CVE-2020-15685
During the plaintext phase of the STARTTLS connection setup, protocol commands could have been...
8.8 HighFix available
During the plaintext phase of the STARTTLS connection setup, protocol commands could have been injected and evaluated within the encrypted session. This vulnerability affects Thunderbird < 78.7.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
0.88%Unchanged since Dec 23, 2022
What each source reports
NVD Score used
During the plaintext phase of the STARTTLS connection setup, protocol commands could have been injected and evaluated within the encrypted session. This vulnerability affects Thunderbird < 78.7.
- Record
CVE-2020-15685- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-77
- Updated
- 2026-11-02
CVE List
During the plaintext phase of the STARTTLS connection setup, protocol commands could have been injected and evaluated within the encrypted session. This vulnerability affects Thunderbird < 78.7.
- Record
CVE-2020-15685- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-77
- Updated
- 2026-11-02
EUVDEUVD-2020-7672
During the plaintext phase of the STARTTLS connection setup, protocol commands could have been injected and evaluated within the encrypted session. This vulnerability affects Thunderbird < 78.7.
- Record
EUVD-2020-7672- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-c839-4fpv-9xp7
During the plaintext phase of the STARTTLS connection setup, protocol commands could have been...
During the plaintext phase of the STARTTLS connection setup, protocol commands could have been injected and evaluated within the encrypted session. This vulnerability affects Thunderbird < 78.7.
- Record
GHSA-c839-4fpv-9xp7- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-77
- Updated
- 2026-11-02
OSVALPINE-CVE-2020-15685
During the plaintext phase of the STARTTLS connection setup, protocol commands could have been injected and evaluated within the encrypted session. This vulnerability affects Thunderbird < 78.7.
- Record
ALPINE-CVE-2020-15685- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-03
OSV
During the plaintext phase of the STARTTLS connection setup, protocol commands could have been injected and evaluated within the encrypted session. This vulnerability affects Thunderbird < 78.7.
- Record
CVE-2020-15685- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 12 moreShow less
OSVDEBIAN-CVE-2020-15685
During the plaintext phase of the STARTTLS connection setup, protocol commands could have been injected and evaluated within the encrypted session. This vulnerability affects Thunderbird < 78.7.
- Record
DEBIAN-CVE-2020-15685- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2021:0297
Red Hat Security Advisory: thunderbird security update
- Record
RHSA-2021:0297- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2021:0298
Red Hat Security Advisory: thunderbird security update
- Record
RHSA-2021:0298- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2021:0299
Red Hat Security Advisory: thunderbird security update
- Record
RHSA-2021:0299- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2021:0397
Red Hat Security Advisory: thunderbird security update
- Record
RHSA-2021:0397- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2020-15685
During the plaintext phase of the STARTTLS connection setup, protocol commands could have been injected and evaluated within the encrypted session. This vulnerability affects Thunderbird < 78.7.
- Record
UBUNTU-CVE-2020-15685- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVMGASA-2021-0066 No score
Updated thunderbird packages fix security vulnerabilities
Cross-origin information leakage via redirected PDF requests. (CVE-2021-23953)
Type confusion when using logical assignment operators in JavaScript switch statements. (CVE-2021-23954)
IMAP Response Injection when using STARTTLS. (CVE-2020-15685)
HTTPS pages could have been intercepted by a registered service worker when they should not have been. (CVE-2020-26976)
Use-after-poison for incorrectly redeclared JavaScript variables during GC. (CVE-2021-23960)
Memory safety bugs fixed in Thunderbird 78.7. (CVE-2021-23964).
