CVE-2023-0616 Denial of service in Thunderbird
An attacker can cause Thunderbird to lock up by sending a crafted MIME email, resulting in a denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2023-0616?
CVE-2023-0616 is a medium-severity denial of service vulnerability in Mozilla Thunderbird, published on 2 Jun 2023. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
If a MIME email combines OpenPGP and OpenPGP MIME data in a certain way Thunderbird repeatedly attempts to process and display the message, which could cause Thunderbird's user interface to lock up and no longer respond to the user's actions. An attacker could send a crafted message with this structure to attempt a DoS attack. This vulnerability affects Thunderbird < 102.8.
Which versions are affected by CVE-2023-0616?
It affects 1 product.
Products include Mozilla Thunderbird.
How do I fix CVE-2023-0616?
Upgrade to a fixed version.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2023-0616 being exploited?
There is no known exploitation of CVE-2023-0616 in the wild and no public exploit code.
Other vulnerabilities in Mozilla Thunderbird
Sources
Also known as DEBIAN-CVE-2023-0616, GHSA-w7wv-wm72-g6pr, UBUNTU-CVE-2023-0616.