GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration
usn-4995-1
Vulnerability from osv_ubuntu
Published
2021-06-22 16:43
Modified
2026-04-22 07:36
Summary
thunderbird vulnerabilities
Details

Multiple security issues were discovered in Thunderbird. If a user were tricked into opening a specially crafted website in a browsing context, an attacker could potentially exploit these to cause a denial of service, obtain sensitive information, spoof the UI, bypass security restrictions, or execute arbitrary code. (CVE-2021-23961, CVE-2021-23981, CVE-2021-23982, CVE-2021-23987, CVE-2021-23994, CVE-2021-23998, CVE-2021-23999, CVE-2021-29945, CVE-2021-29946, CVE-2021-29967)

It was discovered that extensions could open popup windows with control of the window title in some circumstances. If a user were tricked into installing a specially crafted extension, an attacker could potentially exploit this to spoof a website and trick the user into providing credentials. (CVE-2021-23984)

Multiple security issues were discovered in Thunderbird's OpenPGP integration. If a user were tricked into importing a specially crafted key in some circumstances, an attacker could potentially exploit this to cause a denial of service (inability to send encrypted email) or confuse the user. (CVE-2021-23991, CVE-2021-23992, CVE-2021-23993)

A use-after-free was discovered when Responsive Design Mode was enabled. If a user were tricked into opening a specially crafted website with Responsive Design Mode enabled, an attacker could potentially exploit this to cause a denial of service, or execute arbitrary code. (CVE-2021-23995)

It was discovered that Thunderbird mishandled ftp URLs with encoded newline characters. If a user were tricked into clicking on a specially crafted link, an attacker could potentially exploit this to send arbitrary FTP commands. (CVE-2021-24002)

It was discovered that Thunderbird wrote signatures to disk and read them back during verification. A local attacker could potentially exploit this to replace the data with another signature file. (CVE-2021-29948)

It was discovered that Thunderbird might load an alternative OTR library. If a user were tricked into copying a specially crafted library to one of Thunderbird's search paths, an attacker could potentially exploit this to execute arbitrary code. (CVE-2021-29949)

It was discovered that secret keys imported into Thunderbird were stored unencrypted. A local attacker could potentially exploit this to obtain private keys. (CVE-2021-29956)

It was discovered that Thunderbird did not indicate when an inline signed or encrypted message contained additional unprotected parts. (CVE-2021-29957)

