Threats tagged 'ghsa-gm4x-83qc-5rx5'

A vulnerability in Thunderbird allowed clicking on news: or snews: links referencing a message-ID to cause the client to connect automatically to an attacker-specified host and port without user consent, even if the server was not configured. Line breaks in the message-ID were sent unmodified, enabling crafted links to send arbitrary commands to reachable services. Additionally, snews: links connected without TLS, exposing data to interception. This issue was fixed in Thunderbird versions 159 and 153.6.