{"id":"CVE-2023-3417","aliases":["ALSA-2023:4497","ALSA-2023:4499","DEBIAN-CVE-2023-3417","DLA-3510-1","DSA-5463-1","EUVD-2023-44083","GHSA-xpxg-5vmj-vx9g","MGASA-2023-0266","RHSA-2023:4492","RHSA-2023:4493","RHSA-2023:4494","RHSA-2023:4495","RHSA-2023:4496","RHSA-2023:4497","RHSA-2023:4499","RHSA-2023:4500","RLSA-2023:4497","RLSA-2023:4499","SUSE-SU-2023:3059-1","UBUNTU-CVE-2023-3417","USN-6333-1","openSUSE-SU-2024:13072-1"],"status":"published","title":"File Extension Spoofing using the Text Direction Override Character","description":"Thunderbird allowed the Text Direction Override Unicode Character in filenames. An email attachment could be incorrectly shown as being a document file, while in  fact it was an executable file. Newer versions of Thunderbird will strip the character and show the correct file extension. This vulnerability affects Thunderbird \u003c 115.0.1 and Thunderbird \u003c 102.13.1.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.00669,"percentile":0.52226,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2023-07-24T10:09:37Z","modified":"2026-10-29T11:31:30Z","fixes":[{"ecosystem":"Debian:12","package":"thunderbird","fixed_in":["1:102.13.1-1~deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"thunderbird","fixed_in":["1:102.13.1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"thunderbird","fixed_in":["1:102.13.1-1"],"sources":["osv"]},{"ecosystem":"Debian:10","package":"thunderbird","fixed_in":["1:102.13.1-1~deb10u1"],"sources":["osv"]},{"ecosystem":"Debian:11","package":"thunderbird","fixed_in":["1:102.13.1-1~deb11u1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"thunderbird","fixed_in":["1:102.15.0+build1-0ubuntu0.20.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"thunderbird","fixed_in":["1:102.15.0+build1-0ubuntu0.22.04.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"MozillaThunderbird","fixed_in":["102.13.1-1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"AlmaLinux:8","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"102.14.0-1.el8_8.alma"}]}],"bundled":10},{"source":"osv","ecosystem":"AlmaLinux:9","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"102.14.0-1.el9_2.alma"}]}],"bundled":10},{"source":"osv","ecosystem":"Debian:12","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:102.13.1-1~deb12u1"}]}],"versions":["1:102.11.0-1","1:102.12.0-1","1:102.12.0-1~deb10u1","1:102.12.0-1~deb11u1","1:102.12.0-1~deb12u1","1:102.13.0-1","1:102.13.0-1~deb10u1","1:102.13.0-1~deb11u1","1:102.13.0-1~deb12u1","1:102.13.1-1~deb10u1","1:102.13.1-1~deb11u1"]},{"source":"osv","ecosystem":"Debian:13","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:102.13.1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:102.13.1-1"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:102.13.1-1~deb10u1"}]}],"versions":["1:102.0.1-1","1:102.0.2-1","1:102.0~b4-1","1:102.0~b7-1","1:102.1.0-1","1:102.1.1-1","1:102.1.2-1","1:102.10.0-1","1:102.10.0-1~deb10u1","1:102.10.0-1~deb11u1","1:102.11.0-1","1:102.11.0-1~deb10u1","1:102.11.0-1~deb11u1","1:102.12.0-1","1:102.12.0-1~deb10u1","1:102.12.0-1~deb11u1","1:102.12.0-1~deb12u1","1:102.13.0-1","1:102.13.0-1~deb10u1","1:102.13.0-1~deb11u1","1:102.13.0-1~deb12u1","1:102.2.0-1","1:102.2.1-1","1:102.2.2-1","1:102.3.0-1","1:102.3.0-1~deb10u1","1:102.3.0-1~deb11u1","1:102.3.1-1","1:102.3.2-1","1:102.3.3-1","1:102.4.0-1","1:102.4.0-1~deb10u1","1:102.4.0-1~deb11u1","1:102.4.1-1","1:102.5.0-1","1:102.5.0-1~deb10u1","1:102.5.0-1~deb11u1","1:102.5.1-1","1:102.6.0-1","1:102.6.0-1~deb10u1","1:102.6.0-1~deb11u1","1:102.7.1+1-1","1:102.7.1-1","1:102.7.2-1","1:102.8.0-1","1:102.8.0-1~deb10u1","1:102.8.0-1~deb11u1","1:102.9.0-1","1:102.9.0-1~deb10u1","1:102.9.0-1~deb11u1","1:102.9.1-1","1:60.7.2-1","1:60.8.0-1","1:60.8.0-1~deb10u1","1:60.8.0-1~deb8u1","1:60.8.0-1~deb9u1","1:60.8.0-2","1:60.9.0-1","1:60.9.0-1~deb10u1","1:60.9.0-1~deb8u1","1:60.9.0-1~deb9u1","1:65.0~b1-1","1:66.0~b1-1","1:67.0~b3-1","1:68.0~b1-1","1:68.1.1-1~exp1","1:68.1.2-1~exp1","1:68.10.0-1","1:68.10.0-1~deb10u1","1:68.10.0-1~deb9u1","1:68.11.0-1","1:68.11.0-1~deb10u1","1:68.11.0-1~deb9u1","1:68.11.0-2","1:68.11.0-3","1:68.12.0-1","1:68.12.0-1~deb10u1","1:68.12.0-1~deb9u1","1:68.12.0-1~deb9u2","1:68.2.1-1","1:68.2.2-1","1:68.2.2-1~deb10u1","1:68.2.2-1~deb8u1","1:68.2.2-1~deb9u1","1:68.3.0-1","1:68.3.0-2","1:68.3.0-2~deb10u1","1:68.3.0-2~deb8u1","1:68.3.0-2~deb9u1","1:68.3.1-1","1:68.4.1-1","1:68.4.1-1~deb10u1","1:68.4.1-1~deb8u1","1:68.4.1-1~deb9u1","1:68.4.2-1","1:68.5.0-1","1:68.5.0-1~deb10u1","1:68.5.0-1~deb8u1","1:68.5.0-1~deb9u1","1:68.6.0-1","1:68.6.0-1~deb10u1","1:68.6.0-1~deb8u1","1:68.6.0-1~deb9u1","1:68.7.0-1","1:68.7.0-1~deb10u1","1:68.7.0-1~deb8u1","1:68.7.0-1~deb9u1","1:68.8.0-1","1:68.8.0-1~deb10u1","1:68.8.0-1~deb8u1","1:68.8.0-1~deb9u1","1:68.8.1-1","1:68.9.0-1","1:68.9.0-1~deb10u1","1:68.9.0-1~deb8u1","1:68.9.0-1~deb8u2","1:68.9.0-1~deb9u1","1:76.0~b1-1","1:76.0~b2-1","1:77.0~b1-1","1:77.0~b2-1","1:77.0~b3-1","1:78.0-1","1:78.0.1-1","1:78.0~b1-1","1:78.0~b2-1","1:78.1.0-1","1:78.1.1-1","1:78.10.0-1","1:78.10.0-1~deb10u1","1:78.10.0-1~deb9u1","1:78.10.2-1","1:78.11.0-1","1:78.11.0-1~deb10u1","1:78.11.0-1~deb9u1","1:78.11.0-2","1:78.12.0-1","1:78.12.0-1~deb10u1","1:78.12.0-1~deb9u1","1:78.13.0-1","1:78.13.0-1~deb10u1","1:78.13.0-1~deb11u1","1:78.13.0-1~deb9u1","1:78.14.0-1","1:78.14.0-1~deb10u1","1:78.14.0-1~deb11u1","1:78.14.0-1~deb9u1","1:78.2.0-1","1:78.2.1-1","1:78.2.2-1","1:78.3.1-1","1:78.3.1-2","1:78.3.1-2~deb10u1","1:78.3.1-2~deb10u2","1:78.3.1-2~deb9u1","1:78.3.2-1","1:78.3.3-1","1:78.4.0-1","1:78.4.0-1~deb10u1","1:78.4.0-1~deb9u1","1:78.4.1-1","1:78.4.2-1","1:78.4.2-1~deb10u1","1:78.4.2-1~deb9u1","1:78.5.0-1","1:78.5.0-1~deb10u1","1:78.5.0-1~deb9u1","1:78.5.1-1","1:78.5.1-1~deb10u1","1:78.5.1-1~deb9u1","1:78.6.0-1","1:78.6.0-1~deb10u1","1:78.6.0-1~deb9u1","1:78.6.1-1","1:78.7.0-1","1:78.7.0-1~deb10u1","1:78.7.0-1~deb9u1","1:78.7.1-1","1:78.8.0-1","1:78.8.0-1~deb10u1","1:78.8.0-1~deb9u1","1:78.9.0-1","1:78.9.0-1~deb10u1","1:78.9.0-1~deb9u1","1:84.0~b3-1","1:85.0~b3-1","1:86.0~b3-1","1:88.0~b2-1","1:89.0~b2-1","1:90.0~b2-1","1:91.0-1","1:91.0.2-1","1:91.0~b1-1","1:91.0~b3-1","1:91.0~b5-1","1:91.1.0-1","1:91.1.1-1","1:91.10.0-1","1:91.10.0-1~deb10u1","1:91.10.0-1~deb11u1","1:91.10.0-1~deb9u1","1:91.11.0-1","1:91.11.0-1~deb10u1","1:91.11.0-1~deb11u1","1:91.12.0-1~deb10u1","1:91.12.0-1~deb11u1","1:91.13.0-1~deb10u1","1:91.13.0-1~deb11u1","1:91.2.0-1","1:91.2.1-1","1:91.3.0-1","1:91.3.2-1","1:91.4.0-1","1:91.4.1-1","1:91.4.1-1~deb10u1","1:91.4.1-1~deb11u1","1:91.4.1-1~deb9u1","1:91.5.0-1","1:91.5.0-1~deb9u1","1:91.5.0-2","1:91.5.0-2~deb10u1","1:91.5.0-2~deb11u1","1:91.5.1-1","1:91.6.0-1","1:91.6.0-1~deb10u1","1:91.6.0-1~deb11u1","1:91.6.0-1~deb9u1","1:91.6.1-1","1:91.6.1-1~deb10u1","1:91.6.1-1~deb11u1","1:91.6.1-1~deb9u1","1:91.6.2-1","1:91.6.2-1~deb10u1","1:91.6.2-1~deb11u1","1:91.6.2-1~deb9u1","1:91.7.0-1","1:91.7.0-2","1:91.7.0-2~deb10u1","1:91.7.0-2~deb11u1","1:91.7.0-2~deb9u1","1:91.8.0-1","1:91.8.0-1~deb10u1","1:91.8.0-1~deb11u1","1:91.8.0-1~deb9u1","1:91.8.1-1","1:91.9.0-1","1:91.9.0-1~deb10u1","1:91.9.0-1~deb11u1","1:91.9.0-1~deb9u1"]},{"source":"osv","ecosystem":"Debian:11","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:102.13.1-1~deb11u1"}]}],"versions":["1:102.0.1-1","1:102.0.2-1","1:102.0~b4-1","1:102.0~b7-1","1:102.1.0-1","1:102.1.1-1","1:102.1.2-1","1:102.10.0-1","1:102.10.0-1~deb10u1","1:102.10.0-1~deb11u1","1:102.11.0-1","1:102.11.0-1~deb10u1","1:102.11.0-1~deb11u1","1:102.12.0-1","1:102.12.0-1~deb10u1","1:102.12.0-1~deb11u1","1:102.12.0-1~deb12u1","1:102.13.0-1","1:102.13.0-1~deb10u1","1:102.13.0-1~deb11u1","1:102.13.0-1~deb12u1","1:102.13.1-1~deb10u1","1:102.2.0-1","1:102.2.1-1","1:102.2.2-1","1:102.3.0-1","1:102.3.0-1~deb10u1","1:102.3.0-1~deb11u1","1:102.3.1-1","1:102.3.2-1","1:102.3.3-1","1:102.4.0-1","1:102.4.0-1~deb10u1","1:102.4.0-1~deb11u1","1:102.4.1-1","1:102.5.0-1","1:102.5.0-1~deb10u1","1:102.5.0-1~deb11u1","1:102.5.1-1","1:102.6.0-1","1:102.6.0-1~deb10u1","1:102.6.0-1~deb11u1","1:102.7.1+1-1","1:102.7.1-1","1:102.7.2-1","1:102.8.0-1","1:102.8.0-1~deb10u1","1:102.8.0-1~deb11u1","1:102.9.0-1","1:102.9.0-1~deb10u1","1:102.9.0-1~deb11u1","1:102.9.1-1","1:78.12.0-1","1:78.13.0-1","1:78.13.0-1~deb10u1","1:78.13.0-1~deb11u1","1:78.13.0-1~deb9u1","1:78.14.0-1","1:78.14.0-1~deb10u1","1:78.14.0-1~deb11u1","1:78.14.0-1~deb9u1","1:84.0~b3-1","1:85.0~b3-1","1:86.0~b3-1","1:88.0~b2-1","1:89.0~b2-1","1:90.0~b2-1","1:91.0-1","1:91.0.2-1","1:91.0~b1-1","1:91.0~b3-1","1:91.0~b5-1","1:91.1.0-1","1:91.1.1-1","1:91.10.0-1","1:91.10.0-1~deb10u1","1:91.10.0-1~deb11u1","1:91.10.0-1~deb9u1","1:91.11.0-1","1:91.11.0-1~deb10u1","1:91.11.0-1~deb11u1","1:91.12.0-1~deb10u1","1:91.12.0-1~deb11u1","1:91.13.0-1~deb10u1","1:91.13.0-1~deb11u1","1:91.2.0-1","1:91.2.1-1","1:91.3.0-1","1:91.3.2-1","1:91.4.0-1","1:91.4.1-1","1:91.4.1-1~deb10u1","1:91.4.1-1~deb11u1","1:91.4.1-1~deb9u1","1:91.5.0-1","1:91.5.0-1~deb9u1","1:91.5.0-2","1:91.5.0-2~deb10u1","1:91.5.0-2~deb11u1","1:91.5.1-1","1:91.6.0-1","1:91.6.0-1~deb10u1","1:91.6.0-1~deb11u1","1:91.6.0-1~deb9u1","1:91.6.1-1","1:91.6.1-1~deb10u1","1:91.6.1-1~deb11u1","1:91.6.1-1~deb9u1","1:91.6.2-1","1:91.6.2-1~deb10u1","1:91.6.2-1~deb11u1","1:91.6.2-1~deb9u1","1:91.7.0-1","1:91.7.0-2","1:91.7.0-2~deb10u1","1:91.7.0-2~deb11u1","1:91.7.0-2~deb9u1","1:91.8.0-1","1:91.8.0-1~deb10u1","1:91.8.0-1~deb11u1","1:91.8.0-1~deb9u1","1:91.8.1-1","1:91.9.0-1","1:91.9.0-1~deb10u1","1:91.9.0-1~deb11u1","1:91.9.0-1~deb9u1"]},{"source":"osv","ecosystem":"Debian:12","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:102.13.1-1~deb12u1"}]}],"versions":["1:102.11.0-1","1:102.12.0-1","1:102.12.0-1~deb10u1","1:102.12.0-1~deb11u1","1:102.12.0-1~deb12u1","1:102.13.0-1","1:102.13.0-1~deb10u1","1:102.13.0-1~deb11u1","1:102.13.0-1~deb12u1","1:102.13.1-1~deb10u1","1:102.13.1-1~deb11u1"]},{"source":"osv","ecosystem":"Mageia:8","package":"rootcerts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20230720.00-1.mga8"}]}],"bundled":25},{"source":"osv","ecosystem":"Mageia:8","package":"nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.93.0-1.mga8"}]}],"bundled":25},{"source":"osv","ecosystem":"Mageia:8","package":"firefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"102.15.1-1.mga8"}]}],"bundled":25},{"source":"osv","ecosystem":"Mageia:8","package":"firefox-l10n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"102.15.1-1.mga8"}]}],"bundled":25},{"source":"osv","ecosystem":"Mageia:8","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"102.15.1-1.mga8"}]}],"bundled":25},{"source":"osv","ecosystem":"Mageia:8","package":"thunderbird-l10n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"102.15.1-1.mga8"}]}],"bundled":25},{"source":"osv","ecosystem":"Mageia:9","package":"rootcerts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20230720.00-1.mga9"}]}],"bundled":25},{"source":"osv","ecosystem":"Mageia:9","package":"nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.93.0-1.mga9"}]}],"bundled":25},{"source":"osv","ecosystem":"Mageia:9","package":"firefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"115.2.1-1.mga9"}]}],"bundled":25},{"source":"osv","ecosystem":"Mageia:9","package":"firefox-l10n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"115.2.1-1.mga9"}]}],"bundled":25},{"source":"osv","ecosystem":"Mageia:9","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"115.2.2-1.mga9"}]}],"bundled":25},{"source":"osv","ecosystem":"Mageia:9","package":"thunderbird-l10n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"115.2.2-1.mga9"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.1::appstream","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:102.14.0-1.el8_1"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.1::appstream","package":"thunderbird-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:102.14.0-1.el8_1"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.1::appstream","package":"thunderbird-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:102.14.0-1.el8_1"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.6::appstream","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:102.14.0-1.el8_6"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.6::appstream","package":"thunderbird-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:102.14.0-1.el8_6"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.6::appstream","package":"thunderbird-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:102.14.0-1.el8_6"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.0::appstream","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:102.14.0-1.el9_0"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.0::appstream","package":"thunderbird-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:102.14.0-1.el9_0"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.0::appstream","package":"thunderbird-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:102.14.0-1