CVE-2017-7829

CWE-20 — Improper Input Validation10 documents8 sources
Severity
5.3MEDIUM
EPSS
1.6%
top 18.32%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
8
Mozilla ThunderbirdCanonical Ubuntu LinuxDebian Debian Linux+5 more
Timeline
PublishedJun 11
Latest updateMay 14

Description

It is possible to spoof the sender's email address and display an arbitrary sender address to the email recipient. The real sender's address is not displayed if preceded by a null character in the display string. This vulnerability affects Thunderbird < 52.5.2.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:NExploitability: 3.9 | Impact: 1.4

Affected Packages7 packages

▶CVEListV5mozilla/thunderbirdunspecified — 52.5.2
▶NVDmozilla/thunderbird< 52.5.2
▶Debianthunderbird< 1:52.5.2-1+3
▶Ubuntuthunderbird< 1:52.6.0+build1-0ubuntu0.14.04.1+1

Also affects: Debian Linux 7.0, 8.0, 9.0, Ubuntu Linux 14.04, 16.04, 17.10, Enterprise Linux 7.4, 7.5

Patches

Patch: bugzilla.mozilla.org ↗Patch: bugzilla.mozilla.org ↗

🔴Vulnerability Details

4
GHSA
GHSA-hpvr-62fv-x7x4: It is possible to spoof the sender's email address and display an arbitrary sender address to the email recipient↗2022-05-14
▶
OSV
CVE-2017-7829: It is possible to spoof the sender's email address and display an arbitrary sender address to the email recipient↗2018-06-11
▶
CVEList
CVE-2017-7829: It is possible to spoof the sender's email address and display an arbitrary sender address to the email recipient↗2018-06-11
▶
OSV
thunderbird vulnerabilities↗2018-01-29
▶

📋Vendor Advisories

3
Ubuntu
Thunderbird vulnerabilities↗2018-01-29
▶
Debian
CVE-2017-7829: thunderbird - It is possible to spoof the sender's email address and display an arbitrary send...↗2017
▶
Red Hat
Mozilla: From address with encoded null character is cut off in message header display↗2012-12-22
▶

💬Community

2
Bugzilla
CVE-2017-7829 Mozilla: From address with encoded null character is cut off in message header display↗2018-01-02
▶
Bugzilla
CVE-2017-7846 Mozilla: JavaScript Execution via RSS in mailbox:// origin↗2018-01-02
▶
CVE-2017-7829 (MEDIUM CVSS 5.3) | It is possible to spoof the sender' | cvebase.io