Injection Attacks

2020-09-2106:37:21

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

0.003 Low

EPSS

Percentile

70.2%

JSON

thunderbird is vulnerable to injection attacks. The vulnerability exists as the CSS sanitizer incorrectly rewrites a @namespace rule when pasting a <style> tag from the clipboard into a rich text editor.

CPENameOperatorVersion
thunderbird:xenialeq1:38.6.0+build1
firefox:eoaneq69.0.3+build1
thunderbird:bioniceq1:52.7.0+build1
thunderbird:eoaneq1:68.1.2+build1
firefox:bioniceq59.0.2+build1
firefox:xenialeq45.0.2+build1
thunderbird:stretcheq1:52.9.1-1~deb9u1
thunderbird:stretcheq1:60.9.0-1~deb9u1
thunderbird:bustereq1:60.9.0-1~deb10u1

Name	Operator	Version
thunderbird:xenial	eq	1:38.6.0+build1
firefox:eoan	eq	69.0.3+build1
thunderbird:bionic	eq	1:52.7.0+build1
thunderbird:eoan	eq	1:68.1.2+build1
firefox:bionic	eq	59.0.2+build1
firefox:xenial	eq	45.0.2+build1
thunderbird:stretch	eq	1:52.9.1-1~deb9u1
thunderbird:stretch	eq	1:60.9.0-1~deb9u1
thunderbird:buster	eq	1:60.9.0-1~deb10u1