Thunderbird vulnerabilities

A malicious or compromised IMAP server can trigger an out-of-bounds read in the IMAP response parser by sending an untagged '* ID' response, crashing Thunderbird. The affected parsing path is reachable before authentication.

A maliciously constructed mail header could lead to multiple fields being parsed as one, or potential memory safety violations. This vulnerability was fixed in Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.

Triggering an error condition in certain MIME bodies would cause uninitialized memory to be used. This vulnerability was fixed in Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2.

Malicious calendar invitations could use file URI attachments to launch local or network-hosted executables on Windows, bypassing Thunderbird's normal executable attachment protections. With the new invitation display enabled, the attachment could also appear under a misleading filename. This vulnerability was fixed in Thunderbird 154 and Thunderbird 153.2.

Internally found bugs present in Thunderbird 154, Thunderbird ESR 153.1 and Thunderbird ESR 140.14. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited. This vulnerability was fixed in Firefox 155, Firefox ESR 140.15, Firefox ESR 153.2, Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2.

Internally found bugs present in Thunderbird 154. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited. This vulnerability was fixed in Firefox 155 and Thunderbird 155.

Internally found bugs in Thunderbird ESR 140.13, Thunderbird ESR 153.0, and Thunderbird 153 showed evidence of memory corruption or another security-relevant defect. Fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.

Internally found bugs in Thunderbird 153 showed evidence of memory corruption or another security-relevant defect. Fixed in Firefox 154 and Thunderbird 154.

Internally found bugs in Thunderbird ESR 153.0 and Thunderbird 153 showed evidence of memory corruption or another security-relevant defect. Fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.

Internally found bugs in Thunderbird ESR 140.13, Thunderbird ESR 153.0, and Thunderbird 153 showed evidence of memory corruption or another security-relevant defect. Fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.

Memory safety bugs in Thunderbird ESR 140.12 that could allow arbitrary code execution. This vulnerability was fixed in Firefox ESR 115.38, Firefox ESR 140.13, and Thunderbird 140.13.

An attacker could cause a heap buffer overflow by getting a user to open an email that is greater than or equal to 2GB in size. This vulnerability was fixed in Thunderbird 157, Thunderbird 140.17, and Thunderbird 153.4.

A maliciously constructed IMAP line could cause an out-of-bounds buffer read. This vulnerability was fixed in Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.

The values of the mail.allowed_attachment_hostnames advanced config setting were used in a regular expression without escaping. For some possible valid hostnames, this could allow certain unintended hostnames to also match and serve remote attachments. This vulnerability was fixed in Thunderbird 155 and Thunderbird 153.2.

A malicious IMAP server can trigger use-after-free and heap-memory disclosure by sending a crafted ID response. Heap contents can ultimately be persisted to prefs.js. This vulnerability was fixed in Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2.

A maliciously constructed mail header could lead to a one byte read past the end of a buffer. This vulnerability was fixed in Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2.

Internally found bugs present in Thunderbird 154, Thunderbird ESR 153.1 and Thunderbird ESR 140.14. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited. This vulnerability was fixed in Firefox 155, Firefox ESR 115.40, Firefox ESR 140.15, Firefox ESR 153.2, Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2.

Internally found bugs present in Thunderbird 154 and Thunderbird ESR 153.1. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2.

The MIME header parsing code in Thunderbird when forwarding a message (with the setting to view all headers enabled) has an off-by-one error, allowing a single byte to be read from memory after the header buffer, potentially crashing Thunderbird. Fixed in Thunderbird 153 and Thunderbird 140.13.

A vulnerability in Thunderbird allows an attacker to inject arbitrary styled content, phishing links, and CSS via HTML chat messages (Matrix or XMPP). This flaw was fixed in Thunderbird 152.0.1 and Thunderbird 140.12.1.

A malicious LDAP server configured for address-book autocomplete in Thunderbird can send arbitrarily large data to the LDAP client, causing memory exhaustion and a crash. The vulnerability is fixed in Thunderbird 152.0.1 and 140.12.1.

A memory safety bug was fixed in Thunderbird ESR 140.12. This vulnerability was also patched in Firefox ESR 140.12 and Thunderbird 140.12.

Memory safety bugs were found in Thunderbird 150.0.0, some showing evidence of memory corruption that could potentially be exploited to run arbitrary code. The vulnerability was fixed in version 150.0.1.

Memory safety bugs were present in Thunderbird ESR 140.10.0 and Thunderbird 150.0.0. Some of these bugs showed evidence of memory corruption, which could potentially be exploited to run arbitrary code.

Memory safety bugs were found in Thunderbird ESR 140.10.0 and Thunderbird 150.0.0, showing evidence of memory corruption. With enough effort, these could have been exploited to run arbitrary code.

A malicious mail server could send malformed strings with negative lengths, causing the parser to read memory outside the buffer. If a mail server or connection to a mail server were compromised, an attacker could cause the parser to malfunction, potentially crashing Thunderbird or leaking sensitive data.

Vulnerability in Thunderbird allowed malicious sites to use redirects to send credentialed requests to arbitrary endpoints on sites that invoked the Storage Access API, enabling potential CSRF attacks across origins. Fixed in Firefox 138 and Thunderbird 138.

A vulnerability was identified in Thunderbird where XPath parsing could trigger undefined behavior due to missing null checks during attribute access. This could lead to out-of-bounds read access and potentially, memory corruption. This vulnerability was fixed in Firefox 138, Firefox ESR 128.10, Thunderbird 138, and Thunderbird 128.10.

Modification of specific WebGL shader attributes could trigger an out-of-bounds read, which, when chained with other vulnerabilities, could be used to escalate privileges. This bug only affects Thunderbird for macOS. Fixed in Firefox 138, Firefox ESR 128.10, Firefox ESR 115.23, Thunderbird 138, and Thunderbird 128.10.