.el9_0"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:102.14.0-1.el7_9"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"thunderbird-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:102.14.0-1.el7_9"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:102.14.0-1.el7_9"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"thunderbird-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:102.14.0-1.el7_9"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:102.14.0-1.el7_9"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"thunderbird-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:102.14.0-1.el7_9"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.2::appstream","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:102.14.0-1.el8_2"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.2::appstream","package":"thunderbird-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:102.14.0-1.el8_2"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.2::appstream","package":"thunderbird-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:102.14.0-1.el8_2"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.2::appstream","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:102.14.0-1.el8_2"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.2::appstream","package":"thunderbird-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:102.14.0-1.el8_2"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.2::appstream","package":"thunderbird-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:102.14.0-1.el8_2"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.2::appstream","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:102.14.0-1.el8_2"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.2::appstream","package":"thunderbird-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:102.14.0-1.el8_2"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.2::appstream","package":"thunderbird-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:102.14.0-1.el8_2"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:102.14.0-1.el8_8"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"thunderbird-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:102.14.0-1.el8_8"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"thunderbird-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:102.14.0-1.el8_8"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:102.14.0-1.el9_2"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"thunderbird-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:102.14.0-1.el9_2"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"thunderbird-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:102.14.0-1.el9_2"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:102.14.0-1.el8_4"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"thunderbird-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:102.14.0-1.el8_4"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"thunderbird-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:102.14.0-1.el8_4"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.4::appstream","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:102.14.0-1.el8_4"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.4::appstream","package":"thunderbird-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:102.14.0-1.el8_4"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.4::appstream","package":"thunderbird-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:102.14.0-1.el8_4"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.4::appstream","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:102.14.0-1.el8_4"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.4::appstream","package":"thunderbird-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:102.14.0-1.el8_4"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.4::appstream","package":"thunderbird-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:102.14.0-1.el8_4"}]}],"bundled":10},{"source":"osv","ecosystem":"Rocky Linux:8","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:102.14.0-1.el8_8"}]}],"bundled":10},{"source":"osv","ecosystem":"Rocky Linux:9","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:102.14.0-1.el9_2"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP4","package":"MozillaThunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"115.0.1-150200.8.124.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP5","package":"MozillaThunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"115.0.1-150200.8.124.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP4","package":"MozillaThunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"115.0.1-150200.8.124.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP5","package":"MozillaThunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"115.0.1-150200.8.124.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"MozillaThunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"115.0.1-150200.8.124.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"MozillaThunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"115.0.1-150200.8.124.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:102.15.0+build1-0ubuntu0.20.04.1"}]}],"versions":["1:68.1.2+build1-0ubuntu1","1:68.1.2+build1-0ubuntu2","1:68.2.1+build1-0ubuntu1","1:68.2.2+build1-0ubuntu1","1:68.3.0+build2-0ubuntu1","1:68.3.1+build1-0ubuntu2","1:68.4.1+build1-0ubuntu1","1:68.4.2+build2-0ubuntu1","1:68.5.0+build1-0ubuntu1","1:68.6.0+build2-0ubuntu1","1:68.7.0+build1-0ubuntu1","1:68.7.0+build1-0ubuntu2","1:68.8.0+build2-0ubuntu0.20.04.2","1:68.10.0+build1-0ubuntu0.20.04.1","1:78.7.1+build1-0ubuntu0.20.04.1","1:78.8.1+build1-0ubuntu0.20.04.1","1:78.11.0+build1-0ubuntu0.20.04.2","1:78.13.0+build1-0ubuntu0.20.04.2","1:78.14.0+build1-0ubuntu0.20.04.1","1:78.14.0+build1-0ubuntu0.20.04.2","1:91.5.0+build1-0ubuntu0.20.04.1","1:91.7.0+build2-0ubuntu0.20.04.1","1:91.8.1+build1-0ubuntu0.20.04.1","1:91.9.1+build1-0ubuntu0.20.04.1","1:91.11.0+build2-0ubuntu0.20.04.1","1:102.2.2+build1-0ubuntu0.20.04.1","1:102.4.2+build2-0ubuntu0.20.04.1","1:102.7.1+build2-0ubuntu0.20.04.1","1:102.8.0+build2-0ubuntu0.20.04.1","1:102.9.0+build1-0ubuntu0.20.04.1","1:102.10.0+build2-0ubuntu0.20.04.1","1:102.11.0+build1-0ubuntu0.20.04.1","1:102.13.0+build1-0ubuntu0.20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:102.15.0+build1-0ubuntu0.22.04.1"}]}],"versions":["1:91.1.2+build1-0ubuntu1","1:91.3.0+build2-0ubuntu1","1:91.3.1+build1-0ubuntu1","1:91.3.2+build1-0ubuntu1","1:91.4.0+build1.1-0ubuntu1","1:91.4.0+build2-0ubuntu1","1:91.5.0+build1-0ubuntu1","1:91.5.1+build1-0ubuntu1","1:91.6.1+build1-0ubuntu1","1:91.7.0+build1-0ubuntu1","1:91.7.0+build2-0ubuntu1","1:91.8.0+build2-0ubuntu1","1:91.9.1+build1-0ubuntu0.22.04.1","1:91.11.0+build2-0ubuntu0.22.04.1","1:102.2.2+build1-0ubuntu0.22.04.1","1:102.4.2+build2-0ubuntu0.22.04.1","1:102.7.1+build2-0ubuntu0.22.04.1","1:102.8.0+build2-0ubuntu0.22.04.1","1:102.9.0+build1-0ubuntu0.22.04.1","1:102.10.0+build2-0ubuntu0.22.04.1","1:102.11.0+build1-0ubuntu0.22.04.1","1:102.13.0+build1-0ubuntu0.22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:102.15.0+build1-0ubuntu0.20.04.1"}]}],"versions":["1:68.1.2+build1-0ubuntu1","1:68.1.2+build1-0ubuntu2","1:68.2.1+build1-0ubuntu1","1:68.2.2+build1-0ubuntu1","1:68.3.0+build2-0ubuntu1","1:68.3.1+build1-0ubuntu2","1:68.4.1+build1-0ubuntu1","1:68.4.2+build2-0ubuntu1","1:68.5.0+build1-0ubuntu1","1:68.6.0+build2-0ubuntu1","1:68.7.0+build1-0ubuntu1","1:68.7.0+build1-0ubuntu2","1:68.8.0+build2-0ubuntu0.20.04.2","1:68.10.0+build1-0ubuntu0.20.04.1","1:78.7.1+build1-0ubuntu0.20.04.1","1:78.8.1+build1-0ubuntu0.20.04.1","1:78.11.0+build1-0ubuntu0.20.04.2","1:78.13.0+build1-0ubuntu0.20.04.2","1:78.14.0+build1-0ubuntu0.20.04.1","1:78.14.0+build1-0ubuntu0.20.04.2","1:91.5.0+build1-0ubuntu0.20.04.1","1:91.7.0+build2-0ubuntu0.20.04.1","1:91.8.1+build1-0ubuntu0.20.04.1","1:91.9.1+build1-0ubuntu0.20.04.1","1:91.11.0+build2-0ubuntu0.20.04.1","1:102.2.2+build1-0ubuntu0.20.04.1","1:102.4.2+build2-0ubuntu0.20.04.1","1:102.7.1+build2-0ubuntu0.20.04.1","1:102.8.0+build2-0ubuntu0.20.04.1","1:102.9.0+build1-0ubuntu0.20.04.1","1:102.10.0+build2-0ubuntu0.20.04.1","1:102.11.0+build1-0ubuntu0.20.04.1","1:102.13.0+build1-0ubuntu0.20.04.1"],"bundled":9},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:102.15.0+build1-0ubuntu0.22.04.1"}]}],"versions":["1:91.1.2+build1-0ubuntu1","1:91.3.0+build2-0ubuntu1","1:91.3.1+build1-0ubuntu1","1:91.3.2+build1-0ubuntu1","1:91.4.0+build1.1-0ubuntu1","1:91.4.0+build2-0ubuntu1","1:91.5.0+build1-0ubuntu1","1:91.5.1+build1-0ubuntu1","1:91.6.1+build1-0ubuntu1","1:91.7.0+build1-0ubuntu1","1:91.7.0+build2-0ubuntu1","1:91.8.0+build2-0ubuntu1","1:91.9.1+build1-0ubuntu0.22.04.1","1:91.11.0+build2-0ubuntu0.22.04.1","1:102.2.2+build1-0ubuntu0.22.04.1","1:102.4.2+build2-0ubuntu0.22.04.1","1:102.7.1+build2-0ubuntu0.22.04.1","1:102.8.0+build2-0ubuntu0.22.04.1","1:102.9.0+build1-0ubuntu0.22.04.1","1:102.10.0+build2-0ubuntu0.22.04.1","1:102.11.0+build1-0ubuntu0.22.04.1","1:102.13.0+build1-0ubuntu0.22.04.1"],"bundled":9},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"MozillaThunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"102.13.1-1.1"}]}]}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"mozilla","product":"thunderbird"}],"references":[{"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=1835582","tags":["x_transferred","Permissions Required","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2023/07/msg00032.html","tags":["x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://www.debian.org/security/2023/dsa-5463","tags":["x_transferred","Third Party Advisory","advisory"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2023-27/","tags":["x_transferred","Vendor Advisory","advisory","report"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2023-28/","tags":["x_transferred","Vendor Advisory","advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-3417","tags":["advisory"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2023-27"},{"url":"https://www.mozilla.org/security/advisories/mfsa2023-28"},{"url":"https://github.com/advisories/GHSA-xpxg-5vmj-vx9g"},{"url":"https://access.redhat.com/errata/RHSA-2023:4497","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-3417","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-4045","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-4046","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-4047","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-4048","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-4049","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-4050","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-4055","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-4056","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-4057","tags":["report"]},{"url":"https://bugzilla.redhat.com/2225325","tags":["report"]},{"url":"https://bugzilla.redhat.com/2228360","tags":["report"]},{"url":"https://bugzilla.redhat.com/2228361","tags":["report"]},{"url":"https://bugzilla.redhat.com/2228362","tags":["report"]},{"url":"https://bugzilla.redhat.com/2228363","tags":["report"]},{"url":"https://bugzilla.redhat.com/2228364","tags":["report"]},{"url":"https://bugzilla.redhat.com/2228365","tags":["report"]},{"url":"https://bugzilla.redhat.com/2228367","tags":["report"]},{"url":"https://bugzilla.redhat.com/2228370","tags":["report"]},{"url":"https://bugzilla.redhat.com/2228371","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2023-4497.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2023:4499","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2023-4499.html","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-3417","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2023-0266.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=32258","tags":["report"]},{"url":"https://www.mozilla.org/en-US/firefox/115.0.1/releasenotes/","tags":["web"]},{"url":"https://www.mozilla.org/en-US/firefox/115.0.2/releasenotes/","tags":["web"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2023-26/","tags":["advisory"]},{"url":"https://www.mozilla.org/en-US/firefox/115.0.3/releasenotes/","tags":["web"]},{"url":"https://www.mozilla.org/en-US/firefox/115.1.0/releasenotes/","tags":["web"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2023-31/","tags":["advisory"]},{"url":"https://www.mozilla.org/en-US/firefox/115.2.0/releasenotes/","tags":["web"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2023-36/","tags":["advisory"]},{"url":"https://firefox-source-docs.mozilla.org/security/nss/releases/nss_3_93.html","tags":["web"]},{"url":"https://firefox-source-docs.mozilla.org/security/nss/releases/index.html","tags":["web"]},{"url":"https://www.thunderbird.net/en-US/thunderbird/115.0/releasenotes/","tags":["web"]},{"url":"https://www.thunderbird.net/en-US/thunderbird/115.0.1/releasenotes/","tags":["web"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2023-27/","tags":["advisory"]},{"url":"https://www.thunderbird.net/en-US/thunderbird/115.1.0/releasenotes/","tags":["web"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2023-33/","tags":["advisory"]},{"url":"https://www.thunderbird.net/en-US/thunderbird/115.1.1/releasenotes/","tags":["web"]},{"url":"https://www.thunderbird.net/en-US/thunderbird/115.2.0/releasenotes/","tags":["web"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2023-38/","tags":["advisory"]},{"url":"https://www.mozilla.org/en-US/firefox/115.2.1/releasenotes/","tags":["web"]},{"url":"https://www.thunderbird.net/en-US/thunderbird/115.2.1/releasenotes/","tags":["web"]},{"url":"https://www.thunderbird.net/en-US/thunderbird/115.2.2/releasenotes/","tags":["web"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2023-40/","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2023:4492","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2225325","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2228360","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2228361","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2228362","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2228363","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2228364","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2228365","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2228367","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2228370","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2228371","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_4492.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-3417","tags":["advisory","report"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2023-27/#CVE-2023-3417","tags":["article","report"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2023-28/#CVE-2023-3417","tags":["article","report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-4045","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-4045","tags":["advisory"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2023-30/#CVE-2023-4045","tags":["article"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2023-31/#CVE-2023-4045","tags":["article"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2023-32/#CVE-2023-4045","tags":["article"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2023-33/#CVE-2023-4045","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-4046","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-4046","tags":["advisory"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2023-30/#CVE-2023-4046","tags":["article"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2023-31/#CVE-2023-4046","tags":["article"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2023-32/#CVE-2023-4046","tags":["article"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2023-33/#CVE-2023-4046","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-4047","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-4047","tags":["advisory"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2023-30/#CVE-2023-4047","tags":["article"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2023-31/#CVE-2023-4047","tags":["article"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2023-32/#CVE-2023-4047","tags":["article"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2023-33/#CVE-2023-4047","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-4048","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-4048","tags":["advisory"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2023-30/#CVE-2023-4048","tags":["article"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2023-31/#CVE-2023-4048","tags":["article"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2023-32/#CVE-2023-4048","tags":["article"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2023-33/#CVE-2023-4048","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-4049","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-4049","tags":["advisory"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2023-30/#CVE-2023-4049","tags":["article"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2023-31/#CVE-2023-4049","tags":["article"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2023-32/#CVE-2023-4049","tags":["article"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2023-33/#CVE-2023-4049","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-4050","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-4050","tags":["advisory"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2023-30/#CVE-2023-4050","tags":["article"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2023-31/#CVE-2023-4050","tags":["article"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2023-32/#CVE-2023-4050","tags":["article"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2023-33/#CVE-2023-4050","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-4055","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-4055","tags":["advisory"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2023-30/#CVE-2023-4055","tags":["article"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2023-31/#CVE-2023-4055","tags":["article"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2023-32/#CVE-2023-4055","tags":["article"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2023-33/#CVE-2023-4055","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-4056","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-4056","tags":["advisory"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2023-30/#CVE-2023-4056","tags":["article"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2023-31/#CVE-2023-4056","tags":["article"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2023-32/#CVE-2023-4056","tags":["article"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2023-33/#CVE-2023-4056","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-4057","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-4057","tags":["advisory"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2023-31/#CVE-2023-4057","tags":["article"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2023-33/#CVE-2023-4057","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2023:4493","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_4493.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2023:4494","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_4494.