Remote execution flaw mars older Thunderbird versions
Mozilla's email add-on blues
Developers of the Thunderbird email client are in the process of patching a vulnerability that could allow attackers to remotely execute malicious code on end users' machines, security researchers said.
The flaw resides in the dtoa implementation of version 220.127.116.11 of Thunderbird, according to an advisory issued Friday by SecurityReason. The vulnerability mostly affects programs that are running various add-ons, including Lightning 0.9 and Thunderbrowse 18.104.22.168.
"We can create any number of float, which will overwrite the memory," the advisory states. "In Kmax has defined 15. Functions in dtoa, don't checks Kmax limit, and it is possible to call 16<= elements of freelist array."
A spokesman for Mozilla Messaging, the outfit that develops Thunderbird, said clients that don't run add-ons aren't vulnerable.
The bug has been fixed in the recently released version 3 of the email client and will also be patched in the upcoming version 22.214.171.124. The spokesman said it was unclear when it would be released and advised users to install Thunderbird 3.
It's been three days since the official release of that updated program, and there are relatively few reports of problems in the official support forum for the app. Now may be the time to upgrade. ®