CVE-2017-7829
published 2018-06-11CVE-2017-7829: It is possible to spoof the sender's email address and display an arbitrary sender address to the email recipient. The real sender's address is not displayed…
PriorityP427medium5.3CVSS 3.0
AVNACLPRNUINSUCNILAN
EPSS
1.76%
77.9th percentile
It is possible to spoof the sender's email address and display an arbitrary sender address to the email recipient. The real sender's address is not displayed if preceded by a null character in the display string. This vulnerability affects Thunderbird < 52.5.2.
Affected
24 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | thunderbird | < thunderbird 1:52.5.2-1 (bookworm) | thunderbird 1:52.5.2-1 (bookworm) |
| mozilla | thunderbird | < 52.5.2 | 52.5.2 |
| mozilla | thunderbird | >= 0 < 1:52.5.2-1 | 1:52.5.2-1 |
| mozilla | thunderbird | >= 0 < 1:52.5.2-1 | 1:52.5.2-1 |
| mozilla | thunderbird | >= 0 < 1:52.5.2-1 | 1:52.5.2-1 |
| mozilla | thunderbird | >= 0 < 1:52.5.2-1 | 1:52.5.2-1 |
| mozilla | thunderbird | >= 0 < 1:52.6.0+build1-0ubuntu0.14.04.1 | 1:52.6.0+build1-0ubuntu0.14.04.1 |
| mozilla | thunderbird | >= 0 < 1:52.6.0+build1-0ubuntu0.16.04.1 | 1:52.6.0+build1-0ubuntu0.16.04.1 |
| mozilla | thunderbird | >= unspecified < 52.5.2 | 52.5.2 |
| redhat | enterprise_linux_aus | — | — |
| redhat | enterprise_linux_desktop | — | — |
| redhat | enterprise_linux_desktop | — | — |
| redhat | enterprise_linux_eus | — | — |
| redhat | enterprise_linux_eus | — | — |
| redhat | enterprise_linux_server | — | — |
| redhat | enterprise_linux_server | — | — |
| redhat | enterprise_linux_workstation | — | — |
| redhat | enterprise_linux_workstation | — | — |
CVSS provenance
nvdv3.05.3MEDIUMCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:P/A:N
osv5.3MEDIUM
vendor_debian5.3MEDIUM
vendor_redhat5.3MEDIUM
vendor_ubuntu5.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-hpvr-62fv-x7x4: It is possible to spoof the sender's email address and display an arbitrary sender address to the email recipient
ghsa_unreviewed·2022-05-14
CVE-2017-7829 [MEDIUM] CWE-20 GHSA-hpvr-62fv-x7x4: It is possible to spoof the sender's email address and display an arbitrary sender address to the email recipient
It is possible to spoof the sender's email address and display an arbitrary sender address to the email recipient. The real sender's address is not displayed if preceded by a null character in the display string. This vulnerability affects Thunderbird < 52.5.2.
OSV
CVE-2017-7829: It is possible to spoof the sender's email address and display an arbitrary sender address to the email recipient
osv·2018-06-11·CVSS 5.3
CVE-2017-7829 [MEDIUM] CVE-2017-7829: It is possible to spoof the sender's email address and display an arbitrary sender address to the email recipient
It is possible to spoof the sender's email address and display an arbitrary sender address to the email recipient. The real sender's address is not displayed if preceded by a null character in the display string. This vulnerability affects Thunderbird < 52.5.2.
OSV
thunderbird vulnerabilities
osv·2018-01-29·CVSS 5.3
CVE-2017-7829 [MEDIUM] thunderbird vulnerabilities
thunderbird vulnerabilities
It was discovered that a From address encoded with a null character is
cut off in the message header display. An attacker could potentially
exploit this to spoof the sender address. (CVE-2017-7829)
It was discovered that it is possible to execute JavaScript in RSS feeds
in some circumstances. If a user were tricked in to opening a specially
crafted RSS feed, an attacker could potentially exploit this in
combination with another vulnerability, in order to cause unspecified
problems. (CVE-2017-7846)
It was discovered that the RSS feed can leak local path names. If a user
were tricked in to opening a specially crafted RSS feed, an attacker
could potentially exploit this to obtain sensitive information.
(CVE-2017-7847)
It was discovered that RSS feeds are vulner
Ubuntu
Thunderbird vulnerabilities
vendor_ubuntu·2018-01-29·CVSS 5.3
CVE-2017-7829 [MEDIUM] Thunderbird vulnerabilities
Title: Thunderbird vulnerabilities
Summary: Several security issues were fixed in Thunderbird.
