desktop-packages team mailing list archive

[Launchpad Bug Tracker <1033584@xxxxxxxxxxxxxxxxxx>]

*** This bug is a security vulnerability ***

You have been subscribed to a public security bug:

When displaying an email in Thunderbird, hitting the Reply button opens
a new window containing a quoted version of the email you are replying
to. That is what you expect to happen. However, rarely and
intermittently in the same reply window, an unquoted version of the body
of the most recently written email appears underneath the quoted email
you are replying to.

There is no clear pattern as to when it happens. It has been happening
intermittently in all versions of Thunderbird from the 14.0 in Precise
12.04 to whatever version it was in Lucid 10.04. The Thunderbird error
log / console is usually empty when it happens. It has happened in plain
Thunderbird with the default Ubuntu theme version 14.0 and without any
addons. Some kind of paste buffer management is going wrong and picking
up a copy of a previous message (but it happens even without using cut-
and-paste)?

Here is an example of how it looks after hitting the Reply button while displaying an email from JaneL@xxxxxxxx:
This is meant to be a reply to JaneL's email, but notice there is an unwanted copy of the body of another recently written email to John that has been appended as one line of plain text underneath the quoted version of JaneL's email.
This unwanted appending is very easy not to notice, meaning there is a real risk of accidentally passing on unrelated email to unintended recipients, creating a breach of privacy or worse, which is a security issue for those involved. Please investigate and fix.

On 06/08/12 11:30, JaneL@xxxxxxxx wrote:
> Hi Bob,
> Yes!! 5pm is ok. See you!
> xox J.
John, our afternoon meeting is off, please reschedule for 9am. Bob

** Affects: thunderbird (Ubuntu)
     Importance: Undecided
         Status: Triaged


** Tags: security thunderbird
-- 
Reply sometimes randomly appends unrelated message below quoted message 
https://bugs.launchpad.net/bugs/1033584
You received this bug notification because you are a member of Desktop Packages, which is subscribed to thunderbird in Ubuntu.