Mozilla Thunderbird any version

An OpenPGP digital signature includes information about the date when the signature was created. When displaying an email that contains a digital signature, the email's date will be shown. If the dates were different, then Thunderbird didn't report the email as having an invalid signature. If an attacker performed a replay attack, in which an old email with old contents are resent at a later time, it could lead the victim to believe that the statements in the email are current. Fixed versions of Thunderbird will require that the signature's date roughly matches the displayed date of the email. This vulnerability affects Thunderbird < 102 and Thunderbird < 91.11.

Other issue in the Storage: IndexedDB component

Incorrect boundary conditions in the DOM: Device Interfaces component

When displaying the sender of an email, and the sender name contained the Braille Pattern Blank space character multiple times, Thunderbird would have displayed all the spaces. This could have been used by an attacker to send an email message with the attacker's digital signature, that was shown with an arbitrary sender email address chosen by the attacker. If the sender name started with a false email address, followed by many Braille space characters, the attacker's email address was not visible. Because Thunderbird compared the invisible sender address with the signature's email address, if the signing key or certificate was accepted by Thunderbird, the email was shown as having a valid digital signature. This vulnerability affects Thunderbird < 91.10.

JavaScript engine only wrote partial return value to stack

Incorrect JavaScript state machine for generators

Certificate OCSP revocation status was not checked when verifying S/Mime signatures. Mail signed with a revoked certificate would be displayed as having a valid signature. Thunderbird versions from 68 to 102.7.0 were affected by this bug. This vulnerability affects Thunderbird < 102.7.1.

OCSP revocation status of recipient certificates was not checked when sending S/Mime encrypted email, and revoked certificates would be accepted. Thunderbird versions from 68 to 102.9.1 were affected by this bug. This vulnerability affects Thunderbird < 102.10.

Tracking Links in Attachments Bypassed Remote Content Blocking

An attacker could have abused XSLT error handling to associate attacker-controlled content with another origin which was displayed in the address bar. This could have been used to fool the user into submitting data intended for the spoofed origin. This vulnerability affects Thunderbird < 102.2, Thunderbird < 91.13, Firefox ESR < 91.13, Firefox ESR < 102.2, and Firefox < 104.

Uninitialized memory in the JavaScript Engine component

Spoofing issue in Thunderbird

URL being dragged from cross-origin iframe into same tab triggers navigation

Dragging a URL from a cross-origin iframe that was removed during the drag could have led to user confusion and website spoofing attacks. This vulnerability affects Firefox < 111, Firefox ESR < 102.9, and Thunderbird < 102.9.

Spoofing issue in the Form Autofill component

Memory safety bugs fixed in Firefox 136, Thunderbird 136, Firefox ESR 128.8, and Thunderbird 128.8

Spoofing issue in the Privacy: Anti-Tracking component

When aborting the verification of an OTR chat session, an attacker could have caused a use-after-free bug leading to a potentially exploitable crash. This vulnerability affects Thunderbird < 128.2.

Missing thread synchronization primitives could have led to a data race on members of the PlaybackParams structure. This vulnerability affects Firefox < 133 and Thunderbird < 133.

Potential opening of private browsing tabs in normal browsing windows

Mitigation bypass in the File Handling component

Incorrect boundary conditions in the JavaScript: GC component

Chat UI manipulation by injection

Memory safety bugs fixed in Firefox 138 and Thunderbird 138

Same-origin policy bypass in the Layout component

Spoofing issue in the WebAuthn component in Firefox for Android

JIT optimization bug with different stack slot sizes

Specially crafted filename could be used to obscure download type

Address of e-mail sender can be spoofed by malicious email

Mitigation bypass in the DOM: Security component

Mitigation bypass in the DOM: postMessage component

Sandboxed iframes allowed links to open in external apps (Android only)

Memory safety bug fixed in Firefox 152

Some non-writable Object properties could be modified

Denial-of-service in the Graphics: ImageLib component

Denial-of-service in the Audio/Video: Playback component

Spoofing issue in the Address Bar component

Same-origin policy bypass in the Request Handling component

Cross-site request forgery via storage access API redirects

Same-origin policy bypass in the Networking: JAR component