PT-2005-1249 · Mozilla+1 · Thunderbird+2

Tom Braun · Published 2005-01-29 · Updated 2017-10-11 · CVE-2005-0148

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Thunderbird versions prior to 0.9

Description The issue arises when Thunderbird, running on Windows systems, processes javascript: links. It uses the default handler, which invokes Internet Explorer. This may expose the Thunderbird user to vulnerabilities in the version of Internet Explorer installed on the user's system.

Recommendations For Thunderbird versions prior to 0.9, consider updating to a version that properly handles javascript: links without invoking Internet Explorer, or restrict the use of javascript: links in Thunderbird until a proper fix is available.

Fix

Related Identifiers

CVE-2005-0148

Affected Products

Internet Explorer

Thunderbird

Windows

References · 6

• https://bugzilla.mozilla.org/show_bug.cgi?id=263546 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2005-0148 · Security Note
• http://mozilla.org/security/announce/mfsa2005-10.html · Vendor Advisory
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A100048 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/19173 · Note
• http://securityfocus.com/bid/12407 · Note