Vulnerabilities

TI-2017-05464 CVE-2017-7848 · GHSA-fpgh-654r-2xjr

Injection in Mozilla Thunderbird

LOW 28

RSS fields can inject new lines into the created email structure, modifying the message body.

CVSS 3.0MEDIUM 5.3 Network No auth No interaction EPSS 0.01728 Published 2018-06-11 Fixed in 52.5.2 CWE-74

TI-2017-05463 CVE-2017-7847 · GHSA-jmgx-hhrr-ppmv

LOW 23

Crafted CSS in an RSS feed can leak and reveal local path strings, which may contain user name.

CVSS 3.0MEDIUM 4.3 Network No auth User interaction EPSS 0.01594 Published 2018-06-11 Fixed in 52.5.2 CWE-200

TI-2017-05462 CVE-2017-7846 · GHSA-2529-rwp4-75f6

MEDIUM 42

It is possible to execute JavaScript in the parsed RSS feed when RSS feed is viewed as a website, e.g.

CVSS 3.0HIGH 8.8 Network No auth User interaction EPSS 0.01943 Published 2018-06-11 Fixed in 52.5.2 CWE-74

TI-2017-05447 CVE-2017-7830 · GHSA-6j6p-p8wc-9jpp

LOW 33

The Resource Timing API incorrectly revealed navigations in cross-origin iframes.

CVSS 3.0MEDIUM 6.5 Network No auth User interaction EPSS 0.02404 Published 2018-06-11 Fixed in 57, 52.5

TI-2017-05446 CVE-2017-7829 · GHSA-hpvr-62fv-x7x4

LOW 28

It is possible to spoof the sender's email address and display an arbitrary sender address to the email recipient.

CVSS 3.0MEDIUM 5.3 Network No auth No interaction EPSS 0.01765 Published 2018-06-11 Fixed in 52.5.2 CWE-20

TI-2017-05445 CVE-2017-7828 · GHSA-f749-pqmw-rvhp

MEDIUM 52

A use-after-free vulnerability can occur when flushing and resizing layout because the "PressShell" object has been freed while still in use.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.072 Published 2018-06-11 Fixed in 57, 52.5 CWE-416

TI-2017-05443 CVE-2017-7826 · GHSA-9g7r-5p3c-g4qg

MEDIUM 48

Memory safety bugs were reported in Firefox 56 and Firefox ESR 52.4.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.03335 Published 2018-06-11 Fixed in 57, 52.5 CWE-119