- Record
MGASA-2021-0066- Updated
- 2026-11-02
OSVopenSUSE-SU-2021:0208-1 No score
Security update for MozillaThunderbird
This update for MozillaThunderbird fixes the following issues:
- Mozilla Thunderbird was updated to 78.7.0 ESR (MFSA 2021-05, bsc#1181414)
- CVE-2021-23953: Fixed a Cross-origin information leakage via redirected PDF requests
- CVE-2021-23954: Fixed a type confusion when using logical assignment operators in JavaScript switch statements
- CVE-2020-26976: Fixed an issue where HTTPS pages could have been intercepted by a registered service worker when they should not have been
- CVE-2021-23960: Fixed a use-after-poison for incorrectly redeclared JavaScript variables during GC
- CVE-2021-23964: Fixed Memory safety bugs
- CVE-2020-15685: Fixed an IMAP Response Injection when using STARTTLS
This update was imported from the SUSE:SLE-15:Update update project.
- Record
openSUSE-SU-2021:0208-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2021:0209-1 No score
Security update for MozillaThunderbird
This update for MozillaThunderbird fixes the following issues:
- Mozilla Thunderbird was updated to 78.7.0 ESR (MFSA 2021-05, bsc#1181414)
- CVE-2021-23953: Fixed a Cross-origin information leakage via redirected PDF requests
- CVE-2021-23954: Fixed a type confusion when using logical assignment operators in JavaScript switch statements
- CVE-2020-26976: Fixed an issue where HTTPS pages could have been intercepted by a registered service worker when they should not have been
- CVE-2021-23960: Fixed a use-after-poison for incorrectly redeclared JavaScript variables during GC
- CVE-2021-23964: Fixed Memory safety bugs
- CVE-2020-15685: Fixed an IMAP Response Injection when using STARTTLS
This update was imported from the SUSE:SLE-15:Update update project.
- Record
openSUSE-SU-2021:0209-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10601-1 No score
MozillaThunderbird-91.1.1-1.1 on GA media
These are all security issues fixed in the MozillaThunderbird-91.1.1-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10601-1- Updated
- 2026-11-02
OSVSUSE-SU-2021:0245-1 No score
Security update for MozillaThunderbird
This update for MozillaThunderbird fixes the following issues:
- Mozilla Thunderbird was updated to 78.7.0 ESR (MFSA 2021-05, bsc#1181414)
- CVE-2021-23953: Fixed a Cross-origin information leakage via redirected PDF requests
- CVE-2021-23954: Fixed a type confusion when using logical assignment operators in JavaScript switch statements
- CVE-2020-26976: Fixed an issue where HTTPS pages could have been intercepted by a registered service worker when they should not have been
- CVE-2021-23960: Fixed a use-after-poison for incorrectly redeclared JavaScript variables during GC
- CVE-2021-23964: Fixed Memory safety bugs
- CVE-2020-15685: Fixed an IMAP Response Injection when using STARTTLS
- Record
