# thunderbird-gnome-support 1:91.5.0+build1-0ubuntu0.18.04.1: thunderbird-gnome-support 1:91.5.0+build1-0ubuntu0.18.04.1 for Ubuntu 18.04.6 LTS (bionic)

thunderbird-gnome-support 1:91.5.0+build1-0ubuntu0.18.04.1, released February 16, 2023, fixes 45 CVEs in thunderbird-gnome-support. None of them is reported as exploited. Patch Radar priority: Urgent. The product is no longer supported.

- Web page: https://patchblox.com/security/fix/linux/ubuntu-bionic-thunderbird-gnome-support-1-91.5.0-build1-0ubuntu0.18.04.1
- Platform: Linux
- Released: Feb 16, 2023
- Priority: Urgent (Closes CVE-2021-4129, rated Critical)
- CVEs: 45, exploited: 0, on CISA KEV: 0

## Applies to

| Product | Release | Fixed in |
|---|---|---|
| [thunderbird-gnome-support](https://patchblox.com/security/data/product/linux/thunderbird-gnome-support.md) | Ubuntu 18.04.6 LTS (bionic) | 1:91.5.0+build1-0ubuntu0.18.04.1 |

## CVEs this fix closes

| CVE | Priority | Title | CVSS | EPSS | Exploitation |
|---|---|---|---:|---:|---|
| [CVE-2021-4129](https://patchblox.com/security/data/cve/CVE-2021-4129.md) | Urgent | Mozilla Firefox ESR and 3 others: Out-of-bounds Write | 9.8 | 0.0106 |  |
| [CVE-2021-43529](https://patchblox.com/security/data/cve/CVE-2021-43529.md) | Urgent | Mozilla Thunderbird and 1 other: Out-of-bounds Write | 9.8 | 0.0047 |  |
| [CVE-2021-38503](https://patchblox.com/security/data/cve/CVE-2021-38503.md) | High | Mozilla Firefox ESR and 3 others: The iframe sandbox rules were not correctly applied to XSLT stylesheets, allowing an iframe to bypass… | 10.0 | 0.0412 |  |
| [CVE-2021-43537](https://patchblox.com/security/data/cve/CVE-2021-43537.md) | High | Mozilla Firefox ESR and 3 others: An incorrect type conversion of sizes from 64bit to 32bit integers allowed an attacker to corrupt memory… | 9.8 | 0.0209 |  |
| [CVE-2021-44538](https://patchblox.com/security/data/cve/CVE-2021-44538.md) | High | thunderbird: The olm_session_describe function in Matrix libolm before 3.2.7 isvulnerable to a buffer overflow | 9.8 | 0.0200 |  |
| [CVE-2021-43542](https://patchblox.com/security/data/cve/CVE-2021-43542.md) | High | Mozilla Firefox ESR and 3 others: Using XMLHttpRequest, an attacker could have identified installed applications by probing error messages… | 9.8 | 0.0183 |  |
| [CVE-2021-38504](https://patchblox.com/security/data/cve/CVE-2021-38504.md) | High | Mozilla Firefox ESR and 3 others: When interacting with an HTML input element's file picker dialog with webkitdirectory set, a use-after-free… | 9.8 | 0.0177 |  |
| [CVE-2021-43536](https://patchblox.com/security/data/cve/CVE-2021-43536.md) | High | Mozilla Firefox ESR and 3 others: Under certain circumstances, asynchronous functions could have caused a navigation to fail but expose… | 9.8 | 0.0174 |  |
| [CVE-2021-43539](https://patchblox.com/security/data/cve/CVE-2021-43539.md) | High | Mozilla Firefox ESR and 3 others: Failure to correctly record the location of live pointers across wasm instance calls resulted in a GC… | 9.8 | 0.0173 |  |
| [CVE-2021-43545](https://patchblox.com/security/data/cve/CVE-2021-43545.md) | High | Mozilla Firefox ESR and 3 others: Using the Location API in a loop could have caused severe application hangs and crashes. | 9.8 | 0.0172 |  |
| [CVE-2021-38496](https://patchblox.com/security/data/cve/CVE-2021-38496.md) | High | Mozilla Firefox ESR and 3 others: During operations on MessageTasks, a task may have been removed while it was still scheduled, resulting… | 8.8 | 0.0166 |  |
| [CVE-2021-43541](https://patchblox.com/security/data/cve/CVE-2021-43541.md) | High | Mozilla Firefox ESR and 3 others: When invoking protocol handlers for external protocols, a supplied parameter URL containing spaces was… | 9.8 | 0.0163 |  |
| [CVE-2021-38506](https://patchblox.com/security/data/cve/CVE-2021-38506.md) | High | Mozilla Firefox ESR and 3 others: Through a series of navigations, Firefox could have entered fullscreen mode without notification or warning… | 7.5 | 0.0151 |  |
| [CVE-2021-43546](https://patchblox.com/security/data/cve/CVE-2021-43546.md) | High | Mozilla Firefox ESR and 3 others: It was possible to recreate previous cursor spoofing attacks against users with a zoomed native cursor. | 9.8 | 0.0151 |  |
| [CVE-2021-38498](https://patchblox.com/security/data/cve/CVE-2021-38498.md) | High | Mozilla Firefox ESR and 3 others: During process shutdown, a document could have caused a use-after-free of a languages service object,… | 7.5 | 0.0147 |  |
| [CVE-2021-43543](https://patchblox.com/security/data/cve/CVE-2021-43543.md) | High | Mozilla Firefox ESR and 3 others: Documents loaded with the CSP sandbox directive could have escaped the sandbox's script restriction by… | 9.8 | 0.0145 |  |
| [CVE-2021-4140](https://patchblox.com/security/data/cve/CVE-2021-4140.md) | High | Mozilla Firefox ESR and 3 others: XML Injection (aka Blind XPath Injection) | 10.0 | 0.0141 |  |
| [CVE-2021-43528](https://patchblox.com/security/data/cve/CVE-2021-43528.md) | High | Mozilla Thunderbird and 1 other: Thunderbird unexpectedly enabled JavaScript in the composition area. | 9.8 | 0.0131 |  |
| [CVE-2021-38500](https://patchblox.com/security/data/cve/CVE-2021-38500.md) | High | Mozilla Firefox ESR and 3 others: Mozilla developers reported memory safety bugs present in Firefox 92 and Firefox ESR 91.1. | 8.8 | 0.0127 |  |
| [CVE-2021-43534](https://patchblox.com/security/data/cve/CVE-2021-43534.md) | High | Mozilla Firefox ESR and 3 others: Mozilla developers and community members reported memory safety bugs present in Firefox 93 and Firefox… | 8.8 | 0.0125 |  |
| [CVE-2021-43538](https://patchblox.com/security/data/cve/CVE-2021-43538.md) | High | Mozilla Firefox ESR and 3 others: By misusing a race in our notification code, an attacker could have forcefully hidden the notification… | 9.8 | 0.0120 |  |
| [CVE-2021-43535](https://patchblox.com/security/data/cve/CVE-2021-43535.md) | High | Mozilla Firefox ESR and 3 others: A use-after-free could have occured when an HTTP2 session object was released on a different thread,… | 8.8 | 0.0115 |  |
| [CVE-2021-38495](https://patchblox.com/security/data/cve/CVE-2021-38495.md) | High | Mozilla Thunderbird and 1 other: Mozilla developers reported memory safety bugs present in Thunderbird 78.13.0. | 8.8 | 0.0111 |  |
| [CVE-2021-38502](https://patchblox.com/security/data/cve/CVE-2021-38502.md) | High | Mozilla Thunderbird and 1 other: Thunderbird ignored the configuration to require STARTTLS security for an SMTP connection. | 7.5 | 0.0110 |  |
| [CVE-2021-38501](https://patchblox.com/security/data/cve/CVE-2021-38501.md) | High | Mozilla Firefox ESR and 3 others: Mozilla developers reported memory safety bugs present in Firefox 92 and Firefox ESR 91.1. | 8.8 | 0.0105 |  |
| [CVE-2022-22738](https://patchblox.com/security/data/cve/CVE-2022-22738.md) | High | Mozilla Firefox ESR and 3 others: Out-of-bounds Write | 9.6 | 0.0104 |  |
| [CVE-2021-29981](https://patchblox.com/security/data/cve/CVE-2021-29981.md) | High | Firefox ESR and 3 others: An issue present in lowering/register allocation could have led to obscure but deterministic register… | 8.8 | 0.0101 |  |
| [CVE-2022-22740](https://patchblox.com/security/data/cve/CVE-2022-22740.md) | High | Mozilla Firefox ESR and 3 others: Use After Free | 9.6 | 0.0101 |  |
| [CVE-2022-22751](https://patchblox.com/security/data/cve/CVE-2022-22751.md) | High | Mozilla Firefox ESR and 3 others: Out-of-bounds Write | 9.6 | 0.0092 |  |