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2023:4495","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_4495.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2023:4496","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_4496.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_4497.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_4499.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2023:4500","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_4500.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2023:4497","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2023:4499","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20233059-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1212438","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-3417","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-3600","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2023-3417","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-6333-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2023-4045","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-4046","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-4047","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-4048","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-4049","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-4050","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-4055","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-4056","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2023-3417","title":"File Extension Spoofing using the Text Direction Override Character","description":"Thunderbird allowed the Text Direction Override Unicode Character in filenames. An email attachment could be incorrectly shown as being a document file, while in  fact it was an executable file. Newer versions of Thunderbird will strip the character and show the correct file extension. This vulnerability affects Thunderbird \u003c 115.0.1 and Thunderbird \u003c 102.13.1.","status":"published","published":"2023-07-24T10:09:37.591Z","modified":"2025-12-18T15:22:50.216Z","updated_at":"2026-11-02T14:35:24.707957Z"}],"euvd":[{"id":"EUVD-2023-44083","description":"Thunderbird allowed the Text Direction Override Unicode Character in filenames. An email attachment could be incorrectly shown as being a document file, while in  fact it was an executable file. Newer versions of Thunderbird will strip the character and show the correct file extension. This vulnerability affects Thunderbird \u003c 115.0.1 and Thunderbird \u003c 102.13.1.","status":"published","published":"2023-07-24T10:09:37Z","modified":"2025-12-18T15:22:50Z","updated_at":"2026-11-02T19:49:03.071772Z"}],"ghsa":[{"id":"GHSA-xpxg-5vmj-vx9g","title":"Thunderbird allowed the Text Direction Override Unicode Character in filenames. An email...","description":"Thunderbird allowed the Text Direction Override Unicode Character in filenames. An email attachment could be incorrectly shown as being a document file, while in  fact it was an executable file. Newer versions of Thunderbird will strip the character and show the correct file extension. This vulnerability affects Thunderbird \u003c 115.0.1.","status":"published","published":"2023-07-24T12:31:22Z","modified":"2024-04-04T06:19:52Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T14:56:40.949889Z"}],"nvd":[{"id":"CVE-2023-3417","description":"Thunderbird allowed the Text Direction Override Unicode Character in filenames. An email attachment could be incorrectly shown as being a document file, while in  fact it was an executable file. Newer versions of Thunderbird will strip the character and show the correct file extension. This vulnerability affects Thunderbird \u003c 115.0.1 and Thunderbird \u003c 102.13.1.","status":"published","published":"2023-07-24T11:15:09.953Z","modified":"2026-06-17T06:14:01.93Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"primary"}],"updated_at":"2026-11-02T14:08:18.687088Z"}],"osv":[{"id":"CVE-2023-3417","description":"Thunderbird allowed the Text Direction Override Unicode Character in filenames. An email attachment could be incorrectly shown as being a document file, while in  fact it was an executable file. Newer versions of Thunderbird will strip the character and show the correct file extension. This vulnerability affects Thunderbird \u003c 115.0.1 and Thunderbird \u003c 102.13.1.","status":"published","published":"2023-07-24T11:15:09.953Z","modified":"2026-04-16T04:33:28.653877282Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:44:32.116263Z"},{"id":"DEBIAN-CVE-2023-3417","description":"Thunderbird allowed the Text Direction Override Unicode Character in filenames. An email attachment could be incorrectly shown as being a document file, while in  fact it was an executable file. Newer versions of Thunderbird will strip the character and show the correct file extension. This vulnerability affects Thunderbird \u003c 115.0.1 and Thunderbird \u003c 102.13.1.","status":"published","published":"2023-07-24T11:15:09.953Z","modified":"2026-10-26T18:02:28.959212542Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:39.679062Z"},{"id":"RHSA-2023:4492","title":"Red Hat Security Advisory: thunderbird security update","status":"published","published":"2024-09-16T12:38:49Z","modified":"2026-06-26T11:06:20Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:11.154197Z"},{"id":"RHSA-2023:4493","title":"Red Hat Security Advisory: thunderbird security update","status":"published","published":"2024-09-16T12:39:08Z","modified":"2026-06-26T11:06:21Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:11.154197Z"},{"id":"RHSA-2023:4494","title":"Red Hat Security Advisory: thunderbird security update","status":"published","published":"2024-09-16T12:39:18Z","modified":"2026-06-26T11:06:21Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:11.154197Z"},{"id":"RHSA-2023:4495","title":"Red Hat Security Advisory: thunderbird security update","status":"published","published":"2024-09-16T12:39:37Z","modified":"2026-06-26T11:06:22Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:11.154197Z"},{"id":"RHSA-2023:4496","title":"Red Hat Security Advisory: thunderbird security update","status":"published","published":"2024-09-16T12:39:56Z","modified":"2026-06-26T11:06:22Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:11.154197Z"},{"id":"RHSA-2023:4497","title":"Red Hat Security Advisory: thunderbird security update","status":"published","published":"2024-09-16T12:38:58Z","modified":"2026-06-26T11:06:23Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:11.154197Z"},{"id":"RHSA-2023:4499","title":"Red Hat Security Advisory: thunderbird security update","status":"published","published":"2024-09-16T12:39:28Z","modified":"2026-06-26T11:06:24Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:11.154197Z"},{"id":"RHSA-2023:4500","title":"Red Hat Security Advisory: thunderbird security update","status":"published","published":"2024-09-16T12:39:47Z","modified":"2026-06-26T11:06:25Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:11.154197Z"},{"id":"RLSA-2023:4497","title":"Important: thunderbird security update","description":"Mozilla Thunderbird is a standalone mail and newsgroup client.