Developers of the Thunderbird email client are in the process of patching a vulnerability that could allow attackers to
remotely execute malicious code on end users' machines, security researchers said.
The flaw resides in the dtoa implementation of version 2.0.0.23 of Thunderbird, according to an advisory issued Friday by SecurityReason. The vulnerability mostly affects programs that are running various add-ons, including Lightning 0.9 and Thunderbrowse 3.2.6.7.
"We can create any number of float, which will overwrite the memory," the advisory states.
The bug will be patched in the upcoming version 2.0.0.24, but the spokesman said
it was unclear when it would be released and advised users to install Thunderbird 3.
»
www.theregister.co.uk/20 ··· _threat/
