- MFSA 2007-10 Potential integer overflow with text/enhanced mail
Fix released: March 1, 2007
Reporter: Georgi Guninski
Products: Thunderbird, SeaMonkey
Fixed in: Thunderbird 126.96.36.199
DescriptionGeorgi Guninski discovered a potential integer overflow in the code that handles mail formatted as text/enhanced or text/richtext. This could in turn lead to a buffer overflow and potential code execution.
To exploit this flaw a malicious mail message would have to include a line more than 400 megabytes long. Many mail systems have storage quotas and transport filters that would prevent a message of that size from reaching its destination, but should the message get through its size would provide more than sufficient space for a payload.
WorkaroundDo not open mail messages that are megabytes in size unless the sender is someone you know and from whom you were expecting that specific mail. Delete the message without opening it by shutting the view pane (F8, or from the "View | Layout" menu) before selecting the message in the thread pane and then deleting.
Upgrade to a version containing the fix.
Announced: March 5, 2007
Products: Firefox 188.8.131.52/184.108.40.206, SeaMonkey 1.0.7
Fixed in: Firefox 220.127.116.11
Descriptionmoz_bug_r_a4 reports that the fix for MFSA 2006-72 in Firefox 18.104.22.168 and Firefox 22.214.171.124 introduced a regression that allows scripts from web content to execute arbitrary code by setting the
srcattribute of an