If Thunderbird was configured to use STARTTLS for an IMAP connection, and an attacker injected IMAP server responses prior to the completion of the STARTTLS handshake, then Thunderbird didn't ignore the injected data. This could have resulted in Thunderbird showing incorrect information, for example the attacker could have tricked Thunderbird to show folders that didn't exist on the IMAP server. This vulnerability affects Thunderbird < 78.12.
CVSS Details
- CVSS 3.1 Base Score: 5.9
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade thunderbird | May 4, 2022 | Aug 5, 2021 |
| Alpine Linux | — | Upgrade thunderbird | Aug 22, 2024 | Aug 5, 2021 |
| Amazon Linux Ami 2 | — | Upgrade thunderbird-debuginfoUpgrade thunderbird | Sep 16, 2021 | Aug 5, 2021 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Aug 5, 2021 |
| Centos_linux | — | Upgrade thunderbird-debugsourceUpgrade thunderbird-debuginfoUpgrade thunderbird | Jul 27, 2021 | Jul 26, 2021 |
| Debian | — | Upgrade thunderbird | Jul 20, 2021 | Jul 20, 2021 |
| Gentoo Linux | — | Upgrade mail-client/thunderbird.Upgrade mail-client/thunderbird-bin. | Aug 11, 2022 | Aug 5, 2021 |
| Mozilla Thunderbird | — | Upgrade to Mozilla Thunderbird version 78.12Upgrade to the latest version of Mozilla Thunderbird | Jul 14, 2021 | Jul 13, 2021 |
| Oracle Solaris | — | Upgrade mail/thunderbird to version 78.14.0-11.4.38.0.1.101.3 on Solaris 11.4Upgrade web/browser/firefox to version 78.14.0-11.4.38.0.1.101.3 on Solaris 11.4Upgrade web/data/firefox-bookmarks to version 78.14.0-11.4.38.0.1.101.3 on Solaris 11.4 | Nov 17, 2021 | Aug 5, 2021 |
| Oracle_linux | — | Upgrade thunderbird | Jul 27, 2021 | Jul 13, 2021 |
| Redhat_linux | — | Upgrade thunderbird-debuginfoUpgrade thunderbird-debugsourceNo solution existsUpgrade thunderbird | Jul 27, 2021 | Jul 26, 2021 |
| Rocky_linux | — | Upgrade thunderbirdUpgrade thunderbird-debuginfoUpgrade thunderbird-debugsource | May 5, 2022 | Aug 5, 2021 |
| Suse | — | Upgrade MozillaThunderbird-translations-commonUpgrade MozillaThunderbirdUpgrade MozillaThunderbird-translations-other | Jul 23, 2021 | Jul 22, 2021 |
| Ubuntu | — | Upgrade thunderbird | Sep 1, 2021 | Jul 22, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub