Vulnerability · Published Jun 2, 2023 · Assigned by mozilla
CVE-2023-0616
Medium 6.5
In plain English
A medium-severity resource allocation without limits in Thunderbird from Mozilla. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 42% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
If a MIME email combines OpenPGP and OpenPGP MIME data in a certain way Thunderbird repeatedly attempts to process and display the message, which could cause Thunderbird's user interface to lock up and no longer respond to the user's actions. An attacker could send a crafted message with this structure to attempt a DoS attack. This vulnerability affects Thunderbird < 102.8.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | thunderbird | 102.8.0-2.el8_7.alma | ALSA-2023:0821 |
| AlmaLinux:9 | thunderbird | 102.8.0-2.el9_1.alma | ALSA-2023:0824 |
| Debian:12 | thunderbird | 1:102.8.0-1 | DEBIAN-CVE-2023-0616 |
| Debian:13 | thunderbird | 1:102.8.0-1 | DEBIAN-CVE-2023-0616 |
| Debian:14 | thunderbird | 1:102.8.0-1 | DEBIAN-CVE-2023-0616 |
| Rocky Linux:8 | thunderbird | 0:102.8.0-2.el8_7 | RLSA-2023:0821 |
| Rocky Linux:9 | thunderbird | 0:102.8.0-2.el9_1 | RLSA-2023:0824 |
| Ubuntu:22.04:LTS | thunderbird | 1:102.8.0+build2-0ubuntu0.22.04.1 | UBUNTU-CVE-2023-0616 |
| Ubuntu:22.04:LTS | thunderbird | 1:102.8.0+build2-0ubuntu0.22.04.1 | USN-5943-1 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Mozilla | Thunderbird | unspecified – before 102.8 |
Weakness: CWE-770 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H