CVE-2023-3417

Reference Links

• https://bugzilla.mozilla.org/show_bug.cgi?id=1835582
• https://lists.debian.org/debian-lts-announce/2023/07/msg00032.html
• https://www.debian.org/security/2023/dsa-5463
• https://www.mozilla.org/security/advisories/mfsa2023-27/
• https://www.mozilla.org/security/advisories/mfsa2023-28/
• https://www.mozilla.org/en-US/security/advisories/mfsa2023-27/
• https://launchpad.net/bugs/cve/CVE-2023-3417
• https://www.mozilla.org/en-US/security/advisories/mfsa2023-28/
• https://www.mozilla.org/en-US/security/advisories/mfsa2023-27/#CVE-2023-3600
• https://www.mozilla.org/en-US/security/advisories/mfsa2023-27/#CVE-2023-3417
• https://access.redhat.com/errata/RHSA-2023:4492
• https://access.redhat.com/errata/RHSA-2023:4494
• https://access.redhat.com/errata/RHSA-2023:4493
• https://access.redhat.com/errata/RHSA-2023:4495
• https://access.redhat.com/errata/RHSA-2023:4496
• https://access.redhat.com/errata/RHSA-2023:4499
• https://access.redhat.com/errata/RHSA-2023:4497
• https://access.redhat.com/errata/RHSA-2023:4500
• https://access.redhat.com/security/cve/cve-2023-3417
• https://bugzilla.redhat.com/show_bug.cgi?id=2225325
• https://www.mozilla.org/en-US/security/advisories/mfsa2023-28/#CVE-2023-3417
• https://security-tracker.debian.org/tracker/CVE-2023-3417
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-3417
• https://nvd.nist.gov/vuln/detail/CVE-2023-3417
• https://ubuntu.com/security/CVE-2023-3417

Parent vulnerabilities

(Appears in the following advisories)

• MFSA2023-27
• MFSA2023-28

Peer vulnerabilities

(Found alongside the following vulnerabilities)

• CVE-2023-3600
• CVE-2023-3417

Frequently Asked Questions

• What is the vulnerability ID?

  The vulnerability ID is CVE-2023-3417.

• What was the impact of CVE-2023-3417?

  The impact of CVE-2023-3417 was that Thunderbird allowed the Text Direction Override Unicode Character in filenames, resulting in email attachments being incorrectly shown as document files when they were actually executable files.

• Which versions of Thunderbird are affected by CVE-2023-3417?

  Thunderbird versions up to 102.13.1 and versions up to 115.0.1 are affected by CVE-2023-3417.

• How can I mitigate CVE-2023-3417?

  To mitigate CVE-2023-3417, it is recommended to update to newer versions of Thunderbird (102.13.1 or higher) that strip the Text Direction Override Unicode Character from filenames.

• Where can I find more information about CVE-2023-3417?

  You can find more information about CVE-2023-3417 on the Mozilla security advisories pages: [https://www.mozilla.org/en-US/security/advisories/mfsa2023-28/](https://www.mozilla.org/en-US/security/advisories/mfsa2023-28/) and [https://www.mozilla.org/en-US/security/advisories/mfsa2023-27/](https://www.mozilla.org/en-US/security/advisories/mfsa2023-27/)