Overview
Mozilla Thunderbird contains a heap-based buffer overflow which may allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable system.
Description
Mozilla Thunderbird is an open source, cross-platform email and news client. Thunderbird uses Multipurpose Internet Message Extensions (MIME) which extends support in Thunderbird for multi-part message bodies, non-text attachments, and non-ASCII character sets. A vulnerability exists in the way Mozilla Thunderbird parses external-body MIME type in an electronic mail which may result in a heap-based buffer overflow. According to Mozilla Foundation Security Advisory 2008-12: The vulnerability is caused by allocating a buffer that can be three bytes too small in certain cases when viewing an email message with an external MIME body. |
Impact
A remote, unauthenticated attacker may be able to execute arbitrary code on a system running a vulnerable version of Mozilla Thunderbird. |
Solution
Apply Update
|
Apply Workaround
|
Vendor Information
CVSS Metrics
| Group | Score | Vector |
|---|---|---|
| Base | ||
| Temporal | ||
| Environmental |
References
Acknowledgements
This vulnerability was reported to VeriSign iDefense by regenrecht.
This document was written by Joseph W. Pruszynski.
Other Information
| CVE IDs: | CVE-2008-0304 |
| Severity Metric: | 31.00 |
| Date Public: | 2008-02-26 |
| Date First Published: | 2008-03-06 |
| Date Last Updated: | 2008-03-06 13:45 UTC |
| Document Revision: | 24 |