CVE:CVE-2006-0884
CNNVD:CNNVD-200602-379
Thunderbird是一款功能强大的邮件客户端，支持IMAP和POP邮件协议及HTML邮件格式。
Thunderbird对HTML格式邮件的处理上存在问题，远程攻击者可能利用此漏洞在客户端机器上执行恶意脚本代码。
Thunderbird的WYSIWYG渲染引擎没有充分地过滤JavaScript脚本，允许向IFRAME标签的SRC属性中写入JavaScript。这可能导致即使禁用了JavaScript的话，在用户编辑邮件或回复邮件时也可执行脚本或导致拒绝服务。
solution:Upgrade mozilla thunderbird to a higher version than 1.0.7,0.1,0.2,0.3,0.4,0.5,0.6,0.7,0.7.1,0.7.2,0.7.3,0.8,0.9,1.0,1.0.1,1.0.2,1.0.5,1.0.6,and avoid the version (,1.0.7],0.1,0.2,0.3,0.4,0.5,0.6,0.7,0.7.1,0.7.2,0.7.3,0.8,0.9,1.0,1.0.1,1.0.2,1.0.5,1.0.6