Thunderbird vulnerabilities

Vulnerability in Thunderbird allowed malicious sites to use redirects to send credentialed requests to arbitrary endpoints on sites that invoked the Storage Access API, enabling potential CSRF attacks across origins. Fixed in Firefox 138 and Thunderbird 138.

A vulnerability was identified in Thunderbird where XPath parsing could trigger undefined behavior due to missing null checks during attribute access. This could lead to out-of-bounds read access and potentially, memory corruption. This vulnerability was fixed in Firefox 138, Firefox ESR 128.10, Thunderbird 138, and Thunderbird 128.10.

Modification of specific WebGL shader attributes could trigger an out-of-bounds read, which, when chained with other vulnerabilities, could be used to escalate privileges. This bug only affects Thunderbird for macOS. Fixed in Firefox 138, Firefox ESR 128.10, Firefox ESR 115.23, Thunderbird 138, and Thunderbird 128.10.

Unexpected data returned from the Safe Browsing API could have led to memory corruption and a potentially exploitable crash. This vulnerability affects Thunderbird < 102.10 and Firefox ESR < 102.10.

If a MIME email combines OpenPGP and OpenPGP MIME data in a certain way, Thunderbird repeatedly attempts to process and display the message, which could cause the user interface to lock up and stop responding. An attacker could send a crafted message with this structure to attempt a DoS attack. This vulnerability affects Thunderbird < 102.8.

Thunderbird versions from 68 to 102.9.1 did not check the OCSP revocation status of recipient certificates when sending S/MIME encrypted email, so revoked certificates were accepted. The vulnerability affects Thunderbird < 102.10.

Certificate OCSP revocation status was not checked when verifying S/MIME signatures. Mail signed with a revoked certificate would be displayed as having a valid signature. Thunderbird versions from 68 to 102.7.0 were affected.