Read the docs
Red Hat Security Advisory

RHSA-2021:3838

thunderbird security update

Released 2021-10-13 · Red Hat rating Important · View on Red Hat →

Fixed in

Fixes 7 records

TI-2021-12475 CVE-2021-32810 · GHSA-pqqp-xmhj-wgcw

Data race in crossbeam-deque

Priority MEDIUM 46

crossbeam-deque is a package of work-stealing deques for building task schedulers when programming in Rust.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01907 Published 2021-08-02 Partial fix · 0.7.4, 0.8.1 CWE-362
TI-2021-16096 CVE-2021-38496 · GHSA-3rfx-pjp7-cvfp

Use after free in Mozilla Thunderbird

Priority MEDIUM 41

During operations on MessageTasks, a task may have been removed while it was still scheduled, resulting in memory corruption and a potentially exploitable crash.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.01659 Published 2021-11-03 Partial fix · 78.15, 91.2 +1 CWE-416
TI-2021-16098 CVE-2021-38498 · GHSA-f7wc-pcqv-5mwm

Use after free in Mozilla Firefox

Priority LOW 36

During process shutdown, a document could have caused a use-after-free of a languages service object, leading to memory corruption and a potentially exploitable crash.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01467 Published 2021-11-03 Partial fix · 93, 91.2 CWE-416
TI-2021-16097 CVE-2021-38497 · GHSA-qmc5-2jh2-rpcw

Origin validation error in Mozilla Firefox

Priority LOW 30

Through use of reportValidity() and window.open(), a plain-text validation message could have been overlaid on another origin, leading to possible user confusion and spoofing attacks.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00591 Published 2021-11-03 Partial fix · 93, 91.2 CWE-346