{"id":"CVE-2020-6794","aliases":["ALPINE-CVE-2020-6794","DEBIAN-CVE-2020-6794","DLA-2104-1","DSA-4625-1","EUVD-2020-27941","GHSA-2v3r-qqr5-3x33","MGASA-2020-0091","RHSA-2020:0565","RHSA-2020:0574","RHSA-2020:0576","RHSA-2020:0577","SUSE-SU-2020:0385-1","UBUNTU-CVE-2020-6794","USN-4328-1","USN-4335-1","openSUSE-SU-2020:0231-1","openSUSE-SU-2024:10601-1"],"status":"published","title":"If a user saved passwords before Thunderbird 60 and then later set a master password, an...","description":"If a user saved passwords before Thunderbird 60 and then later set a master password, an unencrypted copy of these passwords is still accessible. This is because the older stored password file was not deleted when the data was copied to a new format starting in Thunderbird 60. The new master password is added only on the new file. This could allow the exposure of stored password data outside of user expectations. This vulnerability affects Thunderbird \u003c 68.5.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.01016,"percentile":0.63722,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-312","CWE-459","CWE-522"],"published":"2020-02-15T00:00:00Z","modified":"2026-11-03T06:32:26Z","fixes":[{"ecosystem":"Alpine:v3.16","package":"thunderbird","fixed_in":["68.5.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"thunderbird","fixed_in":["68.5.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"thunderbird","fixed_in":["68.5.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"thunderbird","fixed_in":["68.5.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"thunderbird","fixed_in":["68.5.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"thunderbird","fixed_in":["68.5.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"thunderbird","fixed_in":["68.5.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"thunderbird","fixed_in":["68.5.0-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"thunderbird","fixed_in":["1:68.5.0-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"thunderbird","fixed_in":["1:68.5.0-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"thunderbird","fixed_in":["1:68.5.0-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"thunderbird","fixed_in":["1:68.7.0+build1-0ubuntu0.16.04.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"thunderbird","fixed_in":["1:68.7.0+build1-0ubuntu0.18.04.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.16","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"68.5.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"68.5.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"68.5.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"68.5.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"68.5.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"68.5.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"68.5.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"68.5.0-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:68.5.0-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:68.5.0-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:68.5.0-1"}]}]},{"source":"osv","ecosystem":"Debian:8","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:68.5.0-1~deb8u1"}]}],"versions":["1.5-4","1.5.0.2-1","1.5.0.2-2","1.5.0.2-3","1.5.0.4-1","1.5.0.4-2","1.5.0.4-3","1.5.0.5-1","1.5.0.7-1","1.5.0.7-2","1:52.4.0-1","1:52.4.0-1~deb7u1","1:52.4.0-1~deb8u1","1:52.4.0-1~deb9u1","1:52.4.0-2~exp1","1:52.5.0-1","1:52.5.0-1~deb7u1","1:52.5.0-1~deb8u1","1:52.5.0-1~deb9u1","1:52.5.2-1","1:52.5.2-1~deb7u1","1:52.5.2-2","1:52.5.2-2~deb8u1","1:52.5.2-2~deb9u1","1:52.6.0-1","1:52.6.0-1+alpha.1","1:52.6.0-1+alpha.2","1:52.6.0-1~deb7u1","1:52.6.0-1~deb8u1","1:52.6.0-1~deb9u1","1:52.7.0-1","1:52.7.0-1~deb7u1","1:52.7.0-1~deb8u1","1:52.7.0-1~deb9u1","1:52.8.0-1","1:52.8.0-1~deb7u1","1:52.8.0-1~deb8u1","1:52.8.0-1~deb9u1","1:52.9.0-1","1:52.9.1-1","1:52.9.1-1~deb8u1","1:52.9.1-1~deb9u1","1:58.0~b3-1","1:60.0-1","1:60.0-2","1:60.0-2~deb9u1","1:60.0-3","1:60.0-3~deb9u1","1:60.0~b10-1","1:60.0~b2-1","1:60.0~b3-1","1:60.0~b4-1","1:60.0~b5-1","1:60.0~b6-1","1:60.0~b9-1","1:60.0~b9-2","1:60.2.1-1","1:60.2.1-2~deb9u1","1:60.3.0-1","1:60.3.0-1~deb8u1","1:60.3.0-1~deb9u1","1:60.3.1-1","1:60.4.0-1","1:60.4.0-1~deb8u1","1:60.4.0-1~deb9u1","1:60.5.0-1","1:60.5.0-2","1:60.5.0-3","1:60.5.1-1","1:60.5.1-1~deb8u1","1:60.5.1-1~deb9u1","1:60.6.1-1","1:60.6.1-1~deb8u1","1:60.6.1-1~deb9u1","1:60.7.0-1","1:60.7.0-1~deb8u1","1:60.7.0-1~deb9u1","1:60.7.1-1","1:60.7.1-1~deb8u1","1:60.7.1-1~deb9u1","1:60.7.2-1","1:60.7.2-1~deb8u1","1:60.7.2-1~deb9u1","1:60.8.0-1","1:60.8.0-1~deb10u1","1:60.8.0-1~deb8u1","1:60.8.0-1~deb9u1","1:60.8.0-2","1:60.9.0-1","1:60.9.0-1~deb10u1","1:60.9.0-1~deb8u1","1:60.9.0-1~deb9u1","1:65.0~b1-1","1:66.0~b1-1","1:67.0~b3-1","1:68.0~b1-1","1:68.1.1-1~exp1","1:68.1.2-1~exp1","1:68.2.1-1","1:68.2.2-1","1:68.2.2-1~deb10u1","1:68.2.2-1~deb8u1","1:68.2.2-1~deb9u1","1:68.3.0-1","1:68.3.0-2","1:68.3.0-2~deb10u1","1:68.3.0-2~deb8u1","1:68.3.0-2~deb9u1","1:68.3.1-1","1:68.4.1-1","1:68.4.1-1~deb10u1","1:68.4.1-1~deb8u1","1:68.4.1-1~deb9u1","1:68.4.2-1"],"bundled":6},{"source":"osv","ecosystem":"Debian:9","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:68.5.0-1~deb9u1"}]}],"versions":["1.5-4","1.5.0.2-1","1.5.0.2-2","1.5.0.2-3","1.5.0.4-1","1.5.0.4-2","1.5.0.4-3","1.5.0.5-1","1.5.0.7-1","1.5.0.7-2","1:52.4.0-1","1:52.4.0-1~deb7u1","1:52.4.0-1~deb8u1","1:52.4.0-1~deb9u1","1:52.4.0-2~exp1","1:52.5.0-1","1:52.5.0-1~deb7u1","1:52.5.0-1~deb8u1","1:52.5.0-1~deb9u1","1:52.5.2-1","1:52.5.2-1~deb7u1","1:52.5.2-2","1:52.5.2-2~deb8u1","1:52.5.2-2~deb9u1","1:52.6.0-1","1:52.6.0-1+alpha.1","1:52.6.0-1+alpha.2","1:52.6.0-1~deb7u1","1:52.6.0-1~deb8u1","1:52.6.0-1~deb9u1","1:52.7.0-1","1:52.7.0-1~deb7u1","1:52.7.0-1~deb8u1","1:52.7.0-1~deb9u1","1:52.8.0-1","1:52.8.0-1~deb7u1","1:52.8.0-1~deb8u1","1:52.8.0-1~deb9u1","1:52.9.0-1","1:52.9.1-1","1:52.9.1-1~deb8u1","1:52.9.1-1~deb9u1","1:58.0~b3-1","1:60.0-1","1:60.0-2","1:60.0-2~deb9u1","1:60.0-3","1:60.0-3~deb9u1","1:60.0~b10-1","1:60.0~b2-1","1:60.0~b3-1","1:60.0~b4-1","1:60.0~b5-1","1:60.0~b6-1","1:60.0~b9-1","1:60.0~b9-2","1:60.2.1-1","1:60.2.1-2~deb9u1","1:60.3.0-1","1:60.3.0-1~deb8u1","1:60.3.0-1~deb9u1","1:60.3.1-1","1:60.4.0-1","1:60.4.0-1~deb8u1","1:60.4.0-1~deb9u1","1:60.5.0-1","1:60.5.0-2","1:60.5.0-3","1:60.5.1-1","1:60.5.1-1~deb8u1","1:60.5.1-1~deb9u1","1:60.6.1-1","1:60.6.1-1~deb8u1","1:60.6.1-1~deb9u1","1:60.7.0-1","1:60.7.0-1~deb8u1","1:60.7.0-1~deb9u1","1:60.7.1-1","1:60.7.1-1~deb8u1","1:60.7.1-1~deb9u1","1:60.7.2-1","1:60.7.2-1~deb8u1","1:60.7.2-1~deb9u1","1:60.8.0-1","1:60.8.0-1~deb10u1","1:60.8.0-1~deb8u1","1:60.8.0-1~deb9u1","1:60.8.0-2","1:60.9.0-1","1:60.9.0-1~deb10u1","1:60.9.0-1~deb8u1","1:60.9.0-1~deb9u1","1:65.0~b1-1","1:66.0~b1-1","1:67.0~b3-1","1:68.0~b1-1","1:68.1.1-1~exp1","1:68.1.2-1~exp1","1:68.2.1-1","1:68.2.2-1","1:68.2.2-1~deb10u1","1:68.2.2-1~deb8u1","1:68.2.2-1~deb9u1","1:68.3.0-1","1:68.3.0-2","1:68.3.0-2~deb10u1","1:68.3.0-2~deb8u1","1:68.3.0-2~deb9u1","1:68.3.1-1","1:68.4.1-1","1:68.4.1-1~deb10u1","1:68.4.1