If Thunderbird is configured to use STARTTLS for an IMAP server, and the server sends a PREAUTH response, then Thunderbird will continue with an unencrypted connection, causing email data to be sent without protection. This vulnerability affects Thunderbird < 68.9.0.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade thunderbird | Aug 22, 2024 | Jul 9, 2020 |
| Amazon Linux Ami 2 | — | Upgrade thunderbird-debuginfoUpgrade thunderbird | Jul 21, 2020 | Jul 9, 2020 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Jul 9, 2020 |
| Centos_linux | — | Upgrade thunderbirdUpgrade thunderbird-debuginfoUpgrade thunderbird-debugsource | Jun 23, 2020 | Jun 18, 2020 |
| Debian | — | Upgrade thunderbird | Jun 15, 2020 | Jun 15, 2020 |
| Gentoo Linux | — | Upgrade mail-client/thunderbird-bin.Upgrade mail-client/thunderbird. | Jun 16, 2020 | Jun 15, 2020 |
| Mozilla Thunderbird | — | Upgrade to Mozilla Thunderbird version 68.9 | Jun 5, 2020 | Jun 2, 2020 |
| Oracle Solaris | — | Upgrade mail/thunderbird/plugin/thunderbird-lightning to version 68.9.0-11.4.23.0.1.69.3 on Solaris 11.4Upgrade mail/thunderbird to version 68.9.0-11.4.23.0.1.69.3 on Solaris 11.4 | Jan 19, 2021 | Jul 9, 2020 |
| Oracle_linux | — | Upgrade thunderbird | Jun 21, 2020 | Jun 2, 2020 |
| Redhat_linux | — | Upgrade thunderbirdUpgrade thunderbird-debugsourceUpgrade thunderbird-debuginfoNo solution exists | Jun 23, 2020 | Jun 18, 2020 |
| Suse | — | Upgrade mozillathunderbird-translations-commonUpgrade mozillathunderbird-translations-otherUpgrade mozillathunderbird | Jun 13, 2020 | Jun 10, 2020 |
| Ubuntu | — | Upgrade thunderbird | Aug 5, 2020 | Jun 10, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub