Vulnerabilities > Mozilla > Thunderbird > 37.0
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2020-07-09 | CVE-2020-12405 | Use After Free vulnerability in multiple products When browsing a malicious page, a race condition in our SharedWorkerService could occur and lead to a potentially exploitable crash. | 2.6 |
| 2020-07-09 | CVE-2020-12399 | Information Exposure Through Discrepancy vulnerability in multiple products NSS has shown timing differences when performing DSA signatures, which was exploitable and could eventually leak private keys. | 1.2 |
| 2020-07-09 | CVE-2020-12398 | Cleartext Transmission of Sensitive Information vulnerability in multiple products If Thunderbird is configured to use STARTTLS for an IMAP server, and the server sends a PREAUTH response, then Thunderbird will continue with an unencrypted connection, causing email data to be sent without protection. | 4.3 |
| 2020-07-09 | CVE-2018-12371 | Integer Overflow or Wraparound vulnerability in Mozilla Firefox, Firefox ESR and Thunderbird An integer overflow vulnerability in the Skia library when allocating memory for edge builders on some systems with at least 16 GB of RAM. | 6.8 |
| 2020-05-26 | CVE-2020-6831 | Classic Buffer Overflow vulnerability in multiple products A buffer overflow could occur when parsing and validating SCTP chunks in WebRTC. | 7.5 |
| 2020-05-26 | CVE-2020-12392 | Path Traversal vulnerability in multiple products The 'Copy as cURL' feature of Devtools' network tab did not properly escape the HTTP POST data of a request, which can be controlled by the website. | 2.1 |
| 2020-05-26 | CVE-2020-12387 | Use After Free vulnerability in Mozilla Firefox A race condition when running shutdown code for Web Worker led to a use-after-free vulnerability. | 6.8 |
| 2020-05-26 | CVE-2020-12395 | Out-of-bounds Write vulnerability in multiple products Mozilla developers and community members reported memory safety bugs present in Firefox 75 and Firefox ESR 68.7. | 10.0 |
| 2020-05-26 | CVE-2020-12393 | Injection vulnerability in Mozilla Firefox The 'Copy as cURL' feature of Devtools' network tab did not properly escape the HTTP method of a request, which can be controlled by the website. | 4.6 |
| 2020-05-22 | CVE-2020-12397 | Origin Validation Error vulnerability in multiple products By encoding Unicode whitespace characters within the From email header, an attacker can spoof the sender email address that Thunderbird displays. | 4.3 |