-1~deb8u1","1:68.4.1-1~deb9u1","1:68.4.2-1","1:68.5.0-1~deb8u1"],"bundled":6},{"source":"osv","ecosystem":"Debian:10","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:68.5.0-1~deb10u1"}]}],"versions":["1:60.7.2-1","1:60.8.0-1","1:60.8.0-1~deb10u1","1:60.8.0-1~deb8u1","1:60.8.0-1~deb9u1","1:60.8.0-2","1:60.9.0-1","1:60.9.0-1~deb10u1","1:60.9.0-1~deb8u1","1:60.9.0-1~deb9u1","1:65.0~b1-1","1:66.0~b1-1","1:67.0~b3-1","1:68.0~b1-1","1:68.1.1-1~exp1","1:68.1.2-1~exp1","1:68.2.1-1","1:68.2.2-1","1:68.2.2-1~deb10u1","1:68.2.2-1~deb8u1","1:68.2.2-1~deb9u1","1:68.3.0-1","1:68.3.0-2","1:68.3.0-2~deb10u1","1:68.3.0-2~deb8u1","1:68.3.0-2~deb9u1","1:68.3.1-1","1:68.4.1-1","1:68.4.1-1~deb10u1","1:68.4.1-1~deb8u1","1:68.4.1-1~deb9u1","1:68.4.2-1","1:68.5.0-1~deb8u1","1:68.5.0-1~deb9u1"],"bundled":6},{"source":"osv","ecosystem":"Mageia:7","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"68.5.0-1.mga7"}]}],"bundled":6},{"source":"osv","ecosystem":"Mageia:7","package":"thunderbird-l10n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"68.5.0-1.mga7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.0::appstream","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:68.5.0-1.el8_0"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.0::appstream","package":"thunderbird-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:68.5.0-1.el8_0"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.0::appstream","package":"thunderbird-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:68.5.0-1.el8_0"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:68.5.0-1.el6_10"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"thunderbird-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:68.5.0-1.el6_10"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:68.5.0-1.el6_10"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"thunderbird-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:68.5.0-1.el6_10"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:68.5.0-1.el6_10"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"thunderbird-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:68.5.0-1.el6_10"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:68.5.0-1.el7_7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"thunderbird-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:68.5.0-1.el7_7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:68.5.0-1.el7_7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"thunderbird-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:68.5.0-1.el7_7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:68.5.0-1.el7_7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"thunderbird-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:68.5.0-1.el7_7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:68.5.0-1.el8_1"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"thunderbird-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:68.5.0-1.el8_1"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"thunderbird-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:68.5.0-1.el8_1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP1","package":"MozillaThunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"68.5.0-3.71.1"}]}],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:68.7.0+build1-0ubuntu0.16.04.2"}]}],"versions":["1:38.3.0+build1-0ubuntu2","1:38.5.1+build2-0ubuntu1","1:38.6.0+build1-0ubuntu1","1:38.7.2+build1-0ubuntu0.16.04.1","1:38.8.0+build1-0ubuntu0.16.04.1","1:45.2.0+build1-0ubuntu0.16.04.1","1:45.3.0+build1-0ubuntu0.16.04.2","1:45.4.0+build1-0ubuntu0.16.04.1","1:45.5.1+build1-0ubuntu0.16.04.1","1:45.7.0+build1-0ubuntu0.16.04.1","1:45.8.0+build1-0ubuntu0.16.04.1","1:52.1.1+build1-0ubuntu0.16.04.1","1:52.2.1+build1-0ubuntu0.16.04.1","1:52.3.0+build1-0ubuntu0.16.04.1","1:52.4.0+build1-0ubuntu0.16.04.2","1:52.5.0+build1-0ubuntu0.16.04.1","1:52.6.0+build1-0ubuntu0.16.04.1","1:52.7.0+build1-0ubuntu0.16.04.1","1:52.8.0+build1-0ubuntu0.16.04.1","1:52.9.1+build3-0ubuntu0.16.04.1","1:60.2.1+build1-0ubuntu0.16.04.4","1:60.4.0+build2-0ubuntu0.16.04.1","1:60.5.1+build2-0ubuntu0.16.04.1","1:60.6.1+build2-0ubuntu0.16.04.1","1:60.7.0+build1-0ubuntu0.16.04.1","1:60.7.1+build1-0ubuntu0.16.04.1","1:60.7.2+build2-0ubuntu0.16.04.1","1:60.8.0+build1-0ubuntu0.16.04.2","1:60.9.0+build1-0ubuntu0.16.04.2","1:60.9.1+build1-0ubuntu0.16.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:68.7.0+build1-0ubuntu0.18.04.1"}]}],"versions":["1:52.4.0+build1-0ubuntu2","1:52.6.0+build1-0ubuntu1","1:52.7.0+build1-0ubuntu1","1:52.8.0+build1-0ubuntu0.18.04.1","1:52.9.1+build3-0ubuntu0.18.04.1","1:60.2.1+build1-0ubuntu0.18.04.2","1:60.4.0+build2-0ubuntu0.18.04.1","1:60.5.1+build2-0ubuntu0.18.04.1","1:60.6.1+build2-0ubuntu0.18.04.1","1:60.7.0+build1-0ubuntu0.18.04.1","1:60.7.1+build1-0ubuntu0.18.04.1","1:60.7.2+build2-0ubuntu0.18.04.1","1:60.8.0+build1-0ubuntu0.18.04.1","1:60.9.0+build1-0ubuntu0.18.04.1","1:68.2.1+build1-0ubuntu0.18.04.1","1:68.2.2+build1-0ubuntu0.18.04.1","1:68.4.1+build1-0ubuntu0.18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:68.7.0+build1-0ubuntu0.18.04.1"}]}],"versions":["1:52.4.0+build1-0ubuntu2","1:52.6.0+build1-0ubuntu1","1:52.7.0+build1-0ubuntu1","1:52.8.0+build1-0ubuntu0.18.04.1","1:52.9.1+build3-0ubuntu0.18.04.1","1:60.2.1+build1-0ubuntu0.18.04.2","1:60.4.0+build2-0ubuntu0.18.04.1","1:60.5.1+build2-0ubuntu0.18.04.1","1:60.6.1+build2-0ubuntu0.18.04.1","1:60.7.0+build1-0ubuntu0.18.04.1","1:60.7.1+build1-0ubuntu0.18.04.1","1:60.7.2+build2-0ubuntu0.18.04.1","1:60.8.0+build1-0ubuntu0.18.04.1","1:60.9.0+build1-0ubuntu0.18.04.1","1:68.2.1+build1-0ubuntu0.18.04.1","1:68.2.2+build1-0ubuntu0.18.04.1","1:68.4.1+build1-0ubuntu0.18.04.1"],"bundled":18},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:68.7.0+build1-0ubuntu0.16.04.2"}]}],"versions":["1:38.3.0+build1-0ubuntu2","1:38.5.1+build2-0ubuntu1","1:38.6.0+build1-0ubuntu1","1:38.7.2+build1-0ubuntu0.16.04.1","1:38.8.0+build1-0ubuntu0.16.04.1","1:45.2.0+build1-0ubuntu0.16.04.1","1:45.3.0+build1-0ubuntu0.16.04.2","1:45.4.0+build1-0ubuntu0.16.04.1","1:45.5.1+build1-0ubuntu0.16.04.1","1:45.7.0+build1-0ubuntu0.16.04.1","1:45.8.0+build1-0ubuntu0.16.04.1","1:52.1.1+build1-0ubuntu0.16.04.1","1:52.2.1+build1-0ubuntu0.16.04.1","1:52.3.0+build1-0ubuntu0.16.04.1","1:52.4.0+build1-0ubuntu0.16.04.2","1:52.5.0+build1-0ubuntu0.16.04.1","1:52.6.0+build1-0ubuntu0.16.04.1","1:52.7.0+build1-0ubuntu0.16.04.1","1:52.8.0+build1-0ubuntu0.16.04.1","1:52.9.1+build3-0ubuntu0.16.04.1","1:60.2.1+build1-0ubuntu0.16.04.4","1:60.4.0+build2-0ubuntu0.16.04.1","1:60.5.1+build2-0ubuntu0.16.04.1","1:60.6.1+build2-0ubuntu0.16.04.1","1:60.7.0+build1-0ubuntu0.16.04.1","1:60.7.1+build1-0ubuntu0.16.04.1","1:60.7.2+build2-0ubuntu0.16.04.1","1:60.8.0+build1-0ubuntu0.16.04.2","1:60.9.0+build1-0ubuntu0.16.04.2","1:60.9.1+build1-0ubuntu0.16.04.1"],"bundled":38},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"MozillaThunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"68.5.0-lp151.2.25.1"}]}],"bundled":7},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"MozillaThunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"91.1.1-1.1"}]}],"bundled":394}],"products":[{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"mozilla","product":"thunderbird"}],"references":[{"url":"https://www.mozilla.org/security/advisories/mfsa2020-07/","tags":["x_refsource_MISC","x_transferred","Vendor