Red Hat Security Advisory

RHSA-2021:2914

thunderbird security update

Released 2021-07-27 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AppStream EUS (v. 8.2) thunderbird-78.12.0-2.el8_2

Fixes 4 records

TI-2021-10942 CVE-2021-30547 · GHSA-h3c6-pc9c-gf82

Out-of-bounds write in Google Chrome

MEDIUM 44

Out of bounds write in ANGLE in Google Chrome prior to 91.0.4472.101 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.03612 Published 2021-06-15 Partial fix · 91.0.4472.101 CWE-787

TI-2021-10593 CVE-2021-29976 · GHSA-jv3x-w8ff-cj2g

Out-of-bounds write in Mozilla Thunderbird

MEDIUM 41

Mozilla developers reported memory safety bugs present in code shared between Firefox and Thunderbird.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.01223 Published 2021-08-05 Partial fix · 78.12, 90 CWE-787

TI-2021-10587 CVE-2021-29970 · GHSA-822v-pgr4-6w5g

Use after free in Mozilla Thunderbird

MEDIUM 41

A malicious webpage could have triggered a use-after-free, memory corruption, and a potentially exploitable crash.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.01428 Published 2021-08-05 Partial fix · 78.12, 90 CWE-416

TI-2021-10586 CVE-2021-29969 · GHSA-ggp3-c9px-5c4p

If Thunderbird was configured to use STARTTLS for an IMAP connection, and an attacker…

LOW 29

If Thunderbird was configured to use STARTTLS for an IMAP connection, and an attacker injected IMAP server responses prior to the completion of the STARTTLS handshake, then Thunderbird didn't ignore the injected data.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.012 Published 2021-08-05 Partial fix · 78.12 CWE-552