CVE-2017-7846: High severity Mozilla Thunderbird vulnerability
It is possible to execute JavaScript in the parsed RSS feed when RSS feed is viewed as a website, e.g. via “View -> Feed article -> Website” or in the standard format of “View -> Feed article -> default format”.
Other sources
It is possible to execute JavaScript in the parsed RSS feed when RSS feed is viewed as a website, e.g. via "View -> Feed article -> Website" or in the standard format of "View -> Feed article -> default format". This vulnerability affects Thunderbird < 52.5.2.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/thunderbirdto a version that resolves this vulnerability.Fixed in 1:115.12.0-1~deb11u1Fixed in 1:115.16.0esr-1~deb11u1Fixed in 1:115.12.0-1~deb12u1Fixed in 1:115.16.0esr-1~deb12u1Fixed in 1:128.2.0esr-1Fixed in 1:128.3.0esr-1 - Upgrade
Upgrade
Thunderbirdto a version that resolves this vulnerability.Fixed in 52.5.2
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is CVE-2017-7846?
CVE-2017-7846 is a vulnerability that allows the execution of JavaScript in the parsed RSS feed when the feed is viewed as a website.
How does CVE-2017-7846 affect Thunderbird?
CVE-2017-7846 affects Thunderbird versions prior to 52.5.2.
What is the severity of CVE-2017-7846?
CVE-2017-7846 has a severity rating of 8.8, which is considered high.
How can I fix CVE-2017-7846?
To fix CVE-2017-7846, upgrade Thunderbird to version 52.6.0 or higher.
Where can I find more information about CVE-2017-7846?
You can find more information about CVE-2017-7846 at the following references: [1] [2] [3].