Advisory","advisory"]},{"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=1606619","tags":["x_refsource_MISC","x_transferred","Exploit","Issue Tracking","Patch","Vendor Advisory","fix"]},{"url":"https://security.gentoo.org/glsa/202003-10","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory"]},{"url":"https://usn.ubuntu.com/4328-1/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory"]},{"url":"https://usn.ubuntu.com/4335-1/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-6794","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-2v3r-qqr5-3x33"},{"url":"https://security.alpinelinux.org/vuln/CVE-2020-6794","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2020-6794","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2020-0091.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=26188","tags":["report"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2020-07/","tags":["advisory","article"]},{"url":"https://www.thunderbird.net/en-US/thunderbird/68.5.0/releasenotes/","tags":["web"]},{"url":"https://access.redhat.com/errata/RHSA-2020:0565","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1801918","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1801920","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1801955","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1801956","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1801957","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1801958","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_0565.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-6792","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-6792","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-6792","tags":["advisory"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2020-07/#CVE-2020-6792","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-6793","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-6793","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-6793","tags":["advisory"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2020-07/#CVE-2020-6793","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-6794","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-6794","tags":["advisory","report"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2020-07/#CVE-2020-6794","tags":["article","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-6795","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-6795","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-6795","tags":["advisory"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2020-07/#CVE-2020-6795","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-6798","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-6798","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-6798","tags":["advisory"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2020-06/#CVE-2020-6798","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-6800","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-6800","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-6800","tags":["advisory"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2020-06/#CVE-2020-6800","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2020:0574","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_0574.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2020:0576","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_0576.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2020:0577","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_0577.json","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20200385-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1162777","tags":["report"]},{"url":"https://bugzilla.suse.com/1163368","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2020-6792","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-6793","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-6794","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-6795","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-6797","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-6798","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-6800","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2020-6794","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4328-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-4335-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2019-20503","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-6792","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-6793","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-6795","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-6798","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-6800","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-6805","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-6806","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-6807","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-6811","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-6812","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-6814","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-6819","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-6820","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-6821","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-6822","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-6825","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-11745","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-11755","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-11757","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-11758","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-11759","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-11760","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-11761","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-11762","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-11763","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-11764","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-15903","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-17005","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-17008","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-17010","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-17011","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-17012","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-17016","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-17017","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-17022","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-17024","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-17026","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/N7YWPZQVCFPWDEOU6J3TATNMIGNZ4N6P/","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2007-3089","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2007-3285","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2007-3656","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2007-3670","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2007-3734","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2007-3735","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2007-3736","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2007-3737","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2007-3738","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2008-0016","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2008-1233","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2008-1236","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2008-3835","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2008-4058","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2008-4061","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2008-4064","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2008-4065","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2008-4067","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2008-4070","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2008-5012","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2008-5014","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2008-5016","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2008-5021","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2008-5022","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2008-5024","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2008-5500","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2008-5503","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2008-5506","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2008-5507","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2008-5508","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2008-5510","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2008-5511","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5824","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9893","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9895","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9897","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9898","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9899","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9900","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9904","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9905","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-16541","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5373","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5375","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5376","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5378","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5380","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5383","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5390","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5396","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5398","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5399","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5400","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5401","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5402","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5403","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5404","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5405","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5406","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5407","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5408","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5410","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5412","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5413","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5414","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5416","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5418","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5419","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5421","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5422","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5426","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5429","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5430","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5432","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5433","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5434","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5435","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5436","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5437","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5438","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5439","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5440","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5441","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5442","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5443","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5444","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5445","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5446","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5447","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5449","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5451","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5454","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5459","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5460","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5461","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5462","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5464","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5465","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5466","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5467","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5469","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5470","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5472","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7749","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7750","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7751","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7752","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7753","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7754","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7756","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7757","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7758","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7763","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7764","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7765","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7773","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7777","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7778","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7779","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7782","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7784","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7785","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7786","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7787","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7791","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7792","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7793","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7798","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7800","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7801","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7802","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7803","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7804","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7805","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7807","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7810","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7814","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7818","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7819","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7823","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7824","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7825","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7826","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7828","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7829","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7830","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7845","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7846","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7847","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7848","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12359","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12360","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12361","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12362","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12363","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12364","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12365","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12366","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12367","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12371","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12372","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12373","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12374","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12376","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12377","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12378","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12383","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12385","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12389","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12390","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12391","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12392","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12393","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12405","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-17466","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-18335","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-18356","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-18492","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-18493","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-18494","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-18498","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-18500","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-18501","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-18505","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-18509","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-18511","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-5089","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-5095","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-5096","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-5097","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-5098","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-5099","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-5102","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-5103","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-5104","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-5117","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-5125","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-5127","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-5129","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-5144","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-5145","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-5146","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-5150","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-5154","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-5155","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-5156","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-5159","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-5161","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-5162","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-5168","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-5170","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-5174","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-5178","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-5183","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-5184","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-5185","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-5187","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-5188","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11691","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11692","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11693","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11694","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11698","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11703","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11704","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11705","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11706","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11707","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11708","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11709","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11711","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11712","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11713","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11715","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11717","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11719","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11729","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11730","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11739","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11740","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11742","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11743","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11744","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11746","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11752","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11755","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11757","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11758","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11759","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11760","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11761","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11762","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11763","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11764","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-13722","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-15903","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-17005","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-17008","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-17010","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-17011","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-17012","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-17015","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-17016","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-17017","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-17021","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-17022","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-17024","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-17026","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-20503","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-5785","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-5798","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-7317","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9797","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9800","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9810","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9811","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9813","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9815","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9816","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9817","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9818","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9819","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9820","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-12387","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-12392","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-12393","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-12395","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-12397","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-12398","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-12405","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-12406","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-12410","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-12417","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-12418","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-12419","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-12420","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-12421","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-15652","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-15659","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-15663","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-15664","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-15669","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-15673","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-15676","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-15677","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-15678","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-15683","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-15685","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-15969","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-15999","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-16012","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-16042","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-16044","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-26950","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-26951","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-26953","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-26956","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-26958","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-26959","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-26960","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-26961","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-26965","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-26966","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-26968","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-26970","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-26971","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-26973","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-26974","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-26976","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-26978","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-35111","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-35112","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-35113","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-6463","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-6514","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-6805","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-6806","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-6807","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-6811","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-6812","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-6814","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-6819","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-6820","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-6821","