Description
Heap-based buffer overflow in Mozilla Thunderbird before 1.5.0.5 and SeaMonkey before 1.0.3 allows remote attackers to cause a denial of service (crash) via a VCard attachment with a malformed base64 field, which copies more data than expected due to an integer underflow.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | thunderbird | 1.5.0.5-1 | — |
| Debian 13 | thunderbird | 1.5.0.5-1 | — |
| Debian 12 | thunderbird | 1.5.0.5-1 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 4 | devhelp +1 | 0.10-0.2.el4 | RHSA-2006:0609 |
| RHEL 4 | seamonkey +5 | 1.0.3-0.el4.1 | RHSA-2006:0609 |
| RHEL 4 | thunderbird | 1.5.0.5-0.el4.1 | RHSA-2006:0611 |
| RHEL 3 | seamonkey +9 | 1.0.3-0.el3.1 | RHSA-2006:0608 |
Advisories 3
- RHSA-2006:0611 Red Hat Security Advisory: thunderbird security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2006:0609 Red Hat Security Advisory: seamonkey security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2006:0608 Red Hat Security Advisory: seamonkey security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
References
- RHSA-2006:0608 vendor-advisory
- GLSA-200608-02 vendor-advisory
- MDKSA-2006:145 vendor-advisory
- 19181 vdb-entry
- TA06-208A third-party-advisory
- 22055 third-party-advisory
- ADV-2006-2998 vdb-entry
- mozilla-vcard-base64-bo(27985) vdb-entry
- http://www.mozilla.org/security/announce/2006/mfsa2006-49.html
- 21529 third-party-advisory
- ADV-2007-0058 vdb-entry
- RHSA-2006:0594 vendor-advisory
- oval:org.mitre.oval:def:11395 vdb-entry signature
- 21336 third-party-advisory
- ADV-2006-3749 vdb-entry
- 1016588 vdb-entry
- USN-329-1 vendor-advisory
- MDKSA-2006:146 vendor-advisory
- RHSA-2006:0609 vendor-advisory
- 21607 third-party-advisory
- VU#897540 third-party-advisory
- 21262 third-party-advisory
- 21532 third-party-advisory
- 21631 third-party-advisory
- SSRT061236 vendor-advisory
- 21275 third-party-advisory
- 21246 third-party-advisory
- SUSE-SA:2006:048 vendor-advisory
- 21229 third-party-advisory
- 1016587 vdb-entry
- RHSA-2006:0611 vendor-advisory
- 21228 third-party-advisory
- 21250 third-party-advisory
- USN-350-1 vendor-advisory
- 102763 vendor-advisory
- 21358 third-party-advisory
- https://issues.rpath.com/browse/RPL-537
- 21269 third-party-advisory
- GLSA-200608-04 vendor-advisory
- 21343 third-party-advisory
- MDKSA-2006:143 vendor-advisory
- 22065 third-party-advisory