REDHAT-BUG-2366297: Low severity thunderbird vulnerability
It was possible to craft an email that showed a tracking link as an attachment. If the user attempted to open the attachment, Thunderbird automatically accessed the link. The configuration to block remote content did not prevent that. Thunderbird has been fixed to no longer allow access to web pages listed in the X-Mozilla-External-Attachment-URL header of an email. This vulnerability affects Thunderbird < 128.10.1 and Thunderbird < 138.0.1.
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2366297?
This vulnerability in Thunderbird is considered critical due to the risk of unauthorized access to external web pages through crafted email attachments.
How do I fix REDHAT-BUG-2366297?
To address REDHAT-BUG-2366297, update your Thunderbird to version 128.10.1 or later.
What versions of Thunderbird are affected by REDHAT-BUG-2366297?
Thunderbird versions prior to 128.10.1 and earlier than 138.0.1 are affected by REDHAT-BUG-2366297.
What type of attack is associated with REDHAT-BUG-2366297?
REDHAT-BUG-2366297 is associated with phishing attacks that exploit tracking links in email attachments.
What measures were taken to mitigate the risk in REDHAT-BUG-2366297?
Mozilla has implemented changes to Thunderbird to prevent the automatic access of external links from email attachments.