Read the docs
Red Hat Security Advisory

RHSA-2021:3161

thunderbird security update

Released 2021-08-16 · Red Hat rating Important · View on Red Hat →

Fixed in

Fixes 6 records

TI-2021-10606 CVE-2021-29989 · GHSA-2j98-m58x-h9xv

Out-of-bounds write in Mozilla Thunderbird

Priority MEDIUM 41

Mozilla developers reported memory safety bugs present in Firefox 90 and Firefox ESR 78.12.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.01268 Published 2021-08-17 Partial fix · 78.13, 91 CWE-787
TI-2021-10605 CVE-2021-29988 · GHSA-rqrh-6wcg-wqw7

Out-of-bounds read in Mozilla Thunderbird

Priority MEDIUM 41

Firefox incorrectly treated an inline list-item element as a block element, resulting in an out of bounds read or memory corruption, and a potentially exploitable crash.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.0138 Published 2021-08-17 Partial fix · 78.13, 91 CWE-125
TI-2021-10602 CVE-2021-29985 · GHSA-j4mj-qqm4-jqf7

Use after free in Mozilla Thunderbird

Priority MEDIUM 41

A use-after-free vulnerability in media channels could have led to memory corruption and a potentially exploitable crash.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.01451 Published 2021-08-17 Partial fix · 78.13, 91 CWE-416
TI-2021-10601 CVE-2021-29984 · GHSA-9qg9-jm6v-8f8r

Out-of-bounds write in Mozilla Thunderbird

Priority MEDIUM 41

Instruction reordering resulted in a sequence of instructions that would cause an object to be incorrectly considered during garbage collection.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.01386 Published 2021-08-17 Partial fix · 78.13, 91 CWE-787
Priority MEDIUM 41

Uninitialized memory in a canvas object could have caused an incorrect free() leading to memory corruption and a potentially exploitable crash.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.01399 Published 2021-08-17 Partial fix · 78.13, 91 CWE-909
TI-2021-10603 CVE-2021-29986 · GHSA-vrcx-8xp2-2764

Race condition in Mozilla Thunderbird

Priority LOW 38

A suspected race condition when calling getaddrinfo led to memory corruption and a potentially exploitable crash.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.01263 Published 2021-08-17 Partial fix · 78.13, 91 CWE-362