Mozilla Thunderbird < 1.5 Attachment Extension Spoofing

The remote host is using Mozilla Thunderbird, an email client. The remote version of this software does not display attachments correctly in emails. Using an overly-long filename and specially crafted Content-Type headers, an attacker may be able to leverage this issue to spoof the file extension...

Mozilla Thunderbird attachment spoofing

Filename can be spoofed by using large number of spaces, display icon - with Content-Type header...

[SA15907] Mozilla Thunderbird Attachment Spoofing Vulnerability

TITLE: Mozilla Thunderbird Attachment Spoofing Vulnerability SECUNIA ADVISORY ID: SA15907 VERIFY ADVISORY: http://secunia.com/advisories/15907/ CRITICAL: Less critical IMPACT: Spoofing, System access WHERE: From remote SOFTWARE: Mozilla Thunderbird 1.x http://secunia.com/product/4652/ DESCRIPTION...

Mandrake Linux Security Advisory : mozilla-thunderbird (MDKSA-2005:174)

Updated Mozilla Thunderbird packages fix various vulnerabilities : The run-mozilla.sh script, with debugging enabled, would allow local users to create or overwrite arbitrary files via a symlink attack on temporary files CVE-2005-2353. A bug in the way Thunderbird processes XBM images could be us...

Ubuntu 4.10 / 5.04 : mozilla-thunderbird vulnerabilities (USN-200-1)

A buffer overflow was discovered in the XBM image handler. By tricking an user into opening a specially crafted XBM image, an attacker could exploit this to execute arbitrary code with the user's privileges. CAN-2005-2701 Mats Palmgren discovered a buffer overflow in the Unicode string parser...

Ubuntu 4.10 / 5.04 : mozilla-thunderbird vulnerabilities (USN-157-1)

Vladimir V. Perepelitsa discovered a bug in Thunderbird's handling of anonymous functions during regular expression string replacement. A malicious HTML email could exploit this to capture a random block of client memory. CAN-2005-0989 Georgi Guninski discovered that the types of certain XPInstal...

Mandrake Linux Security Advisory : mozilla-thunderbird (MDKSA-2005:226)

A bug in enigmail, the GPG support extension for Mozilla MailNews and Mozilla Thunderbird was discovered that could lead to the encryption of an email with the wrong public key. This could potentially disclose confidential data to unintended recipients. The updated packages have been patched to...

CVE-2005-3402

The SMTP client in Mozilla Thunderbird 1.0.5 BETA, 1.0.7, and possibly other versions, does not notify users when it cannot establish a secure channel with the server, which allows remote attackers to obtain authentication information without detection via a man-in-the-middle MITM attack that...

CVE-2005-3402

The SMTP client in Mozilla Thunderbird 1.0.5 BETA, 1.0.7, and possibly other versions, does not notify users when it cannot establish a secure channel with the server, which allows remote attackers to obtain authentication information without detection via a man-in-the-middle MITM attack that...

CVE-2005-3402

CVE-2005-3402 affects Mozilla Thunderbird SMTP client (notably 1.0.5 BETA and 1.0.7). The issue is that Thunderbird does not notify users when it cannot establish a secure channel with the SMTP server, enabling a MITM to obtain authentication information by bypassing TLS or downgrading CRAM-MD5 t...

CVE-2005-3402

The SMTP client in Mozilla Thunderbird 1.0.5 BETA, 1.0.7, and possibly other versions, does not notify users when it cannot establish a secure channel with the server, which allows remote attackers to obtain authentication information without detection via a man-in-the-middle MITM attack that...

[SECURITY] [DSA 868-1] New Mozilla Thunderbird packages fix several vulnerabilities

-------------------------------------------------------------------------- Debian Security Advisory DSA 868-1 [email protected] http://www.debian.org/security/ Martin Schulze October 20th, 2005 http://www.debian.org/security/faq -...

[SECURITY] [DSA 868-1] New Mozilla Thunderbird packages fix several vulnerabilities

-------------------------------------------------------------------------- Debian Security Advisory DSA 868-1 [email protected] http://www.debian.org/security/ Martin Schulze October 20th, 2005 http://www.debian.org/security/faq -...

[Full-disclosure] [USN-211-1] Enigmail vulnerability

=========================================================== Ubuntu Security Notice USN-211-1 October 20, 2005 enigmail vulnerability CVE-2005-3256 =========================================================== A security issue affects the following Ubuntu releases: Ubuntu 4.10 Warty Warthog Ubuntu...

Mozilla Thunderbird / Mozilla weak authentication downgrade

If SMTP authentication with CRAM-MD5 or TLS hadshake fails mail agent downgrades to plain text authentication, allowing active man-in-the-middle attacks...

[Full-disclosure] Mozilla Thunderbird SMTP down-negotiation weakness

MOZILLA THUNDERBIRD SMTP DOWN-NEGOTIATION WEAKNESS Thomas Henlich [email protected] SUMMARY Mozilla Thunderbird SMTP down-negotiation behaviour allows a man- in-the-middle MITM attack to bypass TLS initialization and/or downgrade CRAM-MD5 to PLAIN authentication, leading to exposure of...

Mozilla Thunderbird < 1.5 Multiple Vulnerabilities (deprecated)

Binary data 3258.prm...

Fedora Core 3 : thunderbird-1.0.7-1.1.fc3 (2005-962)

An updated thunderbird package that fixes various bugs is now available for Fedora Core 3. This update has been rated as having important security impact by the Fedora Security Response Team. Mozilla Thunderbird is a standalone mail and newsgroup client. A bug was found in the way Thunderbird...

Mozilla Thunderbird < 1.0.7 IDN URL Domain Name Overflow

The remote host is using Mozilla Thunderbird, an email client. The remote version of this software contains various security issues that could allow an attacker to execute arbitrary code on the remote host and to disguise URLs. C Tenable Network Security, Inc. include"compat.inc"; if description...

[SECURITY] [DSA 781-1] New Mozilla Thunderbird packages fix several vulnerabilities

-------------------------------------------------------------------------- Debian Security Advisory DSA 781-1 [email protected] http://www.debian.org/security/ Martin Schulze August 23rd, 2005 http://www.debian.org/security/faq -...