Mozilla Foundation Security Advisory 2007-10
Potential integer overflow with text/enhanced mail
- Announced
- March 5, 2007
- Reporter
- Georgi Guninski
- Impact
- Critical
- Products
- SeaMonkey, Thunderbird
- Fixed in
-
- SeaMonkey 1.0.8
- Thunderbird 1.5.0.10
Description
Georgi Guninski discovered a potential integer overflow in the code that handles mail formatted as text/enhanced or text/richtext. This could in turn lead to a buffer overflow and potential code execution.
To exploit this flaw a malicious mail message would have to include a line more than 400 megabytes long. Many mail systems have storage quotas and transport filters that would prevent a message of that size from reaching its destination, but should the message get through its size would provide more than sufficient space for a payload.
Workaround
Do not open mail messages that are megabytes in size unless the sender is someone you know and from whom you were expecting that specific mail. Delete the message without opening it by shutting the view pane (F8, or from the "View | Layout" menu) before selecting the message in the thread pane and then deleting.
Upgrade to a version containing the fix.