CVE-2017-7829

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

It is possible to spoof the sender's email address and display an arbitrary sender address to the email recipient. The real sender's address is not displayed if preceded by a null character in the display string. This vulnerability affects Thunderbird < 52.5.2.

Metrics

CVSS 3.0 5.3/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-20

Affected software

Vendor	Product	Versions
Mozilla	Thunderbird	>= unspecified, < 52.5.2

References

http://www.securityfocus.com/bid/102258Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1040123Third Party Advisory, VDB Entry
https://access.redhat.com/errata/RHSA-2018:0061Third Party Advisory
https://bugzilla.mozilla.org/show_bug.cgi?id=1423432Exploit, Issue Tracking, Patch
https://lists.debian.org/debian-lts-announce/2017/12/msg00026.htmlMailing List, Third Party Advisory
https://usn.ubuntu.com/3529-1/Third Party Advisory
https://www.debian.org/security/2017/dsa-4075Third Party Advisory
https://www.mozilla.org/security/advisories/mfsa2017-30/Vendor Advisory
http://www.securityfocus.com/bid/102258Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1040123Third Party Advisory, VDB Entry
https://access.redhat.com/errata/RHSA-2018:0061Third Party Advisory
https://bugzilla.mozilla.org/show_bug.cgi?id=1423432Exploit, Issue Tracking, Patch
https://lists.debian.org/debian-lts-announce/2017/12/msg00026.htmlMailing List, Third Party Advisory
https://usn.ubuntu.com/3529-1/Third Party Advisory
https://www.debian.org/security/2017/dsa-4075Third Party Advisory
https://www.mozilla.org/security/advisories/mfsa2017-30/Vendor Advisory

Timeline

Published: Jun 11, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-78306.5The Resource Timing API incorrectly revealed navigations in cross-origin iframes. This is a same-origin policy violation and could allow for CVE-2017-78315.3A vulnerability where the security wrapper does not deny access to some exposed properties using the deprecated "_exposedProps_" mechanism o CVE-2017-78325.3The combined, single character, version of the letter 'i' with any of the potential accents in unicode, such as acute or grave, can be spoof CVE-2017-78335.3Some Arabic and Indic vowel marker characters can be combined with Latin characters in a domain name to eclipse the non-Latin character with CVE-2017-78346.1A "data:" URL loaded in a new tab did not inherit the Content Security Policy (CSP) of the original page, allowing for bypasses of the polic CVE-2017-78357.3Mixed content blocking of insecure (HTTP) sub-resources in a secure (HTTPS) document was not correctly applied for resources that redirect f CVE-2017-78367.8The "pingsender" executable used by the Firefox Health Report dynamically loads a system copy of libcurl, which an attacker could replace. T CVE-2017-78375.3SVG loaded through "<img>" tags can use "<meta>" tags within the SVG data to set cookies for that page. This vulnerability affects Firefox <CVE-2017-78385.3Punycode format text will be displayed for entire qualified international domain names in some instances when a sub-domain triggers the puny CVE-2017-78396.1Control characters prepended before "javascript:" URLs pasted in the addressbar can cause the leading characters to be ignored and the paste CVE-2017-78406.1JavaScript can be injected into an exported bookmarks file by placing JavaScript code into user-supplied tags in saved bookmarks. If the res CVE-2017-78425.3If a document's Referrer Policy attribute is set to "no-referrer" sometimes two network requests are made for "<link>" elements instead of o