PT-2014-1167 · Mozilla+1 · Thunderbird+2

Published 2013-10-26 · Updated 2016-10-04 · CVE-2014-2018

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Mozilla Thunderbird versions 17.x through 17.0.8 Mozilla Thunderbird ESR versions 17.x through 17.0.10 SeaMonkey versions prior to 2.20

Description A cross-site scripting (XSS) issue allows user-assisted remote attackers to inject arbitrary web script or HTML via an e-mail message containing a data: URL in a (1) OBJECT or (2) EMBED element. This vulnerability can be exploited by sending a specially crafted e-mail message.

Recommendations For Mozilla Thunderbird versions 17.x through 17.0.8, update to a version after 17.0.8 to resolve the issue. For Mozilla Thunderbird ESR versions 17.x through 17.0.10, update to a version after 17.0.10 to resolve the issue. For SeaMonkey versions prior to 2.20, update to version 2.20 or later to resolve the issue. As a temporary workaround, consider disabling the use of OBJECT and EMBED elements in e-mail messages until a patch is available.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

ALT-PU-2013-1033

BDU:2014-00303

CVE-2014-2018

Affected Products

Alt Linux

Thunderbird

Seamonkey

References · 31

• https://nvd.nist.gov/vuln/detail/CVE-2014-2018 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1718 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1735 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1720 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1738 · Security Note
• http://mozilla.org/security/announce/2014/mfsa2014-14.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1722 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1732 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1726 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1728 · Security Note
• https://errata.altlinux.org/ALT-PU-2013-1033 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1724 · Security Note
• https://bdu.fstec.ru/vul/2014-00303 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1719 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1737 · Security Note