PT-2017-17948 · Mozilla+5 · Thunderbird+5

Cure53 · Published 2017-12-22 · Updated 2024-06-15 · CVE-2017-7846

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Thunderbird versions prior to 52.5.2

Description The issue allows execution of JavaScript in the parsed RSS feed when viewed as a website. This can occur through different viewing options, such as "View -> Feed article -> Website" or the standard "View -> Feed article -> default format".

Recommendations For versions prior to 52.5.2, update to version 52.5.2 or later to resolve the issue.

Fix

Special Elements Injection

Weakness Enumeration

CWE-74

Related Identifiers

ALT-PU-2017-2838

CESA-2018_0061

CVE-2017-7846

DLA-1223-1

DSA-4075-1

MGASA-2017-0477

OPENSUSE-SU-2017:3433-1

OPENSUSE-SU-2017:3434-1

OPENSUSE-SU-2017_3434-1

OPENSUSE-SU-2024:10601-1

RHSA-2018:0061

RHSA-2018_0061

USN-3529-1

Affected Products

Alt Linux

Centos

Red Hat

Suse

Thunderbird

Ubuntu

References · 440

• https://mozilla.org/security/advisories/mfsa2017-30 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10601-1 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2017-0477.html · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-7846 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-5098 · Vendor Advisory
• https://mozilla.org/en-US/security/advisories/mfsa2017-30/#CVE-2017-7846 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-5102 · Vendor Advisory
• https://mozilla.org/en-US/security/advisories/mfsa2017-30 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2017-7846 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-5097 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7846 · Security Note
• https://ubuntu.com/security/CVE-2017-7847 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-7846 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-5103 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2017-7846 · Security Note