摘要:
When processing a PGP/MIME payload that contains digitally signed text, the first paragraph of the text was never shown to the user. This is because the text was interpreted as a MIME message and the first paragraph was always treated as an email header section. A digitally signed text from a different context, such as a signed GIT commit, could be used to spoof an email message. This vulnerability affects Thunderbird < 115.6.
安全等级: Low
公告ID: KylinSec-SA-2025-2324
发布日期: 2025年4月20日
关联CVE: CVE-2023-50762
在处理包含数字签名文本的PGP/MIME数据时，首个文本段落始终未向用户显示。这是由于该文本被解析为MIME消息格式，导致首个段落始终被识别为邮件头部分。来自其他场景（如GIT签名提交）的数字签名文本可能被利用来伪造电子邮件内容。此漏洞影响Thunderbird < 115.6版本。
| cve名称 | 产品 | 组件 | 是否受影响 |
|---|---|---|---|
| CVE-2023-50762 | KY3.4-5A | thunderbird | Unaffected |
| CVE-2023-50762 | V6 | thunderbird | Unaffected |
