CVE-2020-12397
Mozilla: Sender Email Address Spoofing using encoded Unicode characters
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
By encoding Unicode whitespace characters within the From email header, an attacker can spoof the sender email address that Thunderbird displays. This vulnerability affects Thunderbird < 68.8.0.
Al codificar caracteres de espacio en blanco Unicode dentro del encabezado del correo electrónico From, un atacante puede suplantar la dirección de correo electrónico del remitente que despliega Thunderbird. Esta vulnerabilidad afecta a Thunderbird versiones anteriores a 68.8.0.
Multiple security issues were discovered in Thunderbird. If a user were tricked in to opening a specially crafted website in a browsing context, an attacker could potentially exploit these to cause a denial of service, or execute arbitrary code. It was discovered that Thunderbird did not correctly handle Unicode whitespace characters within the From email header. An attacker could potentially exploit this to spoof the sender email address that Thunderbird displays.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2020-04-28 CVE Reserved
- 2020-05-11 CVE Published
- 2024-08-04 CVE Updated
- 2025-03-30 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-172: Encoding Error
- CWE-346: Origin Validation Error
CAPEC
References (6)
| URL | Tag | Source |
|---|---|---|
| https://security.gentoo.org/glsa/202005-03 | Third Party Advisory |
|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://bugzilla.mozilla.org/show_bug.cgi?id=1617370 | 2023-02-28 |
| URL | Date | SRC |
|---|---|---|
| https://usn.ubuntu.com/4373-1 | 2023-02-28 | |
| https://www.mozilla.org/security/advisories/mfsa2020-18 | 2023-02-28 | |
| https://access.redhat.com/security/cve/CVE-2020-12397 | 2020-05-11 | |
| https://bugzilla.redhat.com/show_bug.cgi?id=1832565 | 2020-05-11 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Mozilla Search vendor "Mozilla" | Thunderbird Search vendor "Mozilla" for product "Thunderbird" | < 68.8.0 Search vendor "Mozilla" for product "Thunderbird" and version " < 68.8.0" | - |
Affected
| ||||||
| Canonical Search vendor "Canonical" | Ubuntu Linux Search vendor "Canonical" for product "Ubuntu Linux" | 16.04 Search vendor "Canonical" for product "Ubuntu Linux" and version "16.04" | esm |
Affected
| ||||||
| Canonical Search vendor "Canonical" | Ubuntu Linux Search vendor "Canonical" for product "Ubuntu Linux" | 18.04 Search vendor "Canonical" for product "Ubuntu Linux" and version "18.04" | lts |
Affected
| ||||||
| Canonical Search vendor "Canonical" | Ubuntu Linux Search vendor "Canonical" for product "Ubuntu Linux" | 19.10 Search vendor "Canonical" for product "Ubuntu Linux" and version "19.10" | - |
Affected
| ||||||
| Canonical Search vendor "Canonical" | Ubuntu Linux Search vendor "Canonical" for product "Ubuntu Linux" | 20.04 Search vendor "Canonical" for product "Ubuntu Linux" and version "20.04" | lts |
Affected
| ||||||