Threats tagged 'ghsa-7w88-6r56-g2q9'

Thunderbird versions prior to 159 and 153.6 accepted calendar locations from directory lookups that could point to local files or remote network shares. This flaw allowed a malicious server or network attacker to cause Thunderbird to subscribe to such locations, potentially leaking Windows NTLM credentials on every calendar refresh and enabling unauthorized writes to local or remote files.