Уязвимость доставки контента в Microsoft приложения через протоколы ms-msdt, search, и search-ms в Thunderbird на Windows
Описание
Протоколы ms-msdt, search и search-ms доставляют контент в приложения Microsoft, обходя браузер, когда пользователь принимает соответствующий запрос. Известно, что данные приложения имеют уязвимости, которые эксплуатируются в реальных условиях. Хотя случаев эксплуатации через Thunderbird не зафиксировано, в этом релизе Thunderbird заблокированы данные протоколы, чтобы не предлагать пользователю открыть их.
Затронутые версии ПО
- Firefox до версии 102
- Firefox ESR до версии 91.11
- Thunderbird до версии 102
- Thunderbird до версии 91.11
Тип уязвимости
Обход средств защиты
Ссылки
- Issue TrackingPermissions RequiredVendor Advisory
- Vendor Advisory
- Vendor Advisory
- Vendor Advisory
- Issue TrackingPermissions RequiredVendor Advisory
- Vendor Advisory
- Vendor Advisory
- Vendor Advisory
Уязвимые конфигурации
Одновременно
Одно из
EPSS
6.5 Medium
CVSS3
Дефекты
Связанные уязвимости
The <code>ms-msdt</code>, <code>search</code>, and <code>search-ms</code> protocols deliver content to Microsoft applications, bypassing the browser, when a user accepts a prompt. These applications have had known vulnerabilities, exploited in the wild (although we know of none exploited through Thunderbird), so in this release Thunderbird has blocked these protocols from prompting the user to open them.<br>*This bug only affects Thunderbird on Windows. Other operating systems are unaffected.*. This vulnerability affects Firefox < 102, Firefox ESR < 91.11, Thunderbird < 102, and Thunderbird < 91.11.
The <code>ms-msdt</code>, <code>search</code>, and <code>search-ms</code> protocols deliver content to Microsoft applications, bypassing the browser, when a user accepts a prompt. These applications have had known vulnerabilities, exploited in the wild (although we know of none exploited through Thunderbird), so in this release Thunderbird has blocked these protocols from prompting the user to open them.<br>*This bug only affects Thunderbird on Windows. Other operating systems are unaffected.*. This vulnerability affects Firefox < 102, Firefox ESR < 91.11, Thunderbird < 102, and Thunderbird < 91.11.
The <code>ms-msdt</code>, <code>search</code>, and <code>search-ms</co ...
The <code>ms-msdt</code>, <code>search</code>, and <code>search-ms</code> protocols deliver content to Microsoft applications, bypassing the browser, when a user accepts a prompt. These applications have had known vulnerabilities, exploited in the wild (although we know of none exploited through Thunderbird), so in this release Thunderbird has blocked these protocols from prompting the user to open them.<br>*This bug only affects Thunderbird on Windows. Other operating systems are unaffected.*. This vulnerability affects Firefox < 102, Firefox ESR < 91.11, Thunderbird < 102, and Thunderbird < 91.11.
EPSS
6.5 Medium
CVSS3