(Seamonkey is Affected) Mozilla Thunderbird Buffer Overflow in Parsing External-Body MIME Content
|
|
SecurityTracker Alert ID: 1019505
|
|
SecurityTracker URL: http://securitytracker.com/id?1019505
|
|
CVE Reference: CVE-2008-0304
(Links to External Site)
|
Date: Feb 27 2008
|
Impact: Execution of arbitrary code via network, User access via network
|
Fix Available: Yes
Vendor Confirmed: Yes
|
Advisory: Mozilla Foundation Security Advisory
|
Version(s): prior to 1.1.8
|
Description: A vulnerability was reported in Mozilla Thunderbird. A remote user can cause arbitrary code to be executed on the target user's system. Mozilla Seamonkey is affected.
A remote user can create an e-mail message with specially crafted external-body MIME type content that, when previewed by the target
user using the Preview Pane, will trigger a buffer overflow and execute arbitrary code on the target system. The code will run
with the privileges of the target user.
The vendor was notified on January 14, 2008.
regenrecht reported this vulnerability
via iDefense.
|
Impact: A remote user can create an e-mail message that, when previewed by the target user, will execute arbitrary code on the target user's system.
|
Solution: The vendor has issued a fixed version (1.1.8).
The vendor's advisory is available at:
http://www.mozilla.org/security/announce/2008/mfsa2008-12.html
|
Vendor URL: www.mozilla.org/security/announce/2008/mfsa2008-12.html (Links to External Site)
|
Cause: Boundary error
|
Underlying OS: Linux (Any), UNIX (Any), Windows (Any)
|
|
Message History:
This archive entry is a follow-up to the message listed below.
|
Source Message Contents
|
Date: Tue, 26 Feb 2008 21:13:33 -0500
Subject: http://www.mozilla.org/security/announce/2008/mfsa2008-12.html
|
CVE-2008-0304
|
|