SUSE-SU-2021:0245-1- Updated
- 2026-11-02
OSVSUSE-SU-2021:0257-1 No score
Security update for MozillaThunderbird
This update for MozillaThunderbird fixes the following issues:
- Mozilla Thunderbird was updated to 78.7.0 ESR (MFSA 2021-05, bsc#1181414)
- CVE-2021-23953: Fixed a Cross-origin information leakage via redirected PDF requests
- CVE-2021-23954: Fixed a type confusion when using logical assignment operators in JavaScript switch statements
- CVE-2020-26976: Fixed an issue where HTTPS pages could have been intercepted by a registered service worker when they should not have been
- CVE-2021-23960: Fixed a use-after-poison for incorrectly redeclared JavaScript variables during GC
- CVE-2021-23964: Fixed Memory safety bugs
- CVE-2020-15685: Fixed an IMAP Response Injection when using STARTTLS
- Record
SUSE-SU-2021:0257-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
thunderbirdAlpine:v3.16 |
before 78.7.0-r0 | 78.7.0-r0 |
thunderbirdAlpine:v3.17 |
before 78.7.0-r0 | 78.7.0-r0 |
thunderbirdAlpine:v3.18 |
before 78.7.0-r0 | 78.7.0-r0 |
thunderbirdAlpine:v3.19 |
before 78.7.0-r0 | 78.7.0-r0 |
thunderbirdAlpine:v3.20 |
before 78.7.0-r0 | 78.7.0-r0 |
thunderbirdAlpine:v3.21 |
before 78.7.0-r0 | 78.7.0-r0 |
thunderbirdAlpine:v3.22 |
before 78.7.0-r0 | 78.7.0-r0 |
thunderbirdAlpine:v3.23 |
before 78.7.0-r0 | 78.7.0-r0 |
thunderbirdDebian:12 |
before 1:78.7.0-1 | 1:78.7.0-1 |
thunderbirdDebian:13 |
before 1:78.7.0-1 | 1:78.7.0-1 |
Show 27 moreShow less
| Package | Affected | Fixed |
|---|---|---|
thunderbirdDebian:14 |
before 1:78.7.0-1 | 1:78.7.0-1 |
thunderbirdDebian:9 From an advisory covering 7 CVEs |
before 1:78.7.0-1~deb9u1, plus listed versions 1.5-41.5.0.2-11.5.0.2-21.5.0.2-31.5.0.4-1 Show 45 moreShow less1.5.0.4-21.5.0.4-31.5.0.5-11.5.0.7-11.5.0.7-21:52.4.0-11:52.4.0-1~deb7u11:52.4.0-1~deb8u11:52.4.0-1~deb9u11:52.4.0-2~exp11:52.5.0-11:52.5.0-1~deb7u11:52.5.0-1~deb8u11:52.5.0-1~deb9u11:52.5.2-11:52.5.2-1~deb7u11:52.5.2-21:52.5.2-2~deb8u11:52.5.2-2~deb9u11:52.6.0-11:52.6.0-1+alpha.11:52.6.0-1+alpha.21:52.6.0-1~deb7u11:52.6.0-1~deb8u11:52.6.0-1~deb9u11:52.7.0-11:52.7.0-1~deb7u11:52.7.0-1~deb8u11:52.7.0-1~deb9u11:52.8.0-11:52.8.0-1~deb7u11:52.8.0-1~deb8u11:52.8.0-1~deb9u11:52.9.0-11:52.9.1-11:52.9.1-1~deb8u11:52.9.1-1~deb9u11:58.0~b3-11:60.0-11:60.0-21:60.0-2~deb9u11:60.0-31:60.0-3~deb9u11:60.0~b10-11:60.0~b2-1 |
1:78.7.0-1~deb9u1 |
thunderbirdDebian:10 From an advisory covering 7 CVEs |
before 1:78.7.0-1~deb10u1, plus listed versions 1:60.7.2-11:60.8.0-11:60.8.0-1~deb10u11:60.8.0-1~deb8u11:60.8.0-1~deb9u1 Show 45 moreShow less1:60.8.0-21:60.9.0-11:60.9.0-1~deb10u11:60.9.0-1~deb8u11:60.9.0-1~deb9u11:65.0~b1-11:66.0~b1-11:67.0~b3-11:68.0~b1-11:68.1.1-1~exp11:68.1.2-1~exp11:68.10.0-11:68.10.0-1~deb10u11:68.10.0-1~deb9u11:68.11.0-11:68.11.0-1~deb10u11:68.11.0-1~deb9u11:68.11.0-21:68.11.0-31:68.12.0-11:68.12.0-1~deb10u11:68.12.0-1~deb9u11:68.12.0-1~deb9u21:68.2.1-11:68.2.2-11:68.2.2-1~deb10u11:68.2.2-1~deb8u11:68.2.2-1~deb9u11:68.3.0-11:68.3.0-21:68.3.0-2~deb10u11:68.3.0-2~deb8u11:68.3.0-2~deb9u11:68.3.1-11:68.4.1-11:68.4.1-1~deb10u11:68.4.1-1~deb8u11:68.4.1-1~deb9u11:68.4.2-11:68.5.0-11:68.5.0-1~deb10u11:68.5.0-1~deb8u11:68.5.0-1~deb9u11:68.6.0-11:68.6.0-1~deb10u1 |
