CVE-2006-0884: Input Validation
The WYSIWYG rendering engine ("rich mail" editor) in Mozilla Thunderbird 1.0.7 and earlier allows user-assisted attackers to bypass javascript security settings and obtain sensitive information or cause a crash via an e-mail containing a javascript URI in the SRC attribute of an IFRAME tag, which is executed when the user edits the e-mail.
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2006-0884?
The severity of CVE-2006-0884 is considered high due to the potential for information disclosure and crashes.
How do I fix CVE-2006-0884?
To fix CVE-2006-0884, users should upgrade to Mozilla Thunderbird version 1.0.8 or later.
What versions of Thunderbird are affected by CVE-2006-0884?
CVE-2006-0884 affects Mozilla Thunderbird versions up to and including 1.0.7.
What type of attack does CVE-2006-0884 allow?
CVE-2006-0884 allows user-assisted attackers to bypass JavaScript security settings.
What can an attacker do with CVE-2006-0884?
An attacker can potentially obtain sensitive information or cause a crash through a specially crafted e-mail.