Description
The HTML rendering engine in Mozilla Thunderbird 1.5, when "Block loading of remote images in mail messages" is enabled, does not properly block external images from inline HTML attachments, which could allow remote attackers to obtain sensitive information, such as application version or IP address, when the user reads the email and the external image is accessed.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | thunderbird | 1.5.0.2-1 | — |
| Debian 13 | thunderbird | 1.5.0.2-1 | — |
| Debian 12 | thunderbird | 1.5.0.2-1 | — |
| Debian 3.1 | mozilla | 2:1.7.8-1sarge5 | DSA-1046-1 |
| Debian 3.1 | mozilla-thunderbird | 1.0.2-2.sarge1.0.8 | DSA-1051-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 4 | thunderbird | 1.0.8-1.4.1 | RHSA-2006:0330 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Exploit-DB 1
- Mozilla Thunderbird 1.5 - Multiple Remote Information Disclosure Vulnerabilities EDB-27337 · webapps · Feb 28, 2006 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 3
- RHSA-2006:0330 Red Hat Security Advisory: thunderbird security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1046-1 mozilla - several Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1051-1 mozilla-thunderbird - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
References
- http://www.mozilla.org/security/announce/2006/mfsa2006-26.html
- RHSA-2006:0330 vendor-advisory
- 19902 third-party-advisory
- USN-276-1 vendor-advisory
- 19941 third-party-advisory
- oval:org.mitre.oval:def:1975 vdb-entry signature
- 19821 third-party-advisory
- oval:org.mitre.oval:def:10254 vdb-entry signature
- 19823 third-party-advisory
- DSA-1051 vendor-advisory
- ADV-2006-3749 vdb-entry
- GLSA-200604-18 vendor-advisory
- ADV-2006-1356 vdb-entry
- SSRT061236 vendor-advisory
- thunderbird-inline-information-disclosure(24959) vdb-entry
- 514 third-party-advisory
- MDKSA-2006:078 vendor-advisory
- 20051 third-party-advisory
- 19863 third-party-advisory
- 16881 vdb-entry
- 17516 vdb-entry
- SUSE-SA:2006:022 vendor-advisory
- 20060228 Mozilla Thunderbird : Multiple Information Disclosure Vulnerabilities mailing-list
- GLSA-200605-09 vendor-advisory
- 22065 third-party-advisory
- 19950 third-party-advisory
- DSA-1046 vendor-advisory