CVE-2020-12397 — Origin Validation Error in Mozilla Thunderbird

CWE-346 — Origin Validation ErrorCWE-172 — Encoding Error10 documents9 sources
Severity
4.3MEDIUMNVD
OSV8.1
EPSS
0.2%
top 58.48%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Mozilla ThunderbirdCanonical Ubuntu Linux
Timeline
PublishedMay 22
Latest updateMay 24

Description

By encoding Unicode whitespace characters within the From email header, an attacker can spoof the sender email address that Thunderbird displays. This vulnerability affects Thunderbird < 68.8.0.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:NExploitability: 2.8 | Impact: 1.4

Affected Packages4 packages

▶CVEListV5mozilla/thunderbirdunspecified — 68.8.0
▶NVDmozilla/thunderbird< 68.8.0
▶Debianmozilla/thunderbird< 1:68.8.0-1+3
▶Ubuntumozilla/thunderbird< 1:68.8.0+build2-0ubuntu0.16.04.2+2

Also affects: Ubuntu Linux 16.04, 18.04, 19.10, 20.04

Patches

Patch: bugzilla.mozilla.org ↗Patch: bugzilla.mozilla.org ↗

🔴Vulnerability Details

4
GHSA
GHSA-mg46-fgw7-xxfg: By encoding Unicode whitespace characters within the From email header, an attacker can spoof the sender email address that Thunderbird displays↗2022-05-24
▶
OSV
thunderbird vulnerabilities↗2020-05-26
▶
CVEList
CVE-2020-12397: By encoding Unicode whitespace characters within the From email header, an attacker can spoof the sender email address that Thunderbird displays↗2020-05-22
▶
OSV
CVE-2020-12397: By encoding Unicode whitespace characters within the From email header, an attacker can spoof the sender email address that Thunderbird displays↗2020-05-22
▶

📋Vendor Advisories

4
Ubuntu
Thunderbird vulnerabilities↗2020-05-26
▶
Red Hat
Mozilla: Sender Email Address Spoofing using encoded Unicode characters↗2020-05-05
▶
Debian
CVE-2020-12397: thunderbird - By encoding Unicode whitespace characters within the From email header, an attac...↗2020
▶
Mozilla
Mozilla Foundation Security Advisory 2020-18: CVE-2020-12397↗
▶

💬Community

1
Bugzilla
CVE-2020-12397 Mozilla: Sender Email Address Spoofing using encoded Unicode characters↗2020-05-06
▶
CVE-2020-12397 — Origin Validation Error in Mozilla | cvebase