Summary
Multiple security issues were discovered in Thunderbird. If a user were
tricked into opening a specially crafted website in a browsing context,
an attacker could potentially exploit these to cause a denial of service,
obtain sensitive information, or execute arbitrary code. (CVE-2021-23968,
CVE-2021-23969, CVE-2021-23973, CVE-2021-23978)
It was discovered that Thunderbird may keep key material in memory in some
circumstances. A local attacker could potentially exploit this to obtain
private keys. (CVE-2021-29950)
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 20.04 LTS 20.04:LTS | thunderbird | 1:78.8.1+build1-0ubuntu0.20.04.1 |
Vulnerabilities 5
-
Unscored —
If Content Security Policy blocked frame navigation, the full destination of a redirect served in the frame was reporte…
-
Unscored —
As specified in the W3C Content Security Policy draft, when creating a violation report, "User agents need to ensure th…
-
Unscored —
When trying to load a cross-origin resource in an audio/video context a decoding error may have resulted, and the conte…
-
Unscored —
Mozilla developers reported memory safety bugs present in Firefox 85 and Firefox ESR 78.7. Some of these bugs showed ev…
-
Unscored —
Thunderbird unprotects a secret OpenPGP key prior to using it for a decryption, signing or key import task. If the task…