Vulnerabilities

TI-2021-10586 CVE-2021-29969 · GHSA-ggp3-c9px-5c4p

If Thunderbird was configured to use STARTTLS for an IMAP connection, and an attacker…

LOW 29

If Thunderbird was configured to use STARTTLS for an IMAP connection, and an attacker injected IMAP server responses prior to the completion of the STARTTLS handshake, then Thunderbird didn't ignore the injected data.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.012 Published 2021-08-05 Partial fix · 78.12 CWE-552

TI-2021-10587 CVE-2021-29970 · GHSA-822v-pgr4-6w5g

Use after free in Mozilla Thunderbird

MEDIUM 41

A malicious webpage could have triggered a use-after-free, memory corruption, and a potentially exploitable crash.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.01428 Published 2021-08-05 Partial fix · 78.12, 90 CWE-416

TI-2021-10593 CVE-2021-29976 · GHSA-jv3x-w8ff-cj2g

Out-of-bounds write in Mozilla Thunderbird

MEDIUM 41

Mozilla developers reported memory safety bugs present in code shared between Firefox and Thunderbird.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.01223 Published 2021-08-05 Partial fix · 78.12, 90 CWE-787

Vulnerabilities

Filters

If Thunderbird was configured to use STARTTLS for an IMAP connection, and an attacker…

Use after free in Mozilla Thunderbird

Out-of-bounds write in Mozilla Thunderbird