CVE-2006-0236: Code Injection
GUI display truncation vulnerability in Mozilla Thunderbird 1.0.2, 1.0.6, and 1.0.7 allows user-assisted attackers to execute arbitrary code via an attachment with a filename containing a large number of spaces ending with a dangerous extension that is not displayed by Thunderbird, along with an inconsistent Content-Type header, which could be used to trick a user into downloading dangerous content by dragging or saving the attachment.
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2006-0236?
CVE-2006-0236 is considered a moderate severity vulnerability that allows for arbitrary code execution when exploiting the GUI display truncation in certain versions of Mozilla Thunderbird.
How do I fix CVE-2006-0236?
To mitigate CVE-2006-0236, users should update to the latest version of Mozilla Thunderbird or apply any available security patches that address this vulnerability.
Which versions of Mozilla Thunderbird are affected by CVE-2006-0236?
CVE-2006-0236 affects Mozilla Thunderbird versions 1.0.2, 1.0.6, 1.0.7, and earlier, including some beta versions.
What type of attack does CVE-2006-0236 enable?
CVE-2006-0236 enables user-assisted attackers to execute arbitrary code on the victim's machine via specially crafted email attachments.
Is CVE-2006-0236 a local or remote vulnerability?
CVE-2006-0236 is considered a remote vulnerability because it can be exploited through email attachments without requiring local access to the system.