{
  "cveId": "CVE-2021-29969",
  "url": "https://patchblox.com/security/cve/CVE-2021-29969",
  "summary": "CVE-2021-29969 is fixed in 7 products on 2 platforms, first by Mozilla Thunderbird (en-US) 78.12.0, released July 12, 2021. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "Thunderbird and 1 other: If Thunderbird was configured to use STARTTLS for an IMAP connection, and an attacker injected IMAP server\u2026",
  "description": "If Thunderbird was configured to use STARTTLS for an IMAP connection, and an attacker injected IMAP server responses prior to the completion of the STARTTLS handshake, then Thunderbird didn\u0027t ignore the injected data. This could have resulted in Thunderbird showing incorrect information, for example the attacker could have tricked Thunderbird to show folders that didn\u0027t exist on the IMAP server. This vulnerability affects Thunderbird \u003C 78.12.",
  "published": "2021-07-26T00:00:00Z",
  "severity": "Important",
  "cvss": 5.9,
  "epss": 0.012,
  "epssPercentile": 0.68371,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "vendorAdvisory": "https://nvd.nist.gov/vuln/detail/CVE-2021-29969",
  "fixes": [
    {
      "platform": "windows-app",
      "product": "Mozilla Thunderbird (en-US)",
      "fixedVersion": "78.12.0",
      "fix": "Mozilla Thunderbird (en-US) 78.12.0",
      "url": "https://patchblox.com/security/fix/windows-app/mozilla.thunderbird-78.12.0",
      "released": "2021-07-12T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "thunderbird",
      "release": "RHEL 8",
      "fixedVersion": "0:78.12.0-3.el8_4",
      "fix": "RHSA-2021:2883",
      "url": "https://patchblox.com/security/fix/linux/rhsa-2021-2883",
      "released": "2021-07-26T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "thunderbird",
      "release": "Ubuntu 18.04.6 LTS (bionic)",
      "fixedVersion": "1:78.13.0\u002Bbuild1-0ubuntu0.18.04.1",
      "fix": "thunderbird 1:78.13.0\u002Bbuild1-0ubuntu0.18.04.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-bionic-thunderbird-1-78.13.0-build1-0ubuntu0.18.04.1",
      "released": "2021-08-10T17:00:00Z"
    },
    {
      "platform": "linux",
      "product": "thunderbird",
      "release": "Ubuntu 20.04 LTS (focal)",
      "fixedVersion": "1:78.13.0\u002Bbuild1-0ubuntu0.20.04.2",
      "fix": "thunderbird 1:78.13.0\u002Bbuild1-0ubuntu0.20.04.2",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-focal-thunderbird-1-78.13.0-build1-0ubuntu0.20.04.2",
      "released": "2021-08-10T17:00:00Z"
    },
    {
      "platform": "linux",
      "product": "thunderbird",
      "release": "ol 8",
      "fixedVersion": "0:78.12.0-3.0.1.el8_4",
      "fix": "ELSA-2021-2883",
      "url": "https://patchblox.com/security/fix/linux/elsa-2021-2883",
      "released": "2021-07-27T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "thunderbird-gnome-support",
      "release": "Ubuntu 18.04.6 LTS (bionic)",
      "fixedVersion": "1:78.13.0\u002Bbuild1-0ubuntu0.18.04.1",
      "fix": "thunderbird-gnome-support 1:78.13.0\u002Bbuild1-0ubuntu0.18.04.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-bionic-thunderbird-gnome-support-1-78.13.0-build1-0ubuntu0.18.04.1",
      "released": "2021-08-10T17:00:00Z"
    },
    {
      "platform": "linux",
      "product": "thunderbird-gnome-support",
      "release": "Ubuntu 20.04 LTS (focal)",
      "fixedVersion": "1:78.13.0\u002Bbuild1-0ubuntu0.20.04.2",
      "fix": "thunderbird-gnome-support 1:78.13.0\u002Bbuild1-0ubuntu0.20.04.2",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-focal-thunderbird-gnome-support-1-78.13.0-build1-0ubuntu0.20.04.2",
