CVE-2020-12397: Medium severity Mozilla Thunderbird vulnerability
By encoding Unicode whitespace characters within the From email header, an attacker can spoof the sender email address that Thunderbird displays.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Thunderbirdto a version that resolves this vulnerability.Fixed in 68.8 - Upgrade
Upgrade
debian/thunderbirdto a version that resolves this vulnerability.Fixed in 1:115.12.0-1~deb11u1Fixed in 1:140.7.1esr-1~deb11u1Fixed in 1:140.6.0esr-1~deb12u1Fixed in 1:140.7.1esr-1~deb12u1Fixed in 1:140.6.0esr-1~deb13u1Fixed in 1:140.7.1esr-1~deb13u1Fixed in 1:140.7.1esr-1 - Upgrade
Upgrade
alpine/thunderbirdto a version that resolves this vulnerability.Fixed in 68.8.0-r0 - Upgrade
Upgrade
Thunderbirdto a version that resolves this vulnerability.Fixed in 68.8.0
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2020-12397?
CVE-2020-12397 has been rated as a low severity vulnerability.
How do I fix CVE-2020-12397?
To fix CVE-2020-12397, upgrade to Mozilla Thunderbird version 68.9 or later.
What type of attack is associated with CVE-2020-12397?
CVE-2020-12397 is associated with email header spoofing using encoded Unicode whitespace characters.
Which versions of Thunderbird are affected by CVE-2020-12397?
CVE-2020-12397 affects Mozilla Thunderbird versions prior to 68.9.
Is CVE-2020-12397 specific to certain operating systems?
CVE-2020-12397 is related to Mozilla Thunderbird and can be found on multiple operating systems where the affected versions are used.