PT-2005-1250 · Mozilla+1 · Thunderbird+2

Michiel Van Leeuwen + 1 · Published 2005-01-29 · Updated 2017-10-11 · CVE-2005-0149

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Thunderbird versions 0.6 through 0.9 Mozilla versions 1.7 through 1.7.3

Description The issue allows remote attackers to bypass the user's intended privacy and security policy by using cookies in e-mail messages, as the software does not obey the network.cookie.disableCookieForMailNews preference.

Recommendations For Thunderbird versions 0.6 through 0.9, consider disabling the use of cookies in e-mail messages until a patch is available. For Mozilla versions 1.7 through 1.7.3, restrict access to cookies in e-mail messages to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2005-0149

RHSA-2005:094

RHSA-2005:335

RHSA-2005_094

RHSA-2005_323

RHSA-2005_335

Affected Products

Mozilla Firefox

Red Hat

Thunderbird

References · 35

• http://redhat.com/support/errata/RHSA-2005-323.html · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2005-094.html · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2005-335.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2005-0149 · Security Note
• http://mozilla.org/security/announce/mfsa2005-11.html · Vendor Advisory
• http://novell.com/linux/security/advisories/2006_04_25.html · Vendor Advisory
• https://bugzilla.mozilla.org/show_bug.cgi?id=268107 · Vendor Advisory
• https://redhat.com/security/data/cve/CVE-2005-0232.html · Note
• https://redhat.com/security/data/cve/CVE-2005-0399.html · Note
• http://mikx.de/firescrolling2 · Note
• https://redhat.com/security/data/cve/CVE-2005-0149.html · Note
• https://redhat.com/security/data/cve/CVE-2005-0146.html · Note
• https://rhn.redhat.com/errata/RHSA-2005-323.html · Note
• https://redhat.com/security/data/cve/CVE-2005-0401.html · Note
• http://securityfocus.com/bid/12407 · Note