CVE-2017-7829: canonical ubuntu_linux Improper Input Validation
Vulnerability summary
CVE-2017-7829 is a medium (CVSS 5.3) Improper Input Validation vulnerability in canonical ubuntu_linux. EPSS estimates a 1.76% chance of exploitation in the next 30 days, higher than 77.7% of scored vulnerabilities. 1 public exploit is recorded.
Advisory lineage
Upstream 0 · Downstream 8 · Related 4Timeline
- 11-06-2018PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
It is possible to spoof the sender's email address and display an arbitrary sender address to the email recipient. The real sender's address is not displayed if preceded by a null character in the display string. This vulnerability affects Thunderbird < 52.5.2.
CVSS metrics
4 scores · 3 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated5.3MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- OSV · DebianEcosystem advisory · calculated5.3MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
EPSS trend
Probability
1.76%
Chance of exploitation in the next 30 days
Percentile
78%
Versus all other CVEs
30-day change
-0.04 pp
From 1.80% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (bugzilla.mozilla.org)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Redhat5 products
- enterprise_linux_aus7.4
- enterprise_linux_desktop6.0 | 7.0
- enterprise_linux_eus7.4 | 7.5
- enterprise_linux_server6.0 | 7.0
- enterprise_linux_workstation6.0 | 7.0
Debian2 products
- thunderbird< 1:52.5.2-1
- debian_linuxEOL7.0 | 8.0 | 9.0
Canonical1 product
- ubuntu_linuxEOL14.04 | 16.04 | 17.10
Mozilla1 product
- thunderbird≥ unspecified, < 52.5.2 | < 52.5.2
Ubuntu1 product
- thunderbird< 1:52.6.0+build1-0ubuntu0.14.04.1 | < 1:52.6.0+build1-0ubuntu0.16.04.1
5 vendors · 10 products
References
13 links
lists.debian.org/debian-lts-announce/2017/12/msg00026.htmlMailing ListX Refsource MLISTThird Party Advisory