Vulnerabilities > Mozilla > Thunderbird > Medium
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2021-09-06 | CVE-2021-40529 | Use of a Broken or Risky Cryptographic Algorithm vulnerability in multiple products The ElGamal implementation in Botan through 2.18.1, as used in Thunderbird and other products, allows plaintext recovery because, during interaction between two cryptographic libraries, a certain dangerous combination of the prime defined by the receiver's public key, the generator defined by the receiver's public key, and the sender's ephemeral exponents can lead to a cross-configuration attack against OpenPGP. | 5.9 |
| 2021-08-17 | CVE-2021-29982 | Missing Release of Resource after Effective Lifetime vulnerability in Mozilla Firefox Due to incorrect JIT optimization, we incorrectly interpreted data from the wrong type of object, resulting in the potential leak of a single bit of memory. | 6.5 |
| 2021-08-17 | CVE-2021-29987 | Improper Restriction of Excessive Authentication Attempts vulnerability in Mozilla Firefox After requesting multiple permissions, and closing the first permission panel, subsequent permission panels will be displayed in a different position but still record a click in the default location, making it possible to trick a user into accepting a permission they did not want to. | 6.5 |
| 2021-08-05 | CVE-2021-29969 | Files or Directories Accessible to External Parties vulnerability in Mozilla Thunderbird If Thunderbird was configured to use STARTTLS for an IMAP connection, and an attacker injected IMAP server responses prior to the completion of the STARTTLS handshake, then Thunderbird didn't ignore the injected data. | 5.9 |
| 2021-06-24 | CVE-2021-23991 | Unspecified vulnerability in Mozilla Thunderbird If a Thunderbird user has previously imported Alice's OpenPGP key, and Alice has extended the validity period of her key, but Alice's updated key has not yet been imported, an attacker may send an email containing a crafted version of Alice's key with an invalid subkey, Thunderbird might subsequently attempt to use the invalid subkey, and will fail to send encrypted email to Alice. | 6.8 |
| 2021-06-24 | CVE-2021-23992 | Improper Verification of Cryptographic Signature vulnerability in Mozilla Thunderbird Thunderbird did not check if the user ID associated with an OpenPGP key has a valid self signature. | 4.3 |
| 2021-06-24 | CVE-2021-23993 | Improper Verification of Cryptographic Signature vulnerability in Mozilla Thunderbird An attacker may perform a DoS attack to prevent a user from sending encrypted email to a correspondent. | 6.5 |
| 2021-06-24 | CVE-2021-23998 | Insufficient Verification of Data Authenticity vulnerability in Mozilla Thunderbird Through complicated navigations with new windows, an HTTP page could have inherited a secure lock icon from an HTTPS page. | 6.5 |
| 2021-06-24 | CVE-2021-29945 | Incorrect Calculation vulnerability in Mozilla Firefox, Firefox ESR and Thunderbird The WebAssembly JIT could miscalculate the size of a return type, which could lead to a null read and result in a crash. | 6.5 |
| 2021-06-24 | CVE-2021-29951 | Improper Privilege Management vulnerability in Mozilla Firefox The Mozilla Maintenance Service granted SERVICE_START access to BUILTIN|Users which, in a domain network, grants normal remote users access to start or stop the service. | 6.5 |