PT-2023-2798 · Mozilla+9 · Thunderbird+9

Published 2023-04-11 · Updated 2025-11-21 · CVE-2023-29479

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions Ribose RNP versions prior to 0.16.3

Description The issue is related to insufficient input validation when parsing PKESK/SKESK packets in the Ribose RNP library of the Thunderbird email client. Exploitation of this issue may allow a remote attacker to cause a denial of service by sending specially crafted OpenPGP messages to the application.

Recommendations For versions prior to 0.16.3, update to version 0.16.3 or later to resolve the issue. As a temporary workaround, consider restricting the use of the Ribose RNP library until a patch is available. Avoid using the library to parse potentially malformed input until the issue is resolved.

Fix

RCE

Resource Exhaustion

Allocation of Resources Without Limits

Weakness Enumeration

CWE-20

CWE-400

CWE-770

Related Identifiers

ALSA-2023:1802

ALSA-2023:1809

ALT-PU-2023-1648

ALT-PU-2023-1765

ALT-PU-2023-1783

ALT-PU-2023-4366

BDU:2023-02696

CESA-2023_1802

CESA-2023_1806

CVE-2023-29479

DLA-3400-1

DSA-5392-1

MGASA-2023-0147

OPENSUSE-SU-2024:12852-1

OPENSUSE-SU-2024:12995-1

RHSA-2023:1802

RHSA-2023:1803

RHSA-2023:1804

RHSA-2023:1805

RHSA-2023:1806

RHSA-2023:1809

RHSA-2023:1810

RHSA-2023:1811

RHSA-2023_1802

RHSA-2023_1806

RHSA-2023_1809

RLSA-2023:1802

RLSA-2023:1809

SUSE-SU-2023:2064-1

USN-6015-1

Affected Products

Alt Linux

Almalinux

Astra Linux

Centos

Linuxmint

Red Hat

Red Os

Rocky Linux

Thunderbird

Ubuntu

References · 110

• https://security-tracker.debian.org/tracker/CVE-2023-29479 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-29479 · Vendor Advisory
• https://mozilla.org/en-US/security/advisories/mfsa2023-15 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-29548 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-3400-1 · Vendor Advisory
• https://osv.dev/vulnerability/RLSA-2023:1809 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:12852-1 · Vendor Advisory
• https://osv.dev/vulnerability/RLSA-2023:1802 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-29533 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-29479 · Vendor Advisory
• http://repo.red-soft.ru/redos/7.3c/x86_64/updates · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-29539 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-29479 · Security Note
• https://ubuntu.com/security/CVE-2023-29536 · Vendor Advisory
• https://errata.almalinux.org/9/ALSA-2023-1809.html · Vendor Advisory