\n\nThis update upgrades Thunderbird to version 102.14.0.\n\nSecurity Fix(es):\n\n* Mozilla: Offscreen Canvas could have bypassed cross-origin restrictions (CVE-2023-4045)\n\n* Mozilla: Incorrect value used during WASM compilation (CVE-2023-4046)\n\n* Mozilla: Potential permissions request bypass via clickjacking (CVE-2023-4047)\n\n* Mozilla: Crash in DOMParser due to out-of-memory conditions (CVE-2023-4048)\n\n* Mozilla: Fix potential race conditions when releasing platform objects (CVE-2023-4049)\n\n* Mozilla: Stack buffer overflow in StorageManager (CVE-2023-4050)\n\n* Mozilla: Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1, Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14 (CVE-2023-4056)\n\n* Mozilla: Memory safety bugs fixed in Firefox ESR 115.1, and Thunderbird 115.1 (CVE-2023-4057)\n\n* thunderbird: File Extension Spoofing using the Text Direction Override Character (CVE-2023-3417)\n\n* Mozilla: Cookie jar overflow caused unexpected cookie jar state (CVE-2023-4055)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2023-08-08T12:34:39.911838Z","modified":"2026-02-05T10:15:04.153252Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:24.63379Z"},{"id":"RLSA-2023:4499","title":"Important: thunderbird security update","description":"Mozilla Thunderbird is a standalone mail and newsgroup client.\n\nThis update upgrades Thunderbird to version 102.14.0.\n\nSecurity Fix(es):\n\n* Mozilla: Offscreen Canvas could have bypassed cross-origin restrictions (CVE-2023-4045)\n\n* Mozilla: Incorrect value used during WASM compilation (CVE-2023-4046)\n\n* Mozilla: Potential permissions request bypass via clickjacking (CVE-2023-4047)\n\n* Mozilla: Crash in DOMParser due to out-of-memory conditions (CVE-2023-4048)\n\n* Mozilla: Fix potential race conditions when releasing platform objects (CVE-2023-4049)\n\n* Mozilla: Stack buffer overflow in StorageManager (CVE-2023-4050)\n\n* Mozilla: Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1, Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14 (CVE-2023-4056)\n\n* Mozilla: Memory safety bugs fixed in Firefox ESR 115.1, and Thunderbird 115.1 (CVE-2023-4057)\n\n* thunderbird: File Extension Spoofing using the Text Direction Override Character (CVE-2023-3417)\n\n* Mozilla: Cookie jar overflow caused unexpected cookie jar state (CVE-2023-4055)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2023-08-08T12:35:00.861167Z","modified":"2026-02-05T04:45:08.545992Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:24.63379Z"},{"id":"UBUNTU-CVE-2023-3417","description":"Thunderbird allowed the Text Direction Override Unicode Character in filenames. An email attachment could be incorrectly shown as being a document file, while in  fact it was an executable file. Newer versions of Thunderbird will strip the character and show the correct file extension. This vulnerability affects Thunderbird \u003c 115.0.1 and Thunderbird \u003c 102.13.1.","status":"published","published":"2023-07-24T11:15:00Z","modified":"2026-04-22T14:07:35.3364Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T16:54:21.882004Z"},{"id":"ALSA-2023:4497","title":"Important: thunderbird security update","description":"Mozilla Thunderbird is a standalone mail and newsgroup client.\n\nThis update upgrades Thunderbird to version 102.14.0.\n\nSecurity Fix(es):\n\n* Mozilla: Offscreen Canvas could have bypassed cross-origin restrictions (CVE-2023-4045)\n* Mozilla: Incorrect value used during WASM compilation (CVE-2023-4046)\n* Mozilla: Potential permissions request bypass via clickjacking (CVE-2023-4047)\n* Mozilla: Crash in DOMParser due to out-of-memory conditions (CVE-2023-4048)\n* Mozilla: Fix potential race conditions when releasing platform objects (CVE-2023-4049)\n* Mozilla: Stack buffer overflow in StorageManager (CVE-2023-4050)\n* Mozilla: Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1, Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14 (CVE-2023-4056)\n* Mozilla: Memory safety bugs fixed in Firefox ESR 115.1, and Thunderbird 115.1 (CVE-2023-4057)\n* thunderbird: File Extension Spoofing using the Text Direction Override Character (CVE-2023-3417)\n* Mozilla: Cookie jar overflow caused unexpected cookie jar state (CVE-2023-4055)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2023-08-07T00:00:00Z","modified":"2026-10-29T11:02:19.267283028Z","updated_at":"2026-11-02T15:27:52.091404Z"},{"id":"ALSA-2023:4499","title":"Important: thunderbird security update","description":"Mozilla Thunderbird is a standalone mail and newsgroup client.\n\nThis update upgrades Thunderbird to version 102.14.0.\n\nSecurity Fix(es):\n\n* Mozilla: Offscreen Canvas could have bypassed cross-origin restrictions (CVE-2023-4045)\n* Mozilla: Incorrect value used during WASM compilation (CVE-2023-4046)\n* Mozilla: Potential permissions request bypass via clickjacking (CVE-2023-4047)\n* Mozilla: Crash in DOMParser due to out-of-memory conditions (CVE-2023-4048)\n* Mozilla: Fix potential race conditions when releasing platform objects (CVE-2023-4049)\n* Mozilla: Stack buffer overflow in StorageManager (CVE-2023-4050)\n* Mozilla: Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1, Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14 (CVE-2023-4056)\n* Mozilla: Memory safety bugs fixed in Firefox ESR 115.1, and Thunderbird 115.1 (CVE-2023-4057)\n* thunderbird: File Extension Spoofing using the Text Direction Override Character (CVE-2023-3417)\n* Mozilla: Cookie jar overflow caused unexpected cookie jar state (CVE-2023-4055)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2023-08-07T00:00:00Z","modified":"2026-10-29T11:31:30.342153851Z","updated_at":"2026-11-02T15:27:52.091404Z"},{"id":"DLA-3510-1","title":"thunderbird - security update","status":"published","published":"2023-07-31T00:00:00Z","modified":"2026-03-09T01:18:10.919233Z","updated_at":"2026-11-02T15:46:11.734021Z"},{"id":"DSA-5463-1","title":"thunderbird - security update","status":"published","published":"2023-07-30T00:00:00Z","modified":"2026-03-09T02:09:28.925986Z","updated_at":"2026-11-02T15:46:17.892347Z"},{"id":"MGASA-2023-0266","title":"Updated firefox/thunderbird packages fix security vulnerability","description":"Use-after-free in workers. (CVE-2023-3600)\n\nFile Extension Spoofing using the Text Direction Override Character.