CVE-2017-7829

Опубликовано: 11 июн. 2018

Источник: nvd

CVSS3: 5.3

CVSS2: 5

EPSS Низкий

Описание

It is possible to spoof the sender's email address and display an arbitrary sender address to the email recipient. The real sender's address is not displayed if preceded by a null character in the display string. This vulnerability affects Thunderbird < 52.5.2.

Ссылки

http://www.securityfocus.com/bid/102258
Third Party Advisory
VDB Entry
http://www.securitytracker.com/id/1040123
Third Party Advisory
VDB Entry
https://access.redhat.com/errata/RHSA-2018:0061
Third Party Advisory
https://bugzilla.mozilla.org/show_bug.cgi?id=1423432
Exploit
Issue Tracking
Patch
https://lists.debian.org/debian-lts-announce/2017/12/msg00026.html
Mailing List
Third Party Advisory
https://usn.ubuntu.com/3529-1/
Third Party Advisory
https://www.debian.org/security/2017/dsa-4075
Third Party Advisory
https://www.mozilla.org/security/advisories/mfsa2017-30/
Vendor Advisory
http://www.securityfocus.com/bid/102258
Third Party Advisory
VDB Entry
http://www.securitytracker.com/id/1040123
Third Party Advisory
VDB Entry
https://access.redhat.com/errata/RHSA-2018:0061
Third Party Advisory
https://bugzilla.mozilla.org/show_bug.cgi?id=1423432
Exploit
Issue Tracking
Patch
https://lists.debian.org/debian-lts-announce/2017/12/msg00026.html
Mailing List
Third Party Advisory
https://usn.ubuntu.com/3529-1/
Third Party Advisory
https://www.debian.org/security/2017/dsa-4075
Third Party Advisory
https://www.mozilla.org/security/advisories/mfsa2017-30/
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*

Версия до 52.5.2 (исключая)

Конфигурация 2

Одно из

cpe:2.3:o:redhat:enterprise_linux_aus:7.4:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_eus:7.4:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_eus:7.5:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*

Конфигурация 3

Одно из

cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*

cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*

cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*

Конфигурация 4

Одно из

cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:17.10:*:*:*:*:*:*:*

EPSS

Процентиль: 81%

0.01565

Низкий

5.3 Medium

CVSS3

5 Medium

CVSS2

Дефекты

CWE-20

Связанные уязвимости

CVE-2017-7829

CVSS3: 5.3

ubuntu

около 7 лет назад

CVE-2017-7829

CVSS3: 5.3

redhat

больше 12 лет назад

CVE-2017-7829

CVSS3: 5.3

debian

около 7 лет назад

It is possible to spoof the sender's email address and display an arbi ...

GHSA-hpvr-62fv-x7x4

CVSS3: 5.3

github

около 3 лет назад

ELSA-2018-0061

oracle-oval

больше 7 лет назад

ELSA-2018-0061: thunderbird security update (IMPORTANT)

EPSS

Процентиль: 81%

0.01565

Низкий

5.3 Medium

CVSS3

5 Medium

CVSS2

Дефекты

CWE-20