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-6822","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-6825","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-6831","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-23953","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-23954","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-23960","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-23961","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-23964","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-23968","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-23969","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-23973","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-23978","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-23981","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-23982","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-23984","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-23987","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-23991","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-23993","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-23994","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-23995","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-23998","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-23999","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-24002","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-29945","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-29946","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-29948","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-29956","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-29957","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-29964","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-29967","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-29969","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-29970","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-29976","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-29980","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-29984","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-29985","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-29986","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-29988","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-29989","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-29991","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-30547","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-38492","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-38495","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2020-6794","description":"If a user saved passwords before Thunderbird 60 and then later set a master password, an unencrypted copy of these passwords is still accessible. This is because the older stored password file was not deleted when the data was copied to a new format starting in Thunderbird 60. The new master password is added only on the new file. This could allow the exposure of stored password data outside of user expectations. This vulnerability affects Thunderbird \u003c 68.5.","status":"published","published":"2020-03-02T04:05:03Z","modified":"2024-08-04T09:11:05.144Z","updated_at":"2026-11-02T14:35:52.592504Z"}],"euvd":[{"id":"EUVD-2020-27941","description":"If a user saved passwords before Thunderbird 60 and then later set a master password, an unencrypted copy of these passwords is still accessible. This is because the older stored password file was not deleted when the data was copied to a new format starting in Thunderbird 60. The new master password is added only on the new file. This could allow the exposure of stored password data outside of user expectations. This vulnerability affects Thunderbird \u003c 68.5.","status":"published","published":"2020-03-02T04:05:03Z","modified":"2024-08-04T09:11:05Z","updated_at":"2026-11-03T03:08:01.566283Z"}],"ghsa":[{"id":"GHSA-2v3r-qqr5-3x33","title":"If a user saved passwords before Thunderbird 60 and then later set a master password, an...","description":"If a user saved passwords before Thunderbird 60 and then later set a master password, an unencrypted copy of these passwords is still accessible. This is because the older stored password file was not deleted when the data was copied to a new format starting in Thunderbird 60. The new master password is added only on the new file. This could allow the exposure of stored password data outside of user expectations. This vulnerability affects Thunderbird \u003c 68.5.","status":"published","published":"2022-05-24T17:10:01Z","modified":"2023-01-29T05:01:51Z","cwes":["CWE-312","CWE-522"],"updated_at":"2026-11-02T14:44:55.873032Z"}],"nvd":[{"id":"CVE-2020-6794","description":"If a user saved passwords before Thunderbird 60 and then later set a master password, an unencrypted copy of these passwords is still accessible. This is because the older stored password file was not deleted when the data was copied to a new format starting in Thunderbird 60. The new master password is added only on the new file. This could allow the exposure of stored password data outside of user expectations. This vulnerability affects Thunderbird \u003c 68.5.","status":"published","published":"2020-03-02T05:15:12.26Z","modified":"2026-06-17T03:23:49.093Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-312","CWE-459","CWE-522"],"updated_at":"2026-11-02T14:05:54.796125Z"}],"osv":[{"id":"ALPINE-CVE-2020-6794","description":"If a user saved passwords before Thunderbird 60 and then later set a master password, an unencrypted copy of these passwords is still accessible. This is because the older stored password file was not deleted when the data was copied to a new format starting in Thunderbird 60. The new master password is added only on the new file. This could allow the exposure of stored password data outside of user expectations. This vulnerability affects Thunderbird \u003c 68.5.","status":"published","published":"2020-03-02T05:15:12.26Z","modified":"2026-11-03T06:32:26.175650843Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-03T07:17:57.723967Z"},{"id":"CVE-2020-6794","description":"If a user saved passwords before Thunderbird 60 and then later set a master password, an unencrypted copy of these passwords is still accessible. This is because the older stored password file was not deleted when the data was copied to a new format starting in Thunderbird 60. The new master password is added only on the new file. This could allow the exposure of stored password data outside of user expectations. This vulnerability affects Thunderbird \u003c 68.5.","status":"published","published":"2020-03-02T05:15:12.26Z","modified":"2026-04-16T04:35:41.989365008Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:17.34531Z"},{"id":"DEBIAN-CVE-2020-6794","description":"If a user saved passwords before Thunderbird 60 and then later set a master password, an unencrypted copy of these passwords is still