vulnwire
5.3med

CVE-2017-7829

It is possible to spoof the sender's email address and display an arbitrary sender address to the email recipient.

Published 8 y ago · modified 4 mo ago · JSON

CVSS
5.3
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
1.8%
percentile 78%
Public exploits
0
none known

It is possible to spoof the sender's email address and display an arbitrary sender address to the email recipient. The real sender's address is not displayed if preceded by a null character in the display string. This vulnerability affects Thunderbird < 52.5.2.

Exploit prediction (EPSS)

1.76% probability of exploitation in the next 30 days, higher than 78% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD3.05.3CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
NVD2.05.0AV:N/AC:L/Au:N/C:N/I:P/A:N

Affected products

  • Mozilla Thunderbird

Classification

Weakness
  • CWE-20 Improper Input Validation

References

  • lists.debian.org /debian-lts-announce/2017/12/msg00026.html · mailing-list, x_refsource_MLIST, x_transferred
  • usn.ubuntu.com /3529-1/ · vendor-advisory, x_refsource_UBUNTU, x_transferred
  • bugzilla.mozilla.org /show_bug.cgi?id=1423432 · x_refsource_CONFIRM, x_transferred
  • securityfocus.com /bid/102258 · vdb-entry, x_refsource_BID, x_transferred
  • securitytracker.com /id/1040123 · vdb-entry, x_refsource_SECTRACK, x_transferred
  • mozilla.org /security/advisories/mfsa2017-30/ · x_refsource_CONFIRM, x_transferred
  • debian.org /security/2017/dsa-4075 · vendor-advisory, x_refsource_DEBIAN, x_transferred
  • access.redhat.com /errata/RHSA-2018:0061 · vendor-advisory, x_refsource_REDHAT, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.