\n(CVE-2023-3417)\n\nOffscreen Canvas could have bypassed cross-origin restrictions.\n(CVE-2023-4045)\n\nIncorrect value used during WASM compilation. (CVE-2023-4046)\n\nPotential permissions request bypass via clickjacking. (CVE-2023-4047)\n\nCrash in DOMParser due to out-of-memory conditions. (CVE-2023-4048)\n\nFix potential race conditions when releasing platform objects.\n(CVE-2023-4049)\n\nStack buffer overflow in StorageManager. (CVE-2023-4050)\n\nCookie jar overflow caused unexpected cookie jar state. (CVE-2023-4055)\n\nMemory safety bugs fixed in Firefox 116, Firefox ESR 115.1, Firefox ESR\n102.14, Thunderbird 115.1, and Thunderbird 102.14. (CVE-2023-4056)\n\nMemory safety bugs fixed in Firefox 116, Firefox ESR 115.1, and\nThunderbird 115.1. (CVE-2023-4057)\n\nMemory corruption in IPC CanvasTranslator. (CVE-2023-4573)\n\nMemory corruption in IPC ColorPickerShownCallback. (CVE-2023-4574)\n\nMemory corruption in IPC FilePickerShownCallback. (CVE-2023-4575)\n\nInteger Overflow in RecordedSourceSurfaceCreation. (CVE-2023-4576)\n\nMemory corruption in JIT UpdateRegExpStatics. (CVE-2023-4577)\n\nFull screen notification obscured by file open dialog. (CVE-2023-4051)\n\nError reporting methods in SpiderMonkey could have triggered an Out of\nMemory Exception. (CVE-2023-4578)\n\nFull screen notification obscured by external program. (CVE-2023-4053)\n\nPush notifications saved to disk unencrypted. (CVE-2023-4580)\n\nXLL file extensions were downloadable without warnings. (CVE-2023-4581)\n\nBrowsing Context potentially not cleared when closing Private Window.\n(CVE-2023-4583)\n\nMemory safety bugs fixed in Firefox 117, Firefox ESR 102.15, Firefox ESR\n115.2, Thunderbird 102.15, and Thunderbird 115.2. (CVE-2023-4584)\n\nMemory safety bugs fixed in Firefox 117, Firefox ESR 115.2, and\nThunderbird 115.2. (CVE-2023-4585)\n\nHeap buffer overflow in libwebp. (CVE-2023-4863)\n","status":"published","published":"2023-09-24T22:16:18Z","modified":"2026-04-16T04:41:02.744328295Z","updated_at":"2026-11-02T15:49:42.263076Z"},{"id":"openSUSE-SU-2024:13072-1","title":"MozillaThunderbird-102.13.1-1.1 on GA media","description":"These are all security issues fixed in the MozillaThunderbird-102.13.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:02:53.906588Z","updated_at":"2026-11-02T16:58:36.025801Z"},{"id":"SUSE-SU-2023:3059-1","title":"Security update for MozillaThunderbird","description":"This update for MozillaThunderbird fixes the following issues:\n\n  Mozilla Thunderbird was updated to version 115.0.1 (bsc#1212438):\n\n  - CVE-2023-3600: Fixed use-after-free in workers (bmo#1839703).\n  - CVE-2023-3417: Fixed File Extension Spoofing using the Text Direction Override Character (bmo#1835582).\n\n  Bugfixes: \n\n  - changed: Added Thunderbird Supernova branding to about:dialog\n    (bmo#1842102)\n  - fixed: Message list was not updated when message was deleted\n    from server outside of Thunderbird (bmo#1837041)\n  - fixed: Scrolling behaved unexpectedly when moving to next\n    message unread message in another folder (bmo#1841711)\n  - fixed: Scrolling animation was unnecessarily used when\n    switching or toggling the sort column in message list\n    (bmo#1838522)\n  - fixed: Attempting to delete a message and then cancelling the\n    action still marked the message as read (bmo#793353)\n  - fixed: Unified Toolbar could not be customized under certain\n    tabs (bmo#1841480)\n  - fixed: Selecting a folder with one or more subfolders and\n    pressing enter did not expand folder (bmo#1841200)\n  - fixed: Tooltips did not appear when hovering over folders\n    (bmo#1839780)\n  - fixed: Deleting large amounts of messages from Trash folder\n    consumed excessive time and memory (bmo#1833665)\n  - fixed: Message Summary header buttons were not keyboard\n    accessible (bmo#1827199)\n  - fixed: 'New' button in Message Filters dialog was not\n    keyboard accessible (bmo#1841477)\n  - fixed: Backing up secret keys from OpenPGP Key Manager dialog\n    silently failed (bmo#1839415)\n  - fixed: Various visual and UX improvements\n    (bmo#1843172,bmo#1831422,bmo#1838360,bmo#1842319)\n","status":"published","published":"2023-07-31T11:13:57Z","modified":"2026-02-04T04:29:29.898349Z","updated_at":"2026-11-02T15:53:53.019382Z"},{"id":"USN-6333-1","title":"thunderbird vulnerabilities","description":"Junsung Lee discovered that Thunderbird did not properly validate the text\ndirection override unicode character in filenames. An attacker could\npotentially exploits this issue by spoofing file extension while attaching\na file in emails. (CVE-2023-3417)\n\nMax Vlasov discovered that Thunderbird Offscreen Canvas did not properly\ntrack cross-origin tainting. An attacker could potentially exploit this\nissue to access image data from another site in violation of same-origin\npolicy. (CVE-2023-4045)\n\nAlexander Guryanov discovered that Thunderbird did not properly update the\nvalue of a global variable in WASM JIT analysis in some circumstances. An\nattacker could potentially exploit this issue to cause a denial of service.\n(CVE-2023-4046)\n\nMark Brand discovered that Thunderbird did not properly validate the size\nof an untrusted input stream. An attacker could potentially exploit this\nissue to cause a denial of service. (CVE-2023-4050)\n\nMultiple security issues were discovered in Thunderbird. If a user were\ntricked into opening a specially crafted website in a browsing context, an\nattacker could potentially exploit these to cause a denial of service,\nobtain sensitive information, bypass security restrictions, cross-site\ntracing, or execute arbitrary code. (CVE-2023-4047, CVE-2023-4048,\nCVE-2023-4049, CVE-2023-4055, CVE-2023-4056)\n","status":"published","published":"2023-09-04T04:07:45Z","modified":"2026-04-22T10:38:19.192954Z","updated_at":"2026-11-02T16:58:17.305935Z"}]}}