Certain crafted MIME email messages that claimed to contain an encrypted OpenPGP message, which instead contained an OpenPGP signed message, were wrongly shown as being encrypted. This vulnerability was fixed in Thunderbird 136 and Thunderbird 128.8.
CVSS Details
- CVSS 3.1 Base Score: 7
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade thunderbird-debuginfoUpgrade thunderbird | Apr 2, 2025 | Mar 10, 2025 |
| Debian | — | Upgrade thunderbird | Mar 12, 2025 | Mar 10, 2025 |
| Gentoo Linux | — | Upgrade mail-client/thunderbird-bin.Upgrade mail-client/thunderbird. | May 13, 2025 | Mar 10, 2025 |
| Mozilla Thunderbird | — | Upgrade to the latest version of Mozilla ThunderbirdUpgrade to Mozilla Thunderbird version 128.8 | Mar 11, 2025 | Mar 4, 2025 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Mar 10, 2025 |
| Suse | — | Upgrade MozillaThunderbirdUpgrade MozillaThunderbird-translations-otherUpgrade MozillaThunderbird-translations-common | Dec 5, 2025 | Mar 12, 2025 |
| Ubuntu | — | Upgrade thunderbird | Jul 23, 2025 | Mar 10, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub