CVE-2020-12397: Medium severity Mozilla Thunderbird vulnerability
Published May 5, 2020
·Updated
By encoding Unicode whitespace characters within the From email header, an attacker can spoof the sender email address that Thunderbird displays.
Affected Software
7 affected componentsFixes available
Mozilla Thunderbird<68.8.0
Canonical Ubuntu Linux=16.04
Canonical Ubuntu Linux=18.04
Canonical Ubuntu Linux=19.10
Canonical Ubuntu Linux=20.04
Mozilla Thunderbird<68.8
68.8
debian/thunderbird
1:115.12.0-1~deb11u11:140.7.1esr-1~deb11u11:140.6.0esr-1~deb12u11:140.7.1esr-1~deb12u11:140.6.0esr-1~deb13u11:140.7.1esr-1~deb13u11:140.7.1esr-1
Remediation
Patch Available
Event History
May 5, 2020
CVE Published
12:00 AM
May 22, 2020
CVE Published
via MITRE·06:57 PM
Data Sourced
via MITRE·06:57 PM
DescriptionWeakness
Data Sourced
via NVD·07:15 PM
RemedyDescriptionSeverityWeaknessAffected Software
Jan 11, 2024
Data Sourced
via Launchpad·11:38 PM
Description
Feb 23, 2026
Data Sourced
via Ubuntu·06:52 PM
RemedyDescriptionSeverityAffected Software
Data Sourced
via Debian·06:52 PM
DescriptionAffected Software
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
1
What is the severity of CVE-2020-12397?
CVE-2020-12397 has been rated as a low severity vulnerability.
2
How do I fix CVE-2020-12397?
To fix CVE-2020-12397, upgrade to Mozilla Thunderbird version 68.9 or later.
3
What type of attack is associated with CVE-2020-12397?
CVE-2020-12397 is associated with email header spoofing using encoded Unicode whitespace characters.
4
Which versions of Thunderbird are affected by CVE-2020-12397?
CVE-2020-12397 affects Mozilla Thunderbird versions prior to 68.9.
5
Is CVE-2020-12397 specific to certain operating systems?
CVE-2020-12397 is related to Mozilla Thunderbird and can be found on multiple operating systems where the affected versions are used.