Thunderbird allowed the Text Direction Override Unicode Character in filenames. An email attachment could be incorrectly shown as being a document file, while in fact it was an executable file. Newer versions of Thunderbird will strip the character and show the correct file extension. This vulnerability affects Thunderbird < 115.0.1 and Thunderbird < 102.13.1.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade thunderbird | Aug 9, 2023 | Jul 24, 2023 |
| Amazon Linux Ami 2 | — | Upgrade thunderbirdUpgrade thunderbird-debuginfo | Sep 21, 2023 | Jul 24, 2023 |
| Centos_linux | — | Upgrade thunderbirdUpgrade thunderbird-debuginfo | Aug 8, 2023 | Jul 24, 2023 |
| Debian | — | Upgrade thunderbird | Aug 1, 2023 | Jul 24, 2023 |
| Gentoo Linux | — | Upgrade mail-client/thunderbird.Upgrade mail-client/thunderbird-bin. | Feb 21, 2024 | Jul 24, 2023 |
| Mozilla Thunderbird | — | Upgrade to Mozilla Thunderbird version 115.0.1Upgrade to the latest version of Mozilla Thunderbird | Jul 24, 2023 | Jul 20, 2023 |
| Oracle_linux | — | Upgrade thunderbird | Aug 8, 2023 | Jul 20, 2023 |
| Redhat_linux | — | Upgrade thunderbird-debugsourceUpgrade thunderbirdNo solution existsUpgrade thunderbird-debuginfo | Aug 8, 2023 | Jul 24, 2023 |
| Rocky_linux | — | Upgrade thunderbird-debuginfoUpgrade thunderbird-debugsourceUpgrade thunderbird | Mar 5, 2024 | Jul 24, 2023 |
| Suse | — | Upgrade MozillaThunderbird-translations-commonUpgrade MozillaThunderbirdUpgrade MozillaThunderbird-translations-other | Aug 1, 2023 | Jul 24, 2023 |
| Ubuntu | — | Upgrade thunderbird | Sep 18, 2023 | Jul 24, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub