CVE-2023-29545: Medium severity thunderbird vulnerability
Similar to CVE-2023-28163, this time when choosing 'Save Link As', suggested filenames containing environment variable names would have resolved those in the context of the current user.
This bug only affects Firefox and Thunderbird on Windows. Other versions of Firefox and Thunderbird are unaffected. This vulnerability affects Firefox < 112, Firefox ESR < 102.10, and Thunderbird < 102.10.
Other sources
Similar to CVE-2023-28163, this time when choosing 'Save Link As', suggested filenames containing environment variable names would have resolved those in the context of the current user. This bug only affects Firefox on Windows. Other versions of Firefox are unaffected.
Similar to CVE-2023-28163, this time when choosing 'Save Link As', suggested filenames containing environment variable names would have resolved those in the context of the current user. This bug only affects Thunderbird on Windows. Other versions of Thunderbird are unaffected.
— Mozilla
Affected Software
Event History
Parent advisories
This vulnerability appears in the following advisories.
Peer vulnerabilities
Found alongside the following vulnerabilities.
- CVE-2023-29531
- CVE-2023-29532
- CVE-2023-29533
- CVE-2023-1999
- CVE-2023-29535
- CVE-2023-29536
- CVE-2023-0547
- CVE-2023-29479
- CVE-2023-29539
- CVE-2023-29541
- CVE-2023-29542
- CVE-2023-29545
- CVE-2023-1945
- CVE-2023-29548
- CVE-2023-29550
- CVE-2023-29534
- CVE-2023-29537
- CVE-2023-29538
- CVE-2023-29540
- CVE-2023-29543
- CVE-2023-29544
- CVE-2023-29546
- CVE-2023-29547
- CVE-2023-29549
- CVE-2023-29551
Frequently Asked Questions
What is CVE-2023-29545?
CVE-2023-29545 is a vulnerability in Thunderbird on Windows that allows suggested filenames to contain environment variable names that are resolved in the user's context.
How does CVE-2023-29545 affect Thunderbird?
CVE-2023-29545 affects Thunderbird on Windows, but other versions of Thunderbird are unaffected.
What is the severity of CVE-2023-29545?
CVE-2023-29545 has a severity level of medium.
How can I fix CVE-2023-29545?
To fix CVE-2023-29545, update Thunderbird to the latest version.
Where can I find more information about CVE-2023-29545?
You can find more information about CVE-2023-29545 in the references provided: [Link 1](https://bugzilla.mozilla.org/show_bug.cgi?id=1823077), [Link 2](https://www.mozilla.org/en-US/security/advisories/mfsa2023-15/), [Link 3](https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/).