Download Firefox

Firefox is no longer supported on Windows 8.1 and below.

Please download Firefox ESR (Extended Support Release) to use Firefox.

Firefox is no longer supported on macOS 10.14 and below.

Please download Firefox ESR (Extended Support Release) to use Firefox.

Firefox Privacy Notice

Mozilla Foundation Security Advisory 2007-10

Potential integer overflow with text/enhanced mail

Announced
March 5, 2007
Reporter
Georgi Guninski
Impact
Critical
Products
SeaMonkey, Thunderbird
Fixed in
  • SeaMonkey 1.0.8
  • Thunderbird 1.5.0.10

Description

Georgi Guninski discovered a potential integer overflow in the code that handles mail formatted as text/enhanced or text/richtext. This could in turn lead to a buffer overflow and potential code execution.

To exploit this flaw a malicious mail message would have to include a line more than 400 megabytes long. Many mail systems have storage quotas and transport filters that would prevent a message of that size from reaching its destination, but should the message get through its size would provide more than sufficient space for a payload.

Workaround

Do not open mail messages that are megabytes in size unless the sender is someone you know and from whom you were expecting that specific mail. Delete the message without opening it by shutting the view pane (F8, or from the "View | Layout" menu) before selecting the message in the thread pane and then deleting.

Upgrade to a version containing the fix.

References

https://bugzilla.mozilla.org/show_bug.cgi?id=362735