      "released": "2021-08-10T17:00:00Z"
    },
    {
      "platform": "linux",
      "product": "thunderbird-mozsymbols",
      "release": "Ubuntu 18.04.6 LTS (bionic)",
      "fixedVersion": "1:78.13.0\u002Bbuild1-0ubuntu0.18.04.1",
      "fix": "thunderbird-mozsymbols 1:78.13.0\u002Bbuild1-0ubuntu0.18.04.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-bionic-thunderbird-mozsymbols-1-78.13.0-build1-0ubuntu0.18.04.1",
      "released": "2021-08-10T17:00:00Z"
    },
    {
      "platform": "linux",
      "product": "thunderbird-mozsymbols",
      "release": "Ubuntu 20.04 LTS (focal)",
      "fixedVersion": "1:78.13.0\u002Bbuild1-0ubuntu0.20.04.2",
      "fix": "thunderbird-mozsymbols 1:78.13.0\u002Bbuild1-0ubuntu0.20.04.2",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-focal-thunderbird-mozsymbols-1-78.13.0-build1-0ubuntu0.20.04.2",
      "released": "2021-08-10T17:00:00Z"
    },
    {
      "platform": "linux",
      "product": "xul-ext-calendar-timezones",
      "release": "Ubuntu 18.04.6 LTS (bionic)",
      "fixedVersion": "1:78.13.0\u002Bbuild1-0ubuntu0.18.04.1",
      "fix": "xul-ext-calendar-timezones 1:78.13.0\u002Bbuild1-0ubuntu0.18.04.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-bionic-xul-ext-calendar-timezones-1-78.13.0-build1-0ubuntu0.18.04.1",
      "released": "2021-08-10T17:00:00Z"
    },
    {
      "platform": "linux",
      "product": "xul-ext-calendar-timezones",
      "release": "Ubuntu 20.04 LTS (focal)",
      "fixedVersion": "1:78.13.0\u002Bbuild1-0ubuntu0.20.04.2",
      "fix": "xul-ext-calendar-timezones 1:78.13.0\u002Bbuild1-0ubuntu0.20.04.2",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-focal-xul-ext-calendar-timezones-1-78.13.0-build1-0ubuntu0.20.04.2",
      "released": "2021-08-10T17:00:00Z"
    },
    {
      "platform": "linux",
      "product": "xul-ext-gdata-provider",
      "release": "Ubuntu 18.04.6 LTS (bionic)",
      "fixedVersion": "1:78.13.0\u002Bbuild1-0ubuntu0.18.04.1",
      "fix": "xul-ext-gdata-provider 1:78.13.0\u002Bbuild1-0ubuntu0.18.04.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-bionic-xul-ext-gdata-provider-1-78.13.0-build1-0ubuntu0.18.04.1",
      "released": "2021-08-10T17:00:00Z"
    },
    {
      "platform": "linux",
      "product": "xul-ext-gdata-provider",
      "release": "Ubuntu 20.04 LTS (focal)",
      "fixedVersion": "1:78.13.0\u002Bbuild1-0ubuntu0.20.04.2",
      "fix": "xul-ext-gdata-provider 1:78.13.0\u002Bbuild1-0ubuntu0.20.04.2",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-focal-xul-ext-gdata-provider-1-78.13.0-build1-0ubuntu0.20.04.2",
      "released": "2021-08-10T17:00:00Z"
    },
    {
      "platform": "linux",
      "product": "xul-ext-lightning",
      "release": "Ubuntu 18.04.6 LTS (bionic)",
      "fixedVersion": "1:78.13.0\u002Bbuild1-0ubuntu0.18.04.1",
      "fix": "xul-ext-lightning 1:78.13.0\u002Bbuild1-0ubuntu0.18.04.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-bionic-xul-ext-lightning-1-78.13.0-build1-0ubuntu0.18.04.1",
      "released": "2021-08-10T17:00:00Z"
    },
    {
      "platform": "linux",
      "product": "xul-ext-lightning",
      "release": "Ubuntu 20.04 LTS (focal)",
      "fixedVersion": "1:78.13.0\u002Bbuild1-0ubuntu0.20.04.2",
      "fix": "xul-ext-lightning 1:78.13.0\u002Bbuild1-0ubuntu0.20.04.2",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-focal-xul-ext-lightning-1-78.13.0-build1-0ubuntu0.20.04.2",
      "released": "2021-08-10T17:00:00Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T19:12:23Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}