CVE-2023-29542: Critical severity Mozilla Thunderbird vulnerability
A newline in a filename could have been used to bypass the file extension security mechanisms that replace malicious file extensions such as .lnk with .download. This could have led to accidental execution of malicious code.
This bug only affects Firefox and Thunderbird on Windows. Other versions of Firefox and Thunderbird are unaffected. This vulnerability affects Firefox < 112, Firefox ESR < 102.10, and Thunderbird < 102.10.
Other sources
A newline in a filename could have been used to bypass the file extension security mechanisms that replace malicious file extensions such as .lnk with .download. This could have led to accidental execution of malicious code.This bug only affects Firefox on Windows. Other versions of Firefox are unaffected.
A newline in a filename could have been used to bypass the file extension security mechanisms that replace malicious file extensions such as .lnk with .download. This could have led to accidental execution of malicious code.This bug only affects Thunderbird on Windows. Other versions of Thunderbird are unaffected.
— Mozilla
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Thunderbirdto a version that resolves this vulnerability.Fixed in 102.10 - Upgrade
Upgrade
Firefox ESRto a version that resolves this vulnerability.Fixed in 102.10 - Upgrade
Upgrade
Firefoxto a version that resolves this vulnerability.Fixed in 112 - Upgrade
Upgrade
alpine/firefox-esrto a version that resolves this vulnerability.Fixed in 102.10.0-r0
Event History
Parent advisories
This vulnerability appears in the following advisories.
Peer vulnerabilities
Found alongside the following vulnerabilities.
- CVE-2023-29531
- CVE-2023-29532
- CVE-2023-29533
- CVE-2023-1999
- CVE-2023-29535
- CVE-2023-29536
- CVE-2023-0547
- CVE-2023-29479
- CVE-2023-29539
- CVE-2023-29541
- CVE-2023-29542
- CVE-2023-29545
- CVE-2023-1945
- CVE-2023-29548
- CVE-2023-29550
- CVE-2023-29534
- CVE-2023-29537
- CVE-2023-29538
- CVE-2023-29540
- CVE-2023-29543
- CVE-2023-29544
- CVE-2023-29546
- CVE-2023-29547
- CVE-2023-29549
- CVE-2023-29551
Frequently Asked Questions
What is CVE-2023-29542?
CVE-2023-29542 is a vulnerability that could have been used to bypass file extension security mechanisms in Thunderbird on Windows, potentially leading to the accidental execution of malicious code.
Which software versions are affected by CVE-2023-29542?
The affected software versions are Thunderbird up to version 102.10 and Firefox ESR up to version 102.10.
What is the severity of CVE-2023-29542?
The severity of CVE-2023-29542 is classified as medium with a severity value of 4.
How can I fix CVE-2023-29542?
To fix CVE-2023-29542, ensure that you have updated Thunderbird to version 102.10 or later.
Where can I find more information about CVE-2023-29542?
You can find more information about CVE-2023-29542 in the references provided: [Link 1](https://bugzilla.mozilla.org/show_bug.cgi?id=1815062), [Link 2](https://bugzilla.mozilla.org/show_bug.cgi?id=1810793), [Link 3](https://www.mozilla.org/en-US/security/advisories/mfsa2023-15/)