Windows apps · Application version · April 15, 2021
Mozilla Thunderbird (en-US) 78.10.0
Mozilla Thunderbird (en-US) 78.10.0, released April 15, 2021, fixes 46 CVEs in Mozilla Thunderbird (en-US). None of them is reported as exploited. Patch Radar priority: Urgent. The latest Mozilla Thunderbird (en-US) is 159.0, which also fixes every one of these CVEs.
Urgent
Superseded. The latest Mozilla Thunderbird (en-US) is 159.0, which also fixes every CVE on this page. Install that instead.
CVEs closed
46
3 rated Critical
Exploited
0
None reported
Highest CVSS
9.8
Base score, 0 to 10
Highest EPSS
0.4233
98th percentile
Priority of the 46 CVEs
Patch now 0
Urgent 3
High 24
Routine 19
Applies to
| Product | Version |
|---|---|
| Mozilla Thunderbird (en-US) | 78.10.0 |
CVEs this fix closes
| Priority | CVE | Title | CVSS | EPSS | Exploitation |
|---|---|---|---|---|---|
| Urgent | CVE-2021-23978 | Firefox ESR and 2 others: Mozilla developers reported memory safety bugs present in Firefox 85 and Firefox ESR 78.7. | 8.8 | 0.0153 | None reported |
| Urgent | CVE-2021-23968 | Firefox ESR and 2 others: If Content Security Policy blocked frame navigation, the full destination of a redirect served in the… | 4.3 | 0.0131 | None reported |
| Urgent | CVE-2021-23969 | Firefox ESR and 2 others: As specified in the W3C Content Security Policy draft, when creating a violation report, "User agents… | 4.3 | 0.0121 | None reported |
| High | CVE-2020-26950 | Firefox ESR and 2 others: In certain circumstances, the MCallGetProperty opcode can be emitted with unmet assumptions resulting… | 8.8 | 0.4233 | None reported |
| High | CVE-2020-26971 | Firefox ESR and 2 others: Certain blit values provided by the user were not properly constrained leading to a heap buffer overflow… | 8.8 | 0.0190 | None reported |
| High | CVE-2021-23994 | Firefox ESR and 2 others: A WebGL framebuffer was not initialized early enough, resulting in memory corruption and an out of bound… | 8.8 | 0.0176 | None reported |
| High | CVE-2020-26973 | Firefox ESR and 2 others: Certain input to the CSS Sanitizer confused it, resulting in incorrect components being removed. | 8.8 | 0.0162 | None reported |
| High | CVE-2020-35113 | Firefox ESR and 2 others: Mozilla developers reported memory safety bugs present in Firefox 83 and Firefox ESR 78.5. | 8.8 | 0.0157 | None reported |
| High | CVE-2020-26960 | Firefox ESR and 2 others: If the Compact() method was called on an nsTArray, the array could have been reallocated without updating… | 8.8 | 0.0156 | None reported |
| High | CVE-2020-26974 | Firefox ESR and 2 others: When flex-basis was used on a table wrapper, a StyleGenericFlexBasis object could have been incorrectly… | 8.8 | 0.0153 | None reported |
| High | CVE-2020-26968 | Firefox ESR and 2 others: Mozilla developers reported memory safety bugs present in Firefox 82 and Firefox ESR 78.4. | 8.8 | 0.0151 | None reported |
| High | CVE-2021-23987 | Firefox ESR and 2 others: Mozilla developers and community members reported memory safety bugs present in Firefox 86 and Firefox… | 8.8 | 0.0142 | None reported |
| High | CVE-2021-23999 | Firefox ESR and 2 others: If a Blob URL was loaded through some unusual user interaction, it could have been loaded by the System… | 8.8 | 0.0137 | None reported |
| High | CVE-2021-23964 | Firefox ESR and 2 others: Mozilla developers reported memory safety bugs present in Firefox 84 and Firefox ESR 78.6. | 8.8 | 0.0136 | None reported |
| High | CVE-2021-29946 | Firefox ESR and 2 others: Ports that were written as an integer overflow above the bounds of a 16-bit integer could have bypassed… | 8.8 | 0.0130 | None reported |
| High | CVE-2020-26959 | Firefox ESR and 2 others: During browser shutdown, reference decrementing could have occured on a previously freed object, resulting… | 8.8 | 0.0130 | None reported |
| High | CVE-2021-23960 | Firefox ESR and 2 others: Performing garbage collection on re-declared JavaScript variables resulted in a user-after-poison, and… | 8.8 | 0.0129 | None reported |
| High | CVE-2020-35112 | Firefox ESR and 2 others: If a user downloaded a file lacking an extension on Windows, and then "Open"-ed it from the downloads… | 8.8 | 0.0127 | None reported |
| High | CVE-2020-26970 | Thunderbird: When reading SMTP server status codes, Thunderbird writes an integer value to a position on the stack… | 8.8 | 0.0125 | None reported |
| High | CVE-2021-23954 | Firefox ESR and 2 others: Using the new logical assignment operators in a JavaScript switch statement could have caused a type… | 8.8 | 0.0119 | None reported |
| High | CVE-2021-23995 | Firefox ESR and 2 others: When Responsive Design Mode was enabled, it used references to objects that were previously freed. | 8.8 | 0.0118 | None reported |
| High | CVE-2021-23981 | Firefox ESR and 2 others: A texture upload of a Pixel Buffer Object could have confused the WebGL code to skip binding the buffer… | 8.1 | 0.0115 | None reported |
| High | CVE-2021-24002 | Firefox ESR and 2 others: When a user clicked on an FTP URL containing encoded newline characters (%0A and %0D), the newlines would… | 8.8 | 0.0113 | None reported |
| High | CVE-2021-4127 | Thunderbird: An out of date graphics library (Angle) likely contained vulnerabilities that could potentially be exploited. | 9.8 | 0.0095 | None reported |
| High | CVE-2020-15685 | Thunderbird: Improper Neutralization of Special Elements used in a Command ('Command Injection') | 8.8 | 0.0088 | None reported |
Showing 1 to 25 of 46
1Next
Patch Radar data is free to use with attribution. Terms and how to credit it.
Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.