The encrypted subject of an email message could be incorrectly and permanently assigned to an arbitrary other email message in Thunderbird's local cache. Consequently, when replying to the contaminated email message, the user might accidentally leak the confidential subject to a third-party. While this update fixes the bug and avoids future message contamination, it does not automatically repair existing contaminations. Users are advised to use the repair folder functionality, which is available from the context menu of email folders, which will erase incorrect subject assignments. This vulnerability affects Thunderbird < 115.8.1.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade thunderbird | Apr 11, 2024 | Mar 4, 2024 |
| Amazon Linux Ami 2 | — | Upgrade thunderbirdUpgrade thunderbird-debuginfo | Mar 19, 2024 | Mar 4, 2024 |
| Centos_linux | — | Upgrade thunderbird-debuginfoUpgrade thunderbird | Apr 4, 2024 | Mar 4, 2024 |
| Debian | — | Upgrade thunderbird | Mar 25, 2024 | Mar 4, 2024 |
| Gentoo Linux | — | Upgrade mail-client/thunderbird.Upgrade mail-client/thunderbird-bin. | May 13, 2024 | Mar 4, 2024 |
| Mozilla Thunderbird | — | Upgrade to Mozilla Thunderbird version 115.8.1 | Mar 5, 2024 | Mar 4, 2024 |
| Oracle_linux | — | Upgrade thunderbird | Mar 26, 2024 | Mar 4, 2024 |
| Redhat_linux | — | Upgrade thunderbird-debuginfoNo solution existsUpgrade thunderbird-debugsourceUpgrade thunderbird | Mar 26, 2024 | Mar 4, 2024 |
| Rocky_linux | — | Upgrade thunderbird-debugsourceUpgrade thunderbird-debuginfoUpgrade thunderbird | Mar 28, 2024 | Mar 4, 2024 |
| Suse | — | Upgrade mozillathunderbirdUpgrade mozillathunderbird-translations-otherUpgrade mozillathunderbird-translations-common | Mar 15, 2024 | Mar 4, 2024 |
| Ubuntu | — | Upgrade thunderbird | Mar 8, 2024 | Mar 4, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub