Summary
Multiple security issues were discovered in Thunderbird. If a user were
tricked into opening a specially crafted website in a browsing context, an
attacker could potentially exploit these to cause a denial of service,
obtain sensitive information, trick a user into accepting unwanted
permissions, conduct header splitting attacks, conduct spoofing attacks,
bypass security restrictions, confuse the user, or execute arbitrary code.
(CVE-2021-4129, CVE-2021-4140, CVE-2021-29981, CVE-2021-29982,
CVE-2021-29987, CVE-2021-29991, CVE-2021-38495, CVE-2021-38496,
CVE-2021-38497, CVE-2021-38498, CVE-2021-38500, CVE-2021-38501,
CVE-2021-38503, CVE-2021-38504, CVE-2021-38506, CVE-2021-38507,
CVE-2021-38508, CVE-2021-38509, CVE-2021-43534, CVE-2021-43535,
CVE-2021-43536, CVE-2021-43537, CVE-2021-43538, CVE-2021-43539,
CVE-2021-43541, CVE-2021-43542, CVE-2021-43543, CVE-2021-43545,
CVE-2021-43656, CVE-2022-22737, CVE-2022-22738, CVE-2022-22739,
CVE-2022-22740, CVE-2022-22741, CVE-2022-22742, CVE-2022-22743,
CVE-2022-22745, CVE-2022-22747, CVE-2022-22748, CVE-2022-22751)
It was discovered that Thunderbird ignored the configuration to require
STARTTLS for an SMTP connection. A person-in-the-middle could potentially
exploit this to perform a downgrade attack in order to intercept messages
or take control of a session. (CVE-2021-38502)
It was discovered that JavaScript was unexpectedly enabled in the
composition area. An attacker could potentially exploit this in
combination with another vulnerability, with unspecified impacts.
(CVE-2021-43528)
A buffer overflow was discovered in the Matrix chat library bundled with
Thunderbird. An attacker could potentially exploit this to cause a denial
of service, or execute arbitrary code. (CVE-2021-44538)
It was discovered that Thunderbird's OpenPGP integration only considered
the inner signed message when checking signature validity in a message
that contains an additional outer MIME layer. An attacker could
potentially exploit this to trick the user into thinking that a message
has a valid signature. (CVE-2021-4126)
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 18.04 LTS 18.04:LTS | thunderbird | 1:91.5.0+build1-0ubuntu0.18.04.1 |
| Ubuntu · 20.04 LTS 20.04:LTS | thunderbird | 1:91.5.0+build1-0ubuntu0.20.04.1 |
Vulnerabilities 44
-
Critical 9.8
Mozilla developers and community members Julian Hector, Randell Jesup, Gabriele Svelto, Tyson Smith, Christian Holler, …
-
Critical 9.8
It was possible to construct specific XSLT markup that would be able to bypass an iframe sandbox. This vulnerability af…
-
High 8.8
Applying a CSS filter effect could have accessed out of bounds memory. This could have lead to a heap-buffer-overflow c…
-
High 8.8
Certain network request objects were freed too early when releasing a network request handle. This could have lead to a…
-
High 8.8
Mozilla developers Calixte Denizet, Kershaw Chang, Christian Holler, Jason Kratzer, Gabriele Svelto, Tyson Smith, Simon…
-
High 7.5
Constructing audio sinks could have lead to a race condition when playing audio files and closing windows. This could h…
-
High 7.5
When resizing a popup while requesting fullscreen access, the popup would have become unable to leave fullscreen mode. …
-
Medium 6.5
When receiving an OpenPGP/MIME signed email message that contains an additional outer MIME message layer, for example a…
-
Medium 6.5
Malicious websites could have tricked users into accepting launching a program to handle an external URL protocol. This…
-
Medium 6.5
When inserting text while in edit mode, some characters might have lead to out-of-bounds memory access causing a potent…
-
Medium 6.5
Securitypolicyviolation events could have leaked cross-origin information for frame-ancestors violations. This vulnerab…
-
Medium 6.5
After accepting an untrusted certificate, handling an empty pkcs7 sequence as part of the certificate data could have l…
-
Medium 6.5
Malicious websites could have confused Firefox into showing the wrong origin when asking to launch a program and handli…
-
Medium 4.3
When navigating from inside an iframe while requesting fullscreen access, an attacker-controlled tab could have made th…
-
Unscored —
An issue present in lowering/register allocation could have led to obscure but deterministic register confusion failure…
-
Unscored —
Due to incorrect JIT optimization, we incorrectly interpreted data from the wrong type of object, resulting in the pote…
-
Unscored —
After requesting multiple permissions, and closing the first permission panel, subsequent permission panels will be dis…
-
Unscored —
Firefox incorrectly accepted a newline in a HTTP/3 header, interpretting it as two separate headers. This allowed for a…
-
Unscored —
Mozilla developers reported memory safety bugs present in Thunderbird 78.13.0. Some of these bugs showed evidence of me…
-
Unscored —
During operations on MessageTasks, a task may have been removed while it was still scheduled, resulting in memory corru…
-
Unscored —
Through use of reportValidity() and window.open(), a plain-text validation message could have been overlaid on another …
