|Description||A file with a long filename could have had its filename truncated to remove the valid extension, leaving a malicious extension in its place. This could potentially led to user confusion and the execution of malicious code.<br/>*Note*: This issue was originally included in the advisories for Thunderbird 102.6, but a patch (specific to Thunderbird) was omitted, resulting in it actually being fixed in Thunderbird 102.6.1. This vulnerability affects Firefox < 108, Thunderbird < 102.6.1, Thunderbird < 102.6, and Firefox ESR < 102.6.|
|Source||CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)|
|References||DLA-3241-1, DLA-3242-1, DSA-5301-1, DSA-5303-1|
Vulnerable and fixed packages
The table below lists information on source packages.
|bookworm, bookworm (security)||115.5.0esr-1~deb12u1||fixed|
|bookworm, bookworm (security)||1:115.5.0-1~deb12u1||fixed|
The information below is based on the following data on fixed versions.