1:78.7.0-1~deb10u1 |
thunderbirdMageia:7 From an advisory covering 6 CVEs |
before 78.7.0-1.mga7 | 78.7.0-1.mga7 |
thunderbird-l10nMageia:7 From an advisory covering 6 CVEs |
before 78.7.0-1.mga7 | 78.7.0-1.mga7 |
thunderbirdRed Hat:enterprise_linux:7::client From an advisory covering 6 CVEs |
before 0:78.7.0-1.el7_9 | 0:78.7.0-1.el7_9 |
thunderbird-debuginfoRed Hat:enterprise_linux:7::client From an advisory covering 6 CVEs |
before 0:78.7.0-1.el7_9 | 0:78.7.0-1.el7_9 |
thunderbirdRed Hat:enterprise_linux:7::server From an advisory covering 6 CVEs |
before 0:78.7.0-1.el7_9 | 0:78.7.0-1.el7_9 |
thunderbird-debuginfoRed Hat:enterprise_linux:7::server From an advisory covering 6 CVEs |
before 0:78.7.0-1.el7_9 | 0:78.7.0-1.el7_9 |
thunderbirdRed Hat:enterprise_linux:7::workstation From an advisory covering 6 CVEs |
before 0:78.7.0-1.el7_9 | 0:78.7.0-1.el7_9 |
thunderbird-debuginfoRed Hat:enterprise_linux:7::workstation From an advisory covering 6 CVEs |
before 0:78.7.0-1.el7_9 | 0:78.7.0-1.el7_9 |
thunderbirdRed Hat:enterprise_linux:8::appstream From an advisory covering 6 CVEs |
before 0:78.7.0-1.el8_3 | 0:78.7.0-1.el8_3 |
thunderbird-debuginfoRed Hat:enterprise_linux:8::appstream From an advisory covering 6 CVEs |
before 0:78.7.0-1.el8_3 | 0:78.7.0-1.el8_3 |
thunderbird-debugsourceRed Hat:enterprise_linux:8::appstream From an advisory covering 6 CVEs |
before 0:78.7.0-1.el8_3 | 0:78.7.0-1.el8_3 |
thunderbirdRed Hat:rhel_eus:8.2::appstream From an advisory covering 6 CVEs |
before 0:78.7.0-1.el8_2 | 0:78.7.0-1.el8_2 |
thunderbird-debuginfoRed Hat:rhel_eus:8.2::appstream From an advisory covering 6 CVEs |
before 0:78.7.0-1.el8_2 | 0:78.7.0-1.el8_2 |
thunderbird-debugsourceRed Hat:rhel_eus:8.2::appstream From an advisory covering 6 CVEs |
before 0:78.7.0-1.el8_2 | 0:78.7.0-1.el8_2 |
thunderbirdRed Hat:rhel_eus:8.1::appstream From an advisory covering 6 CVEs |
before 0:78.7.0-1.el8_1 | 0:78.7.0-1.el8_1 |
thunderbird-debuginfoRed Hat:rhel_eus:8.1::appstream From an advisory covering 6 CVEs |
before 0:78.7.0-1.el8_1 | 0:78.7.0-1.el8_1 |
thunderbird-debugsourceRed Hat:rhel_eus:8.1::appstream From an advisory covering 6 CVEs |
before 0:78.7.0-1.el8_1 | 0:78.7.0-1.el8_1 |
MozillaThunderbirdSUSE:Linux Enterprise Workstation Extension 15 SP1 From an advisory covering 6 CVEs |
before 78.7.0-3.119.1 | 78.7.0-3.119.1 |
MozillaThunderbirdSUSE:Linux Enterprise Workstation Extension 15 SP2 From an advisory covering 6 CVEs |
before 78.7.0-8.9.1 | 78.7.0-8.9.1 |
thunderbirdUbuntu:18.04:LTS |
