{"schemaVersion":3,"id":"MGASA-2017-0477","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"Updated thunderbird packages fix security vulnerabilities\n\nMultiple vulnerabilities have been fixed in thunderbird.\n* JavaScript Execution via RSS in mailbox:// origin (CVE-2017-7846).\n* Local path string can be leaked from RSS feed (CVE-2017-7847).\n* RSS Feed vulnerable to new line Injection (CVE-2017-7848).\n* Mailsploit From address with encoded null character is cut off in\nmessage header display (CVE-2017-7829).\n\nMultiple vulnerabilities have been fixed in the bundled enigmail package.\n* An issue was discovered that allows remote attackers to trigger use of\nan intended public key for encryption, because incorrect regular\nexpressions are used for extraction of an e-mail address from a\ncomma-separated list (CVE-2017-17843).\n* A remote attacker can obtain cleartext content by sending an encrypted\ndata block to a victim, and relying on the victim to automatically\ndecrypt that block and then send it back to the attacker as quoted text\n(CVE-2017-17844).\n* An issue was discovered where Improper Random Secret Generation occurs\nbecause Math.Random() is used by pretty Easy privacy (pEp)\n(CVE-2017-17845).\n* An issue was discovered where regular expressions are exploitable for\nDenial of Service, because of attempts to match arbitrarily long strings\n(CVE-2017-17846).\n* An issue was discovered that signature spoofing is possible because\nthe UI does not properly distinguish between an attachment signature,\nand a signature that applies to the entire containing message\n(CVE-2017-17847).\n* In a variant of CVE-2017-17847, signature spoofing is possible for\nmultipart/related messages because a signed message part can be\nreferenced with a cid: URI but not actually displayed (CVE-2017-17848)","dates":{"published":"2017-12-31T00:10:15.000Z","modified":"2026-05-16T06:30:52.454Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":null,"severity":"unknown","version":null,"versionLabel":null,"source":null,"vector":null,"computed":false,"selection":"none"},"metrics":[]},"epss":{"probability":null,"percentile":null,"severity":"unknown","asOf":null,"change":{"pp":null,"baselineDate":null,"baselineScore":null},"history":[],"last30":[]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[],"affected":[{"vendor":"mageia","product":"thunderbird","name":"thunderbird","label":"thunderbird","ecosystem":"Mageia","cpePart":null,"purl":"pkg:rpm/mageia/thunderbird","purlType":"rpm","versions":[{"text":"< 52.5.2-1.mga5","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 52.5.2-1.mga5","eol":null,"hubHref":null},{"vendor":"mageia","product":"thunderbird-l10n","name":"thunderbird-l10n","label":"thunderbird-l10n","ecosystem":"Mageia","cpePart":null,"purl":"pkg:rpm/mageia/thunderbird-l10n","purlType":"rpm","versions":[{"text":"< 52.5.2-1.mga5","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 52.5.2-1.mga5","eol":null,"hubHref":null},{"vendor":"mageia","product":"thunderbird","name":"thunderbird","label":"thunderbird","ecosystem":"Mageia","cpePart":null,"purl":"pkg:rpm/mageia/thunderbird","purlType":"rpm","versions":[{"text":"< 52.5.2-1.mga6","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 52.5.2-1.mga6","eol":null,"hubHref":null},{"vendor":"mageia","product":"thunderbird-l10n","name":"thunderbird-l10n","label":"thunderbird-l10n","ecosystem":"Mageia","cpePart":null,"purl":"pkg:rpm/mageia/thunderbird-l10n","purlType":"rpm","versions":[{"text":"< 52.5.2-1.mga6","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 52.5.2-1.mga6","eol":null,"hubHref":null}],"affectedCount":4,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://advisories.mageia.org/MGASA-2017-0477.html","label":"advisories.mageia.org/MGASA-2017-0477.html","hostname":"advisories.mageia.org","tags":["Advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=22251","label":"bugs.mageia.org/show_bug.cgi?id=22251","hostname":"bugs.mageia.org","tags":["REPORT"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2017-30/","label":"www.mozilla.org/en-US/security/advisories/mfsa2017-30/","hostname":"www.mozilla.org","tags":["Advisory"]}],"lineage":{"upstream":["CVE-2017-17843","CVE-2017-17844","CVE-2017-17845","CVE-2017-17846","CVE-2017-17847","CVE-2017-17848","CVE-2017-7829","CVE-2017-7846","CVE-2017-7847","CVE-2017-7848"],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2017-12-31T00:10:15.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-05-16T06:30:52.454Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":0,"level":"minimal","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-20T06:52:22.499Z","stale":false,"partial":false}}