CVE-2023-50761

2023-12-2000:00:00

ubuntu.com

s/mime

signature

validation

thunderbird

vulnerability

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

AI Score

6.6

Confidence

High

EPSS

0.001

Percentile

19.4%

JSON

The signature of a digitally signed S/MIME email message may optionally
specify the signature creation date and time. If present, Thunderbird did
not compare the signature creation date with the message date and time, and
displayed a valid signature despite a date or time mismatch. This could be
used to give recipients the impression that a message was sent at a
different date or time. This vulnerability affects Thunderbird < 115.6.

OSVersionArchitecturePackageVersionFilename
ubuntu20.04noarchthunderbird< 1:115.6.0+build2-0ubuntu0.20.04.1UNKNOWN
ubuntu22.04noarchthunderbird< 1:115.6.0+build2-0ubuntu0.22.04.1UNKNOWN
ubuntu23.04noarchthunderbird< 1:115.6.0+build2-0ubuntu0.23.04.1UNKNOWN
ubuntu23.10noarchthunderbird< 1:115.6.0+build2-0ubuntu0.23.10.1UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	20.04	noarch	thunderbird	< 1:115.6.0+build2-0ubuntu0.20.04.1	UNKNOWN
ubuntu	22.04	noarch	thunderbird	< 1:115.6.0+build2-0ubuntu0.22.04.1	UNKNOWN
ubuntu	23.04	noarch	thunderbird	< 1:115.6.0+build2-0ubuntu0.23.04.1	UNKNOWN
ubuntu	23.10	noarch	thunderbird	< 1:115.6.0+build2-0ubuntu0.23.10.1	UNKNOWN