PT-2006-2082 · Mozilla+1 · Thunderbird+1

Crashfr · Published 2006-03-07 · Updated 2018-10-18 · CVE-2006-1045

Positive Technologies (AI Summary)

CVSS v2.0

2.6

Low

Base vector

AV:N/AC:H/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Mozilla Thunderbird version 1.5

Description The issue concerns the HTML rendering engine in Mozilla Thunderbird. When the "Block loading of remote images in mail messages" option is enabled, it fails to properly block external images from inline HTML attachments. This could allow remote attackers to obtain sensitive information, such as the application version or IP address, when the user reads the email and the external image is accessed.

Recommendations For Mozilla Thunderbird version 1.5, consider disabling the HTML rendering engine for mail messages or avoid reading emails with inline HTML attachments until a fix is available. As a temporary workaround, disable the loading of remote images in mail messages to minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

CVE-2006-1045

DSA-1046-1

DSA-1051-1

RHSA-2006:0330

RHSA-2006_0330

Affected Products

Thunderbird

Red Hat

References · 59

• 🔥 http://securityfocus.com/archive/1/426347 · Exploit
• 🔥 https://exploit-db.com/exploits/27337 · Exploit
• http://securityfocus.com/archive/1/446657/100/200/threaded · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDKSA-2006:078 · Vendor Advisory
• http://debian.org/security/2006/dsa-1046 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2006-1045 · Vendor Advisory
• http://debian.org/security/2006/dsa-1051 · Vendor Advisory
• https://usn.ubuntu.com/276-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2006-1045 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2006-1045 · Vendor Advisory
• http://gentoo.org/security/en/glsa/glsa-200605-09.xml · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-1045 · Security Note
• http://redhat.com/support/errata/RHSA-2006-0330.html · Vendor Advisory
• http://novell.com/linux/security/advisories/2006_04_25.html · Vendor Advisory
• http://gentoo.org/security/en/glsa/glsa-200604-18.xml · Vendor Advisory