REDHAT-BUG-2359793: High severity thunderbird vulnerability
Thunderbird processes the X-Mozilla-External-Attachment-URL header to handle attachments which can be hosted externally. When an email is opened, Thunderbird accesses the specified URL to determine file size, and navigates to it when the user clicks the attachment. Because the URL is not validated or sanitized, it can reference internal resources like chrome:// or SMB share file:// links, potentially leading to hashed Windows credential leakage and opening the door to more serious security issues. This vulnerability affects Thunderbird < 137.0.2 and Thunderbird < 128.9.2.
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2359793?
The severity of REDHAT-BUG-2359793 is categorized as high due to the potential for remote exploitation.
How do I fix REDHAT-BUG-2359793?
To fix REDHAT-BUG-2359793, update Thunderbird to the latest version beyond 137.0.2 or 128.9.2.
What systems are affected by REDHAT-BUG-2359793?
REDHAT-BUG-2359793 affects Mozilla Thunderbird versions up to 137.0.2 and 128.9.2.
Is there a workaround for REDHAT-BUG-2359793?
Currently, the recommended workaround for REDHAT-BUG-2359793 is to disable the handling of external attachments.
What type of vulnerability is REDHAT-BUG-2359793?
REDHAT-BUG-2359793 is a remote code execution vulnerability related to external attachment handling in Thunderbird.