Description
When saving or opening an email attachment on macOS, Thunderbird did not set attribute com.apple.quarantine on the received file. If the received file was an application and the user attempted to open it, then the application was started immediately without asking the user to confirm. This vulnerability affects Thunderbird < 102.3.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Mozilla | Thunderbird | unspecified – < 102.3 | 102.3 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP4 | MozillaThunderbird | 102.4.0-150200.8.85.1 | SUSE-SU-2022:3800-1 |
| SLES 15 SP3 | MozillaThunderbird | 102.4.0-150200.8.85.1 | SUSE-SU-2022:3800-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | MozillaThunderbird | 102.3.0-1.1 | openSUSE-SU-2024:12358-1 |
| openSUSE Leap 15.4 | MozillaThunderbird | 102.4.0-150200.8.85.1 | SUSE-SU-2022:3800-1 |
| openSUSE Leap 15.3 | MozillaThunderbird | 102.4.0-150200.8.85.1 | SUSE-SU-2022:3800-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2 | thunderbird | 102.7.1-1.amzn2.0.1 | ALAS2-2023-1951 |
Advisories 5
- openSUSE-SU-2024:12358-1 MozillaThunderbird-102.3.0-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2022:3800-1 Security update for MozillaThunderbird SUSE / openSUSE Security Updates · May 2, 2025
- ALAS2-2023-1951 Important: thunderbird security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Jan 30, 2025
- WID-SEC-2023-0561 Xerox FreeFlow Print Server: Mehrere Schwachstellen BSI CERT-Bund (WID) · May 18, 2023
- WID-SEC-2022-1497 Mozilla Thunderbird: Mehrere Schwachstellen BSI CERT-Bund (WID) · Feb 22, 2023