If Thunderbird is configured to use STARTTLS for an IMAP server, and the server sends a PREAUTH response, then Thunderbird will continue with an unencrypted connection, causing email data to be sent without protection. This vulnerability affects Thunderbird < 68.9.0.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | alpine-linux-upgrade-thunderbird | Aug 22, 2024 | Jul 9, 2020 | |
| Amazon Linux Ami 2 | amazon-linux-ami-2-upgrade-thunderbirdamazon-linux-ami-2-upgrade-thunderbird-debuginfo | Jul 21, 2020 | Jul 9, 2020 | |
| Arch Linux | arch-linux-upgrade-latest | Jul 11, 2025 | Jul 9, 2020 | |
| Centos_linux | — | centos-upgrade-thunderbirdcentos-upgrade-thunderbird-debuginfocentos-upgrade-thunderbird-debugsource | Jun 23, 2020 | Jun 18, 2020 |
| Debian | debian-upgrade-thunderbird | Jun 15, 2020 | Jun 15, 2020 | |
| Gentoo Linux | gentoo-linux-upgrade-mail-client-thunderbirdgentoo-linux-upgrade-mail-client-thunderbird-bin | Jun 16, 2020 | Jun 15, 2020 | |
| Mozilla Thunderbird | mozilla-thunderbird-upgrade-68_9 | Jun 5, 2020 | Jun 2, 2020 | |
| Oracle Solaris | oracle-solaris-11-4-upgrade-mail-thunderbird-68-9-0-11-4-23-0-1-69-3oracle-solaris-11-4-upgrade-mail-thunderbird-plugin-thunderbird-lightning-68-9-0-11-4-23-0-1-69-3 | Jan 19, 2021 | Jul 9, 2020 | |
| Oracle_linux | — | oracle-linux-upgrade-thunderbird | Jun 21, 2020 | Jun 2, 2020 |
| Redhat_linux | redhat-upgrade-thunderbirdredhat-upgrade-thunderbird-debuginforedhat-upgrade-thunderbird-debugsource | Jun 23, 2020 | Jun 18, 2020 | |
| Suse | — | suse-upgrade-mozillathunderbirdsuse-upgrade-mozillathunderbird-translations-commonsuse-upgrade-mozillathunderbird-translations-other | Jun 13, 2020 | Jun 10, 2020 |
| Ubuntu | ubuntu-upgrade-thunderbird | Aug 5, 2020 | Jun 10, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub