Description
Heap-based buffer overflow in Mozilla Thunderbird before 2.0.0.12 and SeaMonkey before 1.1.8 might allow remote attackers to execute arbitrary code via a crafted external-body MIME type in an e-mail message, related to an incorrect memory allocation during message preview.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 4.0 | iceape | 1.0.13~pre080614i-0etch1 | DSA-1697-1 |
| Debian 4.0 | icedove | 1.5.0.13+1.5.0.15b.dfsg1+prepatch080614d-0etch1 | DSA-1621-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | thunderbird | 1.5.0.12-8.el5 | RHSA-2008:0105 |
| RHEL 4 | seamonkey +5 | 1.0.9-9.el4 | RHSA-2008:0104 |
| RHEL 4 | thunderbird | 1.5.0.12-8.el4 | RHSA-2008:0105 |
| RHEL 3 | seamonkey +9 | 1.0.9-0.9.el3 | RHSA-2008:0104 |
| RHEL 2 | seamonkey +9 | 1.0.9-0.9.el2 | RHSA-2008:0104 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhel Productivity 5 | thunderbird | 1.5.0.12-8.el5 | RHSA-2008:0105 |
Advisories 4
- RHSA-2008:0104 Red Hat Security Advisory: seamonkey security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2008:0105 Red Hat Security Advisory: thunderbird security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1697-1 iceape - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1621-1 icedove - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
References
- USN-582-2 vendor-advisory
- DSA-1697 vendor-advisory
- http://www.mozilla.org/security/announce/2008/mfsa2008-12.html
- SSA:2008-061-01 vendor-advisory
- FEDORA-2008-2118 vendor-advisory
- FEDORA-2008-2060 vendor-advisory
- 29133 third-party-advisory
- VU#661651 third-party-advisory
- USN-582-1 vendor-advisory
- 29167 third-party-advisory
- 28012 vdb-entry
- 30327 third-party-advisory
- 239546 vendor-advisory
- 33433 third-party-advisory
- 31253 third-party-advisory
- oval:org.mitre.oval:def:11075 vdb-entry signature
- ADV-2008-2091 vdb-entry
- 29211 third-party-advisory
- 20080226 Mozilla Thunderbird MIME External-Body Heap Overflow Vulnerability third-party-advisory
- MDVSA-2008:062 vendor-advisory
- GLSA-200805-18 vendor-advisory
- DSA-1621 vendor-advisory
- 1019504 vdb-entry
- 31043 third-party-advisory
- 29098 third-party-advisory