It was discovered that a From address encoded with a null character is
cut off in the message header display. An attacker could potentially
exploit this to spoof the sender address. (CVE-2017-7829)
It was discovered that it is possible to execute JavaScript in RSS feeds
in some circumstances. If a user were tricked in to opening a specially
crafted RSS feed, an attacker could potentially exploit this in
combination with another vulnerability, in order to cause unspecified
problems. (CVE-2017-7846)
It was discovered that the RSS feed can leak local path names. If a user
were tricked in to opening a specially crafted RSS feed, an attacker
could potentially exploit this to obtain sensitive infor
Debian
CVE-2017-7829: thunderbird - It is possible to spoof the sender's email address and display an arbitrary send...
vendor_debian·2017·CVSS 5.3
CVE-2017-7829 [MEDIUM] CVE-2017-7829: thunderbird - It is possible to spoof the sender's email address and display an arbitrary send...
It is possible to spoof the sender's email address and display an arbitrary sender address to the email recipient. The real sender's address is not displayed if preceded by a null character in the display string. This vulnerability affects Thunderbird < 52.5.2.
Scope: local
bookworm: resolved (fixed in 1:52.5.2-1)
bullseye: resolved (fixed in 1:52.5.2-1)
forky: resolved (fixed in 1:52.5.2-1)
sid: resolved (fixed in 1:52.5.2-1)
trixie: resolved (fixed in 1:52.5.2-1)
Red Hat
Mozilla: From address with encoded null character is cut off in message header display
vendor_redhat·2012-12-22·CVSS 5.3
CVE-2017-7829 [MEDIUM] Mozilla: From address with encoded null character is cut off in message header display
Mozilla: From address with encoded null character is cut off in message header display
It is possible to spoof the sender's email address and display an arbitrary sender address to the email recipient. The real sender's address is not displayed if preceded by a null character in the display string. This vulnerability affects Thunderbird < 52.5.2.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2017-7829 Mozilla: From address with encoded null character is cut off in message header display
bugzilla·2018-01-02·CVSS 5.3
CVE-2017-7829 [MEDIUM] CVE-2017-7829 Mozilla: From address with encoded null character is cut off in message header display
CVE-2017-7829 Mozilla: From address with encoded null character is cut off in message header display
It is possible to spoof the sender's email address and display an arbitrary sender address to the email recipient. The real sender's address is not displayed if preceded by a null character in the display string.
Discussion:
Acknowledgments:
Name: the Mozilla project
Upstream: Sabri Haddouche
---
External References:
https://www.mozilla.org/en-US/security/advisories/mfsa2017-30/#CVE-2017-7829
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 7
Red Hat Enterprise Linux 6
Via RHSA-2018:0061 https://access.redhat.com/errata/RHSA-2018:0061
Bugzilla
CVE-2017-7846 Mozilla: JavaScript Execution via RSS in mailbox:// origin
bugzilla·2018-01-02·CVSS 5.3
CVE-2017-7846 [MEDIUM] CVE-2017-7846 Mozilla: JavaScript Execution via RSS in mailbox:// origin
CVE-2017-7846 Mozilla: JavaScript Execution via RSS in mailbox:// origin
It is possible to execute JavaScript in the parsed RSS feed when RSS feed is viewed as a website, e.g. via “View -> Feed article -> Website” or in the standard format of “View -> Feed article -> default format”.
Discussion:
Acknowledgments:
Name: the Mozilla project
Upstream: cure53
---
External References:
https://www.mozilla.org/en-US/security/advisories/mfsa2017-30/#CVE-2017-7829
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 7
Red Hat Enterprise Linux 6
Via RHSA-2018:0061 https://access.redhat.com/errata/RHSA-2018:0061
http://www.securityfocus.com/bid/102258http://www.securitytracker.com/id/1040123https://access.redhat.com/errata/RHSA-2018:0061https://bugzilla.mozilla.org/show_bug.cgi?id=1423432https://lists.debian.org/debian-lts-announce/2017/12/msg00026.htmlhttps://usn.ubuntu.com/3529-1/https://www.debian.org/security/2017/dsa-4075https://www.mozilla.org/security/advisories/mfsa2017-30/http://www.securityfocus.com/bid/102258http://www.securitytracker.com/id/1040123https://access.redhat.com/errata/RHSA-2018:0061https://bugzilla.mozilla.org/show_bug.cgi?id=1423432https://lists.debian.org/debian-lts-announce/2017/12/msg00026.htmlhttps://usn.ubuntu.com/3529-1/https://www.debian.org/security/2017/dsa-4075https://www.mozilla.org/security/advisories/mfsa2017-30/
2018-06-11
Published