CVE-2023-3417
Publication date 24 July 2023
Last updated 24 July 2024
Ubuntu priority
Thunderbird allowed the Text Direction Override Unicode Character in filenames. An email attachment could be incorrectly shown as being a document file, while in fact it was an executable file. Newer versions of Thunderbird will strip the character and show the correct file extension. This vulnerability affects Thunderbird < 115.0.1 and Thunderbird < 102.13.1.
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| thunderbird | 24.04 LTS noble |
Fixed 1:102.13.0+build1-0ubuntu1
|
| 22.04 LTS jammy |
Fixed 1:102.15.0+build1-0ubuntu0.22.04.1
|
|
| 20.04 LTS focal |
Fixed 1:102.15.0+build1-0ubuntu0.20.04.1
|
|
| 18.04 LTS bionic | Ignored | |
| 16.04 LTS xenial | Ignored | |
| 14.04 LTS trusty | Ignored |
Severity score breakdown
| Parameter | Value |
|---|---|
| Base score |
7.5 · High
|
| Attack vector | Network |
| Attack complexity | Low |
| Privileges required | None |
| User interaction | None |
| Scope | Unchanged |
| Confidentiality | None |
| Integrity impact | High |
| Availability impact | None |
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
References
Related Ubuntu Security Notices (USN)
- USN-6333-1
- Thunderbird vulnerabilities
- 4 September 2023
Other references
- https://www.mozilla.org/en-US/security/advisories/mfsa2023-27/#CVE-2023-3417
- https://www.mozilla.org/en-US/security/advisories/mfsa2023-28/#CVE-2023-3417
- https://www.mozilla.org/security/advisories/mfsa2023-27/
- https://www.mozilla.org/security/advisories/mfsa2023-28/
- https://www.cve.org/CVERecord?id=CVE-2023-3417