You are here: Known Vulnerabilities in Mozilla Products (Thunderbird 1.5.0.4) > MFSA 2006-40
Mozilla Foundation Security Advisory 2006-40
Title: Double-free on malformed VCard
Impact: Critical
Date: June 1, 2006
Reporter: Masatoshi Kimura
Products: Thunderbird, SeaMonkey
Fixed in: Thunderbird 1.5.0.4
SeaMonkey 1.0.2
Description
Masatoshi Kimura reported a hang caused by a double-free in Thunderbird when processing a large VCard with invalid base64 characters in it. Since an attacker can supply an arbitrary amount of well-formed VCard data before introducing the error we presume this could be exploited to run code of the attacker's choosing.
Workaround
From the View
menu de-select "Display Attachments Inline", and do not open
any VCard attachments (.vcf extension) until you upgrade to a fixed version.