Vulnerabilities

If a Thunderbird user has previously imported Alice's OpenPGP key, and Alice has extended the validity period of her key, but Alice's updated key has not yet been imported, an attacker may send an email containing a craf…

Thunderbird did not check if the user ID associated with an OpenPGP key has a valid self signature.

An attacker may perform a DoS attack to prevent a user from sending encrypted email to a correspondent.

When loading the shared library that provides the OTR protocol implementation, Thunderbird will initially attempt to open it using a filename that isn't distributed by Thunderbird.