Description
When reading SMTP server status codes, Thunderbird writes an integer value to a position on the stack that is intended to contain just one byte. Depending on processor architecture and stack layout, this leads to stack corruption that may be exploitable. This vulnerability affects Thunderbird < 78.5.1.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Mozilla | Thunderbird | < 78.5.1 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | thunderbird | 1:78.5.1-1 | — |
| Debian 13 | thunderbird | 1:78.5.1-1 | — |
| Debian 12 | thunderbird | 1:78.5.1-1 | — |
| Debian 10 | thunderbird | 1:78.5.1-1~deb10u1 | DSA-4802-1 |
| Debian 9 | thunderbird | 1:78.5.1-1~deb9u1 | DLA-2479-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | thunderbird | 1:78.7.1+build1-0ubuntu0.20.04.1 | — |
| Ubuntu 18.04 LTS | thunderbird | 1:78.8.1+build1-0ubuntu0.18.04.1 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 8 | thunderbird | 78.5.1-1.el8_3 | RHSA-2020:5398 |
| RHEL 7 | thunderbird | 78.5.1-1.el7_9 | RHSA-2020:5400 |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 8.2 EUS | thunderbird | 78.5.1-1.el8_2 | RHSA-2020:5399 |
| RHEL 8.1 EUS | thunderbird | 78.6.0-1.el8_1 | RHSA-2020:5644 |
| RHEL 8.0 E4S | thunderbird | 78.6.0-1.el8_0 | RHSA-2020:5645 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP2 | MozillaThunderbird | 78.6.0-8.3.1 | SUSE-SU-2020:3935-1 |
| SLES 15 SP1 | MozillaThunderbird | 78.5.1-3.110.2 | SUSE-SU-2020:3642-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | MozillaThunderbird | 91.1.1-1.1 | openSUSE-SU-2024:10601-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.23 | thunderbird | 78.5.1-r0 | — |
| Alpine v3.22 | thunderbird | 78.5.1-r0 | — |
| Alpine v3.21 | thunderbird | 78.5.1-r0 | — |
| Alpine v3.20 | thunderbird | 78.5.1-r0 | — |
| Alpine v3.19 | thunderbird | 78.5.1-r0 | — |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.18 | thunderbird | 78.5.1-r0 | — |
| Alpine v3.17 | thunderbird | 78.5.1-r0 | — |
| Alpine v3.16 | thunderbird | 78.5.1-r0 | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 8 | thunderbird | 78.5.1-1.0.1.el8_3 | ELSA-2020-5398 |
| Oracle Linux 7 | thunderbird | 78.5.1-1.0.1.el7_9 | ELSA-2020-5400 |
Advisories 12
- RHSA-2020:5400 Red Hat Security Advisory: thunderbird security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-4802-1 thunderbird - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-2479-1 thunderbird - security update Debian Security (DSA / DLA) · Mar 9, 2026
- SUSE-SU-2020:3642-1 Security update for MozillaThunderbird SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2020:3935-1 Security update for MozillaThunderbird SUSE / openSUSE Security Updates · Feb 4, 2026
- RHSA-2020:5645 Red Hat Security Advisory: thunderbird security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- RHSA-2020:5644 Red Hat Security Advisory: thunderbird security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- RHSA-2020:5399 Red Hat Security Advisory: thunderbird security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- RHSA-2020:5398 Red Hat Security Advisory: thunderbird security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- openSUSE-SU-2024:10601-1 MozillaThunderbird-91.1.1-1.1 on GA media SUSE / openSUSE Security Updates · May 7, 2025
- ELSA-2020-5398 Important: thunderbird security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Dec 15, 2020
- ELSA-2020-5400 Important: thunderbird security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Dec 14, 2020