-
Unscored —
During process shutdown, a document could have caused a use-after-free of a languages service object, leading to memory…
-
Unscored —
Mozilla developers reported memory safety bugs present in Firefox 92 and Firefox ESR 91.1. Some of these bugs showed ev…
-
Unscored —
Mozilla developers reported memory safety bugs present in Firefox 92 and Firefox ESR 91.1. Some of these bugs showed ev…
-
Unscored —
Thunderbird ignored the configuration to require STARTTLS security for an SMTP connection. A MITM could perform a downg…
-
Unscored —
The iframe sandbox rules were not correctly applied to XSLT stylesheets, allowing an iframe to bypass restrictions such…
-
Unscored —
When interacting with an HTML input element's file picker dialog with webkitdirectory set, a use-after-free could have …
-
Unscored —
Through a series of navigations, Firefox could have entered fullscreen mode without notification or warning to the user…
-
Unscored —
The Opportunistic Encryption feature of HTTP2 (RFC 8164) allows a connection to be transparently upgraded to TLS while …
-
Unscored —
By displaying a form validity message in the correct location at the same time as a permission prompt (such as for geol…
-
Unscored —
Due to an unusual sequence of attacker-controlled events, a Javascript alert() dialog with arbitrary (although unstyled…
-
Unscored —
Thunderbird unexpectedly enabled JavaScript in the composition area. The JavaScript execution context was limited to th…
-
Unscored —
Mozilla developers and community members reported memory safety bugs present in Firefox 93 and Firefox ESR 91.2. Some o…
-
Unscored —
A use-after-free could have occured when an HTTP2 session object was released on a different thread, leading to memory …
-
Unscored —
Under certain circumstances, asynchronous functions could have caused a navigation to fail but expose the target URL. T…
-
Unscored —
An incorrect type conversion of sizes from 64bit to 32bit integers allowed an attacker to corrupt memory leading to a p…
-
Unscored —
By misusing a race in our notification code, an attacker could have forcefully hidden the notification for pages that h…
-
Unscored —
Failure to correctly record the location of live pointers across wasm instance calls resulted in a GC occurring within …
-
Unscored —
When invoking protocol handlers for external protocols, a supplied parameter URL containing spaces was not properly esc…
-
Unscored —
Using XMLHttpRequest, an attacker could have identified installed applications by probing error messages for loading ex…
-
Unscored —
Documents loaded with the CSP sandbox directive could have escaped the sandbox's script restriction by embedding additi…
-
Unscored —
Using the Location API in a loop could have caused severe application hangs and crashes. This vulnerability affects Thu…
-
Unscored —
It was possible to recreate previous cursor spoofing attacks against users with a zoomed native cursor. This vulnerabil…
-
Unscored —
The olm_session_describe function in Matrix libolm before 3.2.7 is vulnerable to a buffer overflow. The Olm session obj…
References
-
report
https://ubuntu.com/security/CVE-2021-4126
-
report
https://ubuntu.com/security/CVE-2021-4129
-
report
https://ubuntu.com/security/CVE-2021-4140
-
report
https://ubuntu.com/security/CVE-2021-29981
-
report
https://ubuntu.com/security/CVE-2021-29982
-
report
https://ubuntu.com/security/CVE-2021-29987
-
report
https://ubuntu.com/security/CVE-2021-29991
-
report
https://ubuntu.com/security/CVE-2021-38495
-
report
https://ubuntu.com/security/CVE-2021-38496
-
report
https://ubuntu.com/security/CVE-2021-38497
-
report
https://ubuntu.com/security/CVE-2021-38498
-
report
https://ubuntu.com/security/CVE-2021-38500
-
report
https://ubuntu.com/security/CVE-2021-38501
-
report
https://ubuntu.com/security/CVE-2021-38502
-
report
https://ubuntu.com/security/CVE-2021-38503
-
report
https://ubuntu.com/security/CVE-2021-38504
-
report
https://ubuntu.com/security/CVE-2021-38506
-
report
https://ubuntu.com/security/CVE-2021-38507
-
report
https://ubuntu.com/security/CVE-2021-38508
-
report
https://ubuntu.com/security/CVE-2021-38509
-
report
https://ubuntu.com/security/CVE-2021-43528
-
report
https://ubuntu.com/security/CVE-2021-43534
-
report
https://ubuntu.com/security/CVE-2021-43535
-
report
https://ubuntu.com/security/CVE-2021-43536
-
report
https://ubuntu.com/security/CVE-2021-43537
-
report
https://ubuntu.com/security/CVE-2021-43538
-
report
https://ubuntu.com/security/CVE-2021-43539
-
report
https://ubuntu.com/security/CVE-2021-43541
-
report
https://ubuntu.com/security/CVE-2021-43542
-
report
https://ubuntu.com/security/CVE-2021-43543
-
report
https://ubuntu.com/security/CVE-2021-43545
-
report
https://ubuntu.com/security/CVE-2021-43546
-
report
https://ubuntu.com/security/CVE-2021-44538
-
report
https://ubuntu.com/security/CVE-2022-22737
-
report
https://ubuntu.com/security/CVE-2022-22738
-
report
https://ubuntu.com/security/CVE-2022-22739
-
report
https://ubuntu.com/security/CVE-2022-22740
-
report
https://ubuntu.com/security/CVE-2022-22741
-
report
https://ubuntu.com/security/CVE-2022-22742