If Thunderbird was configured to use STARTTLS for an IMAP connection, and an attacker injected IMAP server responses prior to the completion of the STARTTLS handshake, then Thunderbird didn't ignore the injected data. This could have resulted in Thunderbird showing incorrect information, for example the attacker could have tricked Thunderbird to show folders that didn't exist on the IMAP server. This vulnerability affects Thunderbird < 78.12.
CVSS Details
- CVSS 3.1 Base Score: 5.9
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade thunderbird | May 4, 2022 | Aug 5, 2021 |
| Alpine Linux | — | Upgrade thunderbird | Aug 22, 2024 | Aug 5, 2021 |
| Amazon Linux Ami 2 | — | Upgrade thunderbirdUpgrade thunderbird-debuginfo | Sep 16, 2021 | Aug 5, 2021 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Aug 5, 2021 |
| Centos_linux | — | Upgrade thunderbird-debugsourceUpgrade thunderbird-debuginfoUpgrade thunderbird | Jul 27, 2021 | Jul 26, 2021 |
| Debian | — | Upgrade thunderbird | Jul 20, 2021 | Jul 20, 2021 |
| Gentoo Linux | — | Upgrade mail-client/thunderbird-bin.Upgrade mail-client/thunderbird. | Aug 11, 2022 | Aug 5, 2021 |
| Mozilla Thunderbird | — | Upgrade to the latest version of Mozilla ThunderbirdUpgrade to Mozilla Thunderbird version 78.12 | Jul 14, 2021 | Jul 13, 2021 |
| Oracle Solaris | — | Upgrade web/data/firefox-bookmarks to version 78.14.0-11.4.38.0.1.101.3 on Solaris 11.4Upgrade web/browser/firefox to version 78.14.0-11.4.38.0.1.101.3 on Solaris 11.4Upgrade mail/thunderbird to version 78.14.0-11.4.38.0.1.101.3 on Solaris 11.4 | Nov 17, 2021 | Aug 5, 2021 |
| Oracle_linux | — | Upgrade thunderbird | Jul 27, 2021 | Jul 13, 2021 |
| Redhat_linux | — | Upgrade thunderbirdNo solution existsUpgrade thunderbird-debuginfoUpgrade thunderbird-debugsource | Jul 27, 2021 | Jul 26, 2021 |
| Rocky_linux | — | Upgrade thunderbird-debugsourceUpgrade thunderbird-debuginfoUpgrade thunderbird | May 5, 2022 | Aug 5, 2021 |
| Suse | — | Upgrade MozillaThunderbird-translations-commonUpgrade MozillaThunderbirdUpgrade MozillaThunderbird-translations-other | Jul 23, 2021 | Jul 22, 2021 |
| Ubuntu | — | Upgrade thunderbird | Sep 1, 2021 | Jul 22, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub