Risk: Medium
A vulnerability in Mozilla Thunderbird can be exploited to allow malicious people to run arbitrary programs.
When attachments are not displayed correctly in emails, the file extension and associated file type icon can be spoofed by using overly long file names containing "Content-Type" headers that don't match the file extension and lots of white spaces. In the event that exploitation is successful, it may lead to malware being saved to the computer.
The vulnerability has been confirmed in versions 1.0.2, 1.0.6, and 1.0.7 but other versions may also be affected. Only the Microsoft Windows platform is affected.
In order to minimise this potential risk, simply save or drag the attachment onto the desktop rather than opening it directly from the email.
To fix the problem, upgrade to version 1.5, which is available at www.mozilla.com/thunderbird