| [CVE-2021-29991](https://patchblox.com/security/data/cve/CVE-2021-29991.md) | High | Firefox ESR and 3 others: Firefox incorrectly accepted a newline in a HTTP/3 header, interpretting it as two separate headers. | 8.1 | 0.0091 |  |
| [CVE-2022-22742](https://patchblox.com/security/data/cve/CVE-2022-22742.md) | High | Mozilla Firefox ESR and 3 others: Out-of-bounds Read | 9.6 | 0.0085 |  |
| [CVE-2021-38507](https://patchblox.com/security/data/cve/CVE-2021-38507.md) | High | Mozilla Firefox ESR and 3 others: The Opportunistic Encryption feature of HTTP2 (RFC 8164) allows a connection to be transparently upgraded… | 7.5 | 0.0083 |  |
| [CVE-2022-22737](https://patchblox.com/security/data/cve/CVE-2022-22737.md) | High | Mozilla Firefox ESR and 3 others: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') | 9.6 | 0.0078 |  |
| [CVE-2022-22748](https://patchblox.com/security/data/cve/CVE-2022-22748.md) | High | Mozilla Firefox ESR and 3 others: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | 9.6 | 0.0077 |  |
| [CVE-2022-22739](https://patchblox.com/security/data/cve/CVE-2022-22739.md) | High | Mozilla Firefox ESR and 3 others: Malicious websites could have tricked users into accepting launching a program to handle an external… | 9.6 | 0.0071 |  |
| [CVE-2022-22741](https://patchblox.com/security/data/cve/CVE-2022-22741.md) | High | Mozilla Firefox ESR and 3 others: When resizing a popup while requesting fullscreen access, the popup would have become unable to leave… | 9.6 | 0.0070 |  |
| [CVE-2022-22743](https://patchblox.com/security/data/cve/CVE-2022-22743.md) | High | Mozilla Firefox ESR and 3 others: When navigating from inside an iframe while requesting fullscreen access, an attacker-controlled tab… | 9.6 | 0.0069 |  |
| [CVE-2022-22745](https://patchblox.com/security/data/cve/CVE-2022-22745.md) | High | Mozilla Firefox ESR and 3 others: Exposure of Sensitive Information to an Unauthorized Actor | 9.6 | 0.0068 |  |
| [CVE-2022-22747](https://patchblox.com/security/data/cve/CVE-2022-22747.md) | High | Mozilla Firefox ESR and 3 others: Improper Certificate Validation | 9.6 | 0.0068 |  |
| [CVE-2021-38509](https://patchblox.com/security/data/cve/CVE-2021-38509.md) | Routine | Mozilla Firefox ESR and 3 others: Due to an unusual sequence of attacker-controlled events, a Javascript alert() dialog with arbitrary… | 6.1 | 0.0176 |  |
| [CVE-2021-38508](https://patchblox.com/security/data/cve/CVE-2021-38508.md) | Routine | Mozilla Firefox ESR and 3 others: By displaying a form validity message in the correct location at the same time as a permission prompt… | 6.1 | 0.0164 |  |
| [CVE-2021-29982](https://patchblox.com/security/data/cve/CVE-2021-29982.md) | Routine | Firefox ESR and 3 others: Due to incorrect JIT optimization, we incorrectly interpreted data from the wrong type of object, resulting… | 6.5 | 0.0112 |  |
| [CVE-2021-29987](https://patchblox.com/security/data/cve/CVE-2021-29987.md) | Routine | firefox: After requesting multiple permissions, and closing the first permission panel, subsequent permission panels will be d... | n/a | 0.0095 |  |
| [CVE-2021-38497](https://patchblox.com/security/data/cve/CVE-2021-38497.md) | Routine | Mozilla Firefox ESR and 3 others: Through use of reportValidity() and window.open(), a plain-text validation message could have been overlaid… | 6.5 | 0.0059 |  |
| [CVE-2021-4126](https://patchblox.com/security/data/cve/CVE-2021-4126.md) | Routine | Mozilla Thunderbird and 1 other: When receiving an OpenPGP/MIME signed email message that contains an additional outer MIME message layer,… | 6.5 | 0.0046 |  |

---

Data as of 2026-11-13T20:04:13Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.