VulnerabilityModified
CVE-2020-12397
By encoding Unicode whitespace characters within the From email header, an attacker can spoof the sender email address that Thunderbird displays.
MEDIUM 4.3EPSS 0.60%
Does this matter?
Lower severity and a low EPSS score (0.60%). Track it; it rarely justifies an emergency change on its own.
Description
By encoding Unicode whitespace characters within the From email header, an attacker can spoof the sender email address that Thunderbird displays. This vulnerability affects Thunderbird < 68.8.0.
- CVSS 3.1
- 4.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
- EPSS
- 0.60% probability · 47th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-346
- Affected
- mozilla/thunderbird · canonical/ubuntu linux
- Source
- security@mozilla.org
References
- https://bugzilla.mozilla.org/show_bug.cgi?id=1617370Issue Tracking, Patch, Vendor Advisory
- https://security.gentoo.org/glsa/202005-03Third Party Advisory
- https://usn.ubuntu.com/4373-1/Third Party Advisory
- https://www.mozilla.org/security/advisories/mfsa2020-18/Vendor Advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=1617370Issue Tracking, Patch, Vendor Advisory
- https://security.gentoo.org/glsa/202005-03Third Party Advisory
- https://usn.ubuntu.com/4373-1/Third Party Advisory
- https://www.mozilla.org/security/advisories/mfsa2020-18/Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.