References
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2021-23961",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2021-23981",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2021-23982",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2021-23984",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2021-23987",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2021-23991",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2021-23992",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2021-23993",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2021-23994",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2021-23995",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2021-23998",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2021-23999",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2021-24002",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2021-29945",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2021-29946",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2021-29948",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2021-29949",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2021-29956",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2021-29957",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2021-29967",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:20.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "thunderbird",
            "binary_version": "1:78.11.0+build1-0ubuntu0.20.04.2"
          },
          {
            "binary_name": "thunderbird-gnome-support",
            "binary_version": "1:78.11.0+build1-0ubuntu0.20.04.2"
          },
          {
            "binary_name": "thunderbird-mozsymbols",
            "binary_version": "1:78.11.0+build1-0ubuntu0.20.04.2"
          },
          {
            "binary_name": "xul-ext-calendar-timezones",
            "binary_version": "1:78.11.0+build1-0ubuntu0.20.04.2"
          },
          {
            "binary_name": "xul-ext-gdata-provider",
            "binary_version": "1:78.11.0+build1-0ubuntu0.20.04.2"
          },
          {
            "binary_name": "xul-ext-lightning",
            "binary_version": "1:78.11.0+build1-0ubuntu0.20.04.2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:20.04:LTS",
        "name": "thunderbird",
        "purl": "pkg:deb/ubuntu/thunderbird@1:78.11.0+build1-0ubuntu0.20.04.2?arch=source\u0026distro=focal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1:78.11.0+build1-0ubuntu0.20.04.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1:68.1.2+build1-0ubuntu1",
        "1:68.1.2+build1-0ubuntu2",
        "1:68.2.1+build1-0ubuntu1",
        "1:68.2.2+build1-0ubuntu1",
        "1:68.3.0+build2-0ubuntu1",
        "1:68.3.1+build1-0ubuntu2",
        "1:68.4.1+build1-0ubuntu1",
        "1:68.4.2+build2-0ubuntu1",
        "1:68.5.0+build1-0ubuntu1",
        "1:68.6.0+build2-0ubuntu1",
        "1:68.7.0+build1-0ubuntu1",
        "1:68.7.0+build1-0ubuntu2",
        "1:68.8.0+build2-0ubuntu0.20.04.2",
        "1:68.10.0+build1-0ubuntu0.20.04.1",
        "1:78.7.1+build1-0ubuntu0.20.04.1",
        "1:78.8.1+build1-0ubuntu0.20.04.1"
      ]
    }
  ],
  "aliases": [],
  "details": "Multiple security issues were discovered in Thunderbird. If a user were\ntricked into opening a specially crafted website in a browsing context, an\nattacker could potentially exploit these to cause a denial of service,\nobtain sensitive information, spoof the UI, bypass security restrictions,\nor execute arbitrary code. (CVE-2021-23961, CVE-2021-23981,\nCVE-2021-23982, CVE-2021-23987, CVE-2021-23994, CVE-2021-23998,\nCVE-2021-23999, CVE-2021-29945, CVE-2021-29946, CVE-2021-29967)\n\nIt was discovered that extensions could open popup windows with control\nof the window title in some circumstances. If a user were tricked into\ninstalling a specially crafted extension, an attacker could potentially\nexploit this to spoof a website and trick the user into providing\ncredentials. (CVE-2021-23984)\n\nMultiple security issues were discovered in Thunderbird\u0027s OpenPGP\nintegration. If a user were tricked into importing a specially crafted\nkey in some circumstances, an attacker could potentially exploit this\nto cause a denial of service (inability to send encrypted email) or\nconfuse the user. (CVE-2021-23991, CVE-2021-23992, CVE-2021-23993)\n\nA use-after-free was discovered when Responsive Design Mode was\nenabled. If a user were tricked into opening a specially crafted\nwebsite with Responsive Design Mode enabled, an attacker could\npotentially exploit this to cause a denial of service, or execute\narbitrary code. (CVE-2021-23995)\n\nIt was discovered that Thunderbird mishandled ftp URLs with encoded\nnewline characters. If a user were tricked into clicking on a specially\ncrafted link, an attacker could potentially exploit this to send arbitrary\nFTP commands. (CVE-2021-24002)\n\nIt was discovered that Thunderbird wrote signatures to disk and read them\nback during verification. A local attacker could potentially exploit this\nto replace the data with another signature file. (CVE-2021-29948)\n\nIt was discovered that Thunderbird might load an alternative OTR\nlibrary. If a user were tricked into copying a specially crafted\nlibrary to one of Thunderbird\u0027s search paths, an attacker could\npotentially exploit this to execute arbitrary code. (CVE-2021-29949)\n\nIt was discovered that secret keys imported into Thunderbird were\nstored unencrypted. A local attacker could potentially exploit this to\nobtain private keys. (CVE-2021-29956)\n\nIt was discovered that Thunderbird did not indicate when an inline signed\nor encrypted message contained additional unprotected parts.\n(CVE-2021-29957)\n",
  "id": "USN-4995-1",
  "modified": "2026-04-22T07:36:59Z",
  "published": "2021-06-22T16:43:02Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-4995-1"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2021-23961"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2021-23981"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2021-23982"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2021-23984"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2021-23987"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2021-23991"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2021-23992"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2021-23993"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2021-23994"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2021-23995"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2021-23998"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2021-23999"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2021-24002"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2021-29945"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2021-29946"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2021-29948"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2021-29949"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2021-29956"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2021-29957"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2021-29967"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "summary": "thunderbird vulnerabilities",
  "upstream": [
    "UBUNTU-CVE-2021-23961",
    "UBUNTU-CVE-2021-23981",
    "UBUNTU-CVE-2021-23982",
    "UBUNTU-CVE-2021-23984",
    "UBUNTU-CVE-2021-23987",
    "UBUNTU-CVE-2021-23991",
    "UBUNTU-CVE-2021-23992",
    "UBUNTU-CVE-2021-23993",
    "UBUNTU-CVE-2021-23994",
    "UBUNTU-CVE-2021-23995",
    "UBUNTU-CVE-2021-23998",
    "UBUNTU-CVE-2021-23999",
    "UBUNTU-CVE-2021-24002",
    "UBUNTU-CVE-2021-29945",
    "UBUNTU-CVE-2021-29946",
    "UBUNTU-CVE-2021-29948",
    "UBUNTU-CVE-2021-29949",
    "UBUNTU-CVE-2021-29956",
    "UBUNTU-CVE-2021-29957",
    "UBUNTU-CVE-2021-29967"
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.