CVE-2023-0616
First published: Tue Feb 14 2023(Updated: )
If a MIME email combines OpenPGP and OpenPGP MIME data in a certain way Thunderbird repeatedly attempts to process and display the message, which could cause Thunderbird's user interface to lock up and no longer respond to the user's actions. An attacker could send a crafted message with this structure to attempt a DoS attack.
Credit: security@mozilla.org security@mozilla.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/thunderbird | <0:102.8.0-2.el7_9 | 0:102.8.0-2.el7_9 |
| redhat/thunderbird | <0:102.8.0-2.el8_7 | 0:102.8.0-2.el8_7 |
| redhat/thunderbird | <0:102.8.0-2.el8_1 | 0:102.8.0-2.el8_1 |
| redhat/thunderbird | <0:102.8.0-2.el8_2 | 0:102.8.0-2.el8_2 |
| redhat/thunderbird | <0:102.8.0-2.el8_4 | 0:102.8.0-2.el8_4 |
| redhat/thunderbird | <0:102.8.0-2.el8_6 | 0:102.8.0-2.el8_6 |
| redhat/thunderbird | <0:102.8.0-2.el9_1 | 0:102.8.0-2.el9_1 |
| redhat/thunderbird | <0:102.8.0-2.el9_0 | 0:102.8.0-2.el9_0 |
| Mozilla Thunderbird | <102.8 | |
| Mozilla Thunderbird | <102.8 | 102.8 |
| redhat/thunderbird | <102.8 | 102.8 |
| debian/thunderbird | 1:115.12.0-1~deb11u1 1:115.16.0esr-1~deb11u1 1:115.12.0-1~deb12u1 1:115.16.0esr-1~deb12u1 1:128.2.0esr-1 1:128.3.0esr-1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://bugzilla.mozilla.org/show_bug.cgi?id=1806507
- https://www.mozilla.org/security/advisories/mfsa2023-07/
- https://www.cve.org/CVERecord?id=CVE-2023-0616 https://nvd.nist.gov/vuln/detail/CVE-2023-0616 https://www.mozilla.org/en-US/security/advisories/mfsa2023-07/#CVE-2023-0616
- https://bugzilla.redhat.com/show_bug.cgi?id=2171397
- https://access.redhat.com/errata/RHSA-2023:0817
- https://access.redhat.com/errata/RHSA-2023:0821
- https://access.redhat.com/errata/RHSA-2023:0818
- https://access.redhat.com/errata/RHSA-2023:0819
- https://access.redhat.com/errata/RHSA-2023:0820
- https://access.redhat.com/errata/RHSA-2023:0822
- https://access.redhat.com/errata/RHSA-2023:0824
- https://access.redhat.com/errata/RHSA-2023:0823
- https://access.redhat.com/security/cve/cve-2023-0616
- https://www.mozilla.org/en-US/security/advisories/mfsa2023-07/
- https://launchpad.net/bugs/cve/CVE-2023-0616
- https://www.mozilla.org/en-US/security/advisories/mfsa2023-07/#CVE-2023-25746
- https://www.mozilla.org/en-US/security/advisories/mfsa2023-07/#CVE-2023-0616
- https://security-tracker.debian.org/tracker/CVE-2023-0616
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-0616
- https://nvd.nist.gov/vuln/detail/CVE-2023-0616
- https://ubuntu.com/security/CVE-2023-0616
Parent vulnerabilities
(Appears in the following advisories)
Peer vulnerabilities
(Found alongside the following vulnerabilities)
Frequently Asked Questions
What is CVE-2023-0616?
CVE-2023-0616 is a vulnerability in Thunderbird that can cause the user interface to lock up and become unresponsive.
How does CVE-2023-0616 affect Thunderbird?
CVE-2023-0616 affects Thunderbird versions up to 102.8, causing the user interface to lock up and become unresponsive.
What is the severity of CVE-2023-0616?
CVE-2023-0616 has a medium severity rating.
How can I fix CVE-2023-0616?
To fix CVE-2023-0616, update Thunderbird to version 102.8 or higher.
Where can I find more information about CVE-2023-0616?
You can find more information about CVE-2023-0616 on the Mozilla website and Bugzilla.
- collector/nvd-latest
- collector/redhat-cve
- collector/nvd-index
- collector/mozilla-advisory
- agent/type
- agent/first-publish-date
- collector/launchpad-cve
- source/Launchpad
- agent/author
- collector/nvd-cve
- source/NVD
- agent/software-canonical-lookup
- source/Mozilla
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2023-0616
- agent/description
- agent/severity
- agent/weakness
- agent/references
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/tags
- agent/event
- collector/security-tracker-debian
- source/Debian
- agent/softwarecombine
- collector/usn-cve
- source/Ubuntu
- package-manager/redhat
- vendor/mozilla
- canonical/mozilla thunderbird
- package-manager/debian