Lucene search

K
mozillaMozilla FoundationMFSA2007-40
HistoryDec 19, 2007 - 12:00 a.m.

Upgraded Thunderbird 1.5.0.13 missing fix for MFSA 2007-23 — Mozilla

2007-12-1900:00:00
Mozilla Foundation
www.mozilla.org
14

4.3 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

0.228 Low

EPSS

Percentile

96.5%

Mozilla tester Stephen Donner reported that only users who installed Thunderbird 1.5.0.13 using the install package received the fix for MFSA 2007-23. Users who upgraded to Thunderbird 1.5.0.13 from an earlier version using the automatic update mechanism were not protected. If those users browsed the internet using Internet Explorer or another similarly affected program and clicked on a malicious mailto: link the attacker could potentially execute arbitrary code.

CPENameOperatorVersion
thunderbirdlt1.5.0.14

4.3 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

0.228 Low

EPSS

Percentile

96.5%