before 1:78.8.1+build1-0ubuntu0.18.04.1, plus listed versions 1:52.4.0+build1-0ubuntu21:52.6.0+build1-0ubuntu11:52.7.0+build1-0ubuntu11:52.8.0+build1-0ubuntu0.18.04.11:52.9.1+build3-0ubuntu0.18.04.1 Show 15 moreShow less1:60.2.1+build1-0ubuntu0.18.04.21:60.4.0+build2-0ubuntu0.18.04.11:60.5.1+build2-0ubuntu0.18.04.11:60.6.1+build2-0ubuntu0.18.04.11:60.7.0+build1-0ubuntu0.18.04.11:60.7.1+build1-0ubuntu0.18.04.11:60.7.2+build2-0ubuntu0.18.04.11:60.8.0+build1-0ubuntu0.18.04.11:60.9.0+build1-0ubuntu0.18.04.11:68.2.1+build1-0ubuntu0.18.04.11:68.2.2+build1-0ubuntu0.18.04.11:68.4.1+build1-0ubuntu0.18.04.11:68.7.0+build1-0ubuntu0.18.04.11:68.8.0+build2-0ubuntu0.18.04.21:68.10.0+build1-0ubuntu0.18.04.1 |
1:78.8.1+build1-0ubuntu0.18.04.1 |
thunderbirdUbuntu:20.04:LTS |
before 1:78.7.1+build1-0ubuntu0.20.04.1, plus listed versions 1:68.1.2+build1-0ubuntu11:68.1.2+build1-0ubuntu21:68.2.1+build1-0ubuntu11:68.2.2+build1-0ubuntu11:68.3.0+build2-0ubuntu1 Show 9 moreShow less1:68.3.1+build1-0ubuntu21:68.4.1+build1-0ubuntu11:68.4.2+build2-0ubuntu11:68.5.0+build1-0ubuntu11:68.6.0+build2-0ubuntu11:68.7.0+build1-0ubuntu11:68.7.0+build1-0ubuntu21:68.8.0+build2-0ubuntu0.20.04.21:68.10.0+build1-0ubuntu0.20.04.1 |
1:78.7.1+build1-0ubuntu0.20.04.1 |
MozillaThunderbirdopenSUSE:Leap 15.1 From an advisory covering 6 CVEs |
before 78.7.0-lp151.2.69.1 | 78.7.0-lp151.2.69.1 |
MozillaThunderbirdopenSUSE:Leap 15.2 From an advisory covering 6 CVEs |
before 78.7.0-lp152.2.29.1 | 78.7.0-lp152.2.29.1 |
MozillaThunderbirdopenSUSE:Tumbleweed From an advisory covering 394 CVEs |
before 91.1.1-1.1 | 91.1.1-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected, aliases, references | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-15685 is a high vulnerability (CVSS 8.8) in Mozilla Thunderbird, published December 31, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.88%, the 59th percentile. Fixed in thunderbird 78.7.0-r0.
References
mozilla.org/security/advisories/mfsa2021-05
bugzilla.mozilla.org/show_bug.cgi?id=1622640
nvd.nist.gov/vuln/detail/CVE-2020-15685
github.com/advisories/GHSA-c839-4fpv-9xp7
security.alpinelinux.org/vuln/CVE-2020-15685
security-tracker.debian.org/tracker/CVE-2020-15685
Show 194 moreShow less
advisories.mageia.org/MGASA-2021-0066.html
bugs.mageia.org/show_bug.cgi?id=28247
thunderbird.net/en-US/thunderbird/78.7.0/releasenotes
access.redhat.com/errata/RHSA-2021:0297
bugzilla.redhat.com/show_bug.cgi?id=1920646
security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_0297.json
cve.org/CVERecord?id=CVE-2020-15685
suse.com/support/update/announcement/2021/suse-su-20210245-1
bugzilla.suse.com/1181414
ubuntu.com/security/CVE-2020-15685
lists.opensuse.org/archives/list/[email protected]/thread/PJ6EGWAN3STX7MVPJ6SXVNB6AQBHBJEA
This page doesn't list everything
Left out here: 191 versions and 244 references. The JSON record has them.