PT-2008-1945 · Mozilla+1 · Seamonkey+2

Regenrecht · Published 2008-02-08 · Updated 2017-09-29 · CVE-2008-0304

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Mozilla Thunderbird versions prior to 2.0.0.12 SeaMonkey versions prior to 1.1.8

Description A heap-based buffer overflow issue might allow remote attackers to execute arbitrary code via a crafted external-body MIME type in an e-mail message. This issue is related to an incorrect memory allocation during message preview.

Recommendations For Mozilla Thunderbird versions prior to 2.0.0.12, update to version 2.0.0.12 or later. For SeaMonkey versions prior to 1.1.8, update to version 1.1.8 or later.

Fix

RCE

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2008-0304

DSA-1621-1

DSA-1697-1

RHSA-2008:0104

RHSA-2008:0105

RHSA-2008_0104

RHSA-2008_0105

Affected Products

Thunderbird

Red Hat

Seamonkey

References · 42

• https://redhat.com/archives/fedora-package-announce/2008-February/msg00946.html · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2008:062 · Vendor Advisory
• http://securityfocus.com/bid/28012 · Patch
• http://ubuntu.com/usn/usn-582-2 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-0304 · Security Note
• https://redhat.com/archives/fedora-package-announce/2008-February/msg00905.html · Vendor Advisory
• http://slackware.com/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.445399 · Vendor Advisory
• http://gentoo.org/security/en/glsa/glsa-200805-18.xml · Vendor Advisory
• http://debian.org/security/2009/dsa-1697 · Vendor Advisory
• http://secunia.com/advisories/29133 · Vendor Advisory
• http://sunsolve.sun.com/search/document.do?assetkey=1-26-239546-1 · Vendor Advisory
• http://ubuntu.com/usn/usn-582-1 · Vendor Advisory
• http://debian.org/security/2008/dsa-1621 · Vendor Advisory
• http://secunia.com/advisories/29098 · Note
• https://access.redhat.com/security/cve/CVE-2008-0416 · Note