Linux · Security advisory · October 15, 2021

ELSA-2021-3838: thunderbird security update

ELSA-2021-3838, released October 15, 2021, fixes 7 CVEs in thunderbird (version 0:91.2.0-1.0.1.el8_4). None of them is reported as exploited. Patch Radar priority: High.

High
CVEs closed
7
None rated Critical
Exploited
0
None reported
Exploitation more likely
0
Vendor assessment
Highest EPSS
0.0191
79th percentile

Priority of the 7 CVEs

Patch now 0 Urgent 0 High 6 Routine 1

Fixed package versions

ProductReleaseFixed in
thunderbirdol 80:91.2.0-1.0.1.el8_4

CVEs this fix closes

PriorityCVETitleImpactCVSSEPSSExploitation
High CVE-2021-32810 firefox: crossbeam-deque is a package of work-stealing deques for building taskschedulers when programming in Rust 9.8 0.0191 None reported
High CVE-2021-38496 Mozilla Firefox ESR and 3 others: During operations on MessageTasks, a task may have been removed while it was still scheduled, resulting… 8.8 0.0166 None reported
High CVE-2021-38498 Mozilla Firefox ESR and 3 others: During process shutdown, a document could have caused a use-after-free of a languages service object,… 7.5 0.0147 None reported
High CVE-2021-38500 Mozilla Firefox ESR and 3 others: Mozilla developers reported memory safety bugs present in Firefox 92 and Firefox ESR 91.1. 8.8 0.0127 None reported
High CVE-2021-38502 Mozilla Thunderbird and 1 other: Thunderbird ignored the configuration to require STARTTLS security for an SMTP connection. 7.5 0.0110 None reported
High CVE-2021-38501 Mozilla Firefox ESR and 3 others: Mozilla developers reported memory safety bugs present in Firefox 92 and Firefox ESR 91.1. 8.8 0.0105 None reported
Routine CVE-2021-38497 Mozilla Firefox ESR and 3 others: Through use of reportValidity() and window.open(), a plain-text validation message could have been overlaid… 6.5 0.0059 None reported
Showing 1 to 7 of 7 1