CVE-2026-118179: Mozilla Thunderbird

Описание

Оригинално описание

Clicking a news: or snews: link that referenced a message-ID made Thunderbird connect, without asking, to the host and port given in the link, even if it was not a configured news server. Line breaks in the message-ID were sent to the server unmodified, so a crafted link could send arbitrary commands to services reachable from the user's network. In addition, snews: links to such servers connected without TLS. This vulnerability was fixed in Thunderbird 159 and Thunderbird 153.6.

Засегнати продукти

• Mozilla Thunderbird: 153.6 до 153.*; от 159 нататък

История

Други уязвимости в Mozilla Thunderbird

• CVE-2026-118180
• CVE-2026-118177
• CVE-2026-118178
• CVE-2026-118176
• CVE-2026-118175

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2026-118179
• https://nvd.nist.gov/vuln/detail/CVE-2026-118179
• https://bugzilla.mozilla.org/show_bug.cgi?id=2077789
• https://www.mozilla.org/security/advisories/mfsa2026-121/
• https://www.mozilla.org/security/advisories/mfsa2026-122/