Bug 918444 (CVE-2023-3417)

Summary:	<mail-client/thunderbird{-bin,}-115.5.0: multiple vulnerabilities
Product:	Gentoo Security	Reporter:	John Helmert III <ajak>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	RESOLVED FIXED
Severity:	major	CC:	ajak, mozilla
Priority:	Normal
Version:	unspecified
Hardware:	All
OS:	Linux
Whiteboard:	A2 [glsa+]
Package list:		Runtime testing required:	---
Bug Depends on:
Bug Blocks:	918442

Description John Helmert III archtester

2023-11-25 03:39:11 UTC

CVE-2023-3417:

Thunderbird allowed the Text Direction Override Unicode Character in filenames. An email attachment could be incorrectly shown as being a document file, while in  fact it was an executable file. Newer versions of Thunderbird will strip the character and show the correct file extension. This vulnerability affects Thunderbird < 115.0.1 and Thunderbird < 102.13.1.

https://www.mozilla.org/security/advisories/mfsa2023-27/
https://www.mozilla.org/security/advisories/mfsa2023-28/

More details also in tracker. Please cleanup remaining affected versions.

Comment 1 John Helmert III archtester

2023-11-25 03:40:10 UTC

Oops, wrong tracker..

Comment 2 Larry the Git Cow gentoo-dev

2024-02-19 06:11:05 UTC

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/data/glsa.git/commit/?id=39f2a7a485887d1506cfabc1ac4bee230c06a1e7

commit 39f2a7a485887d1506cfabc1ac4bee230c06a1e7
Author:     GLSAMaker <glsamaker@gentoo.org>
AuthorDate: 2024-02-19 05:59:01 +0000
Commit:     John Helmert III <ajak@gentoo.org>
CommitDate: 2024-02-19 06:10:22 +0000

    [ GLSA 202402-25 ] Mozilla Thunderbird: Multiple Vulnerabilities
    
    Bug: https://bugs.gentoo.org/918444
    Bug: https://bugs.gentoo.org/920508
    Bug: https://bugs.gentoo.org/924845
    Signed-off-by: GLSAMaker <glsamaker@gentoo.org>
    Signed-off-by: John Helmert III <ajak@gentoo.org>

 glsa-202402-25.xml | 129 +++++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 129 insertions(+)