Spoofing attack in Mozilla Thunderbird - CVE-2020-12397

Vulnerability identifier: #VU27572

CSH Severity: Low

CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-12397

CWE-ID: CWE-451

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform spoofing attack.

The vulnerability exists due to incorrect processing of sender email addresses. A remote attacker can spoof an email address using encoded Unicode characters.

Mozilla Thunderbird
Arch Linux
Gentoo Linux
CentOS
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, big endian
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Opensuse
Red Hat Enterprise Linux Server for x86_64 - Update Services for SAP Solutions
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
thunderbird (Ubuntu package)
thunderbird (Red Hat package)
thunderbird (Debian package)
thunderbird (Alpine package)

Install updates from vendor's website.

Mozilla Thunderbird - update to 68.8.0
thunderbird (Ubuntu package) - addressed in versions 1:68.8.0+build2-0ubuntu0.16.04.2, 1:68.8.0+build2-0ubuntu0.18.04.2, 1:68.8.0+build2-0ubuntu0.19.10.2, 1:68.8.0+build2-0ubuntu0.20.04.2
thunderbird (Red Hat package) - addressed in versions 68.8.0-1.el6_10, 68.8.0-1.el7_8, 68.8.0-1.el8_0, 68.8.0-1.el8_1, 68.8.0-1.el8_2
thunderbird (Debian package) - addressed in versions 1:68.8.0-1~deb8u1, 1:68.8.0-1~deb9u1, 1:68.8.0-1~deb10u1
thunderbird (Alpine package) - update to 68.8.0-r0

• https://www.mozilla.org/en-US/security/advisories/mfsa2020-18/

• Multiple vulnerabilities in Mozilla Thunderbird
• Arch Linux update for thunderbird
• Debian update for thunderbird
• OpenSUSE Linux update for MozillaThunderbird
• Red Hat Enterprise Linux 8 update for thunderbird
• Red Hat Enterprise Linux 8 update for thunderbird
• Red Hat Enterprise Linux 8 update for thunderbird
• Red Hat Enterprise Linux 6 update for thunderbird
• Red Hat Enterprise Linux 7 update for thunderbird
• Gentoo update for Mozilla Thunderbird
• CentOS 6 update for thunderbird
• CentOS 7 update for thunderbird
• Ubuntu update for Thunderbird
• Spoofing attack in thunderbird (Alpine package)