Bug 1951872 (CVE-2021-29949) - CVE-2021-29949 Mozilla: Thunderbird might execute an alternative OTR library
Summary: CVE-2021-29949 Mozilla: Thunderbird might execute an alternative OTR library
Keywords:
Status: CLOSED WONTFIX
Alias: CVE-2021-29949
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks: 1951866
TreeView+ depends on / blocked
 
Reported: 2021-04-21 02:59 UTC by Doran Moppert
Modified: 2021-07-01 13:59 UTC (History)
5 users (show)

Fixed In Version: thunderbird 78.9.1
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2021-04-21 04:46:33 UTC


Attachments (Terms of Use)

Description Doran Moppert 2021-04-21 02:59:20 UTC
When loading the shared library that provides the OTR protocol implementation, Thunderbird will initially attempt to open it using a filename that isn't distributed by Thunderbird. If a computer has already been infected with a malicious library of the alternative filename, and the malicious library has been copied to a directory that is contained in the search path for executable libraries, then Thunderbird will load the incorrect library.



External Reference:

https://www.mozilla.org/en-US/security/advisories/mfsa2021-13/#CVE-2021-29949

Comment 1 Doran Moppert 2021-04-21 02:59:24 UTC
Acknowledgments:

Name: the Mozilla project
Upstream: Tuan Vu Pham

Comment 2 Product Security DevOps Team 2021-04-21 04:46:33 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2021-29949


Note You need to log in before you can comment on or make changes to this bug.