 12.0 |
References
- NVD record
- CVE.org record
- https://bugzilla.mozilla.org/show_bug.cgi?id=1835582
- https://lists.debian.org/debian-lts-announce/2023/07/msg00032.html
- https://www.debian.org/security/2023/dsa-5463
- https://www.mozilla.org/security/advisories/mfsa2023-27/
- https://www.mozilla.org/security/advisories/mfsa2023-28/
- https://bugzilla.mozilla.org/show_bug.cgi?id=1835582
- https://lists.debian.org/debian-lts-announce/2023/07/msg00032.html
- https://www.debian.org/security/2023/dsa-5463
- https://www.mozilla.org/security/advisories/mfsa2023-27/
- https://www.mozilla.org/security/advisories/mfsa2023-28/