accessible. This is because the older stored password file was not deleted when the data was copied to a new format starting in Thunderbird 60. The new master password is added only on the new file. This could allow the exposure of stored password data outside of user expectations. This vulnerability affects Thunderbird \u003c 68.5.","status":"published","published":"2020-03-02T05:15:12.26Z","modified":"2026-10-26T12:02:33.114320518Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:34.311861Z"},{"id":"RHSA-2020:0565","title":"Red Hat Security Advisory: thunderbird security update","status":"published","published":"2024-09-16T03:32:32Z","modified":"2025-11-22T11:55:36Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:06.535721Z"},{"id":"RHSA-2020:0574","title":"Red Hat Security Advisory: thunderbird security update","status":"published","published":"2024-09-16T03:32:46Z","modified":"2026-06-26T10:46:15Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:06.535721Z"},{"id":"RHSA-2020:0576","title":"Red Hat Security Advisory: thunderbird security update","status":"published","published":"2024-09-16T03:32:53Z","modified":"2026-06-26T10:46:16Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:06.535721Z"},{"id":"RHSA-2020:0577","title":"Red Hat Security Advisory: thunderbird security update","status":"published","published":"2024-09-16T03:32:39Z","modified":"2025-11-22T11:55:44Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:06.535721Z"},{"id":"UBUNTU-CVE-2020-6794","description":"If a user saved passwords before Thunderbird 60 and then later set a master password, an unencrypted copy of these passwords is still accessible. This is because the older stored password file was not deleted when the data was copied to a new format starting in Thunderbird 60. The new master password is added only on the new file. This could allow the exposure of stored password data outside of user expectations. This vulnerability affects Thunderbird \u003c 68.5.","status":"published","published":"2020-03-02T05:15:00Z","modified":"2026-04-22T12:42:51.239993Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:25.728622Z"},{"id":"DLA-2104-1","title":"thunderbird - security update","status":"published","published":"2020-02-17T00:00:00Z","modified":"2026-03-09T01:18:49.331932Z","updated_at":"2026-11-02T15:46:10.227108Z"},{"id":"DSA-4625-1","title":"thunderbird - security update","status":"published","published":"2020-02-15T00:00:00Z","modified":"2026-03-09T02:10:28.918779Z","updated_at":"2026-11-02T15:46:17.19998Z"},{"id":"MGASA-2020-0091","title":"Updated thunderbird packages fix security vulnerabilities","description":"Updated thunderbird packages fix security vulnerabilities:\n\nWhen deriving an identifier for an email message, uninitialized memory was\nused in addition to the message contents (CVE-2020-6792).\n\nWhen processing an email message with an ill-formed envelope, Thunderbird\ncould read data from a random memory location (CVE-2020-6793).\n\nIf a user saved passwords before Thunderbird 60 and then later set a master\npassword, an unencrypted copy of these passwords is still accessible. This\nis because the older stored password file was not deleted when the data was\ncopied to a new format starting in Thunderbird 60. The new master password is\nadded only on the new file. This could allow the exposure of stored password\ndata outside of user expectations (CVE-2020-6794).\n\nWhen processing a message that contains multiple S/MIME signatures, a bug in\nthe MIME processing code caused a null pointer dereference, leading to an\nunexploitable crash (CVE-2020-6795).\n\nIf a \u003ctemplate\u003e tag was used in a \u003cselect\u003e tag, the parser could be confused\nand allow JavaScript parsing and execution when it should not be allowed. A\nsite that relied on the browser behaving correctly could suffer a cross-site\nscripting vulnerability as a result (CVE-2020-6798).\n\nMemory safety bugs present in Thunderbird ESR 68.4. Some of these bugs showed\nevidence of memory corruption and presumably some of these could have been\nexploited to run arbitrary code (CVE-2020-6800).\n","status":"published","published":"2020-02-18T14:05:53Z","modified":"2026-04-16T04:42:21.044361131Z","updated_at":"2026-11-02T15:49:41.151324Z"},{"id":"openSUSE-SU-2020:0231-1","title":"Security update for MozillaThunderbird","description":"This update for MozillaThunderbird fixes the following issues:\n\n- Mozilla Thunderbird 68.5 (bsc#1162777)\n  MFSA 2020-07 (bsc#1163368)\n  * CVE-2020-6793 (bmo#1608539)\n    Out-of-bounds read when processing certain email messages\n  * CVE-2020-6794 (bmo#1606619)\n    Setting a master password post-Thunderbird 52 does not delete\n    unencrypted previously stored passwords\n  * CVE-2020-6795 (bmo#1611105)\n    Crash processing S/MIME messages with multiple signatures\n  * CVE-2020-6797 (bmo#1596668)\n    Extensions granted downloads.open permission could open\n    arbitrary applications on Mac OSX\n  * CVE-2020-6798 (bmo#1602944)\n    Incorrect parsing of template tag could result in JavaScript\n    injection\n  * CVE-2020-6792 (bmo#1609607)\n    Message ID calculcation was based on uninitialized data\n  * CVE-2020-6800 (bmo#1595786, bmo#1596706, bmo#1598543,\n    bmo#1604851, bmo#1605777, bmo#1608580, bmo#1608785)\n    Memory safety bugs fixed in Thunderbird 68.5\n\n  * new: Support for Client Identity IMAP/SMTP Service Extension\n    (bmo#1532388)\n  * new: Support for OAuth 2.0 authentication for POP3 accounts\n    (bmo#1538409)\n  * fixed: Status area goes blank during account setup\n    (bmo#1593122)\n  * fixed: Calendar: Could not remove color for default\n    categories (bmo#1584853)\n  * fixed: Calendar: Prevent calendar component loading multiple\n    times (bmo#1606375)\n  * fixed: Calendar: Today pane did not retain width between\n    sessions (bmo#1610207)\n  * unresolved: When upgrading from Thunderbird version 60 to\n    version 68, add-ons are not automatically updated during the\n    upgrade process. They will however be updated during the add-\n    on update check. It is of course possible to reinstall\n    compatible add-ons via the Add-ons Manager or via\n    addons.thunderbird.net. (bmo#1574183)\n  * changed: Calendar: Task and Event tree colours adjusted for\n    the dark theme (bmo#1608344)\n  * fixed: Retrieval of S/MIME certificates from LDAP failed\n    (bmo#1604773)\n  * fixed: Address-parsing crash on some IMAP servers when\n    preference mail.imap.use_envelope_cmd was set (bmo#1609690)\n  * fixed: Incorrect forwarding of HTML messages caused SMTP\n    servers to respond with a timeout (bmo#1222046)\n  * fixed: Calendar: Various parts of the calendar UI stopped\n    working when a second Thunderbird window opened (bmo#1608407)\n\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2020-02-18T05:12:00Z","modified":"2026-02-04T03:26:00.897569Z","updated_at":"2026-11-02T16:58:31.152112Z"},{"id":"openSUSE-SU-2024:10601-1","title":"MozillaThunderbird-91.1.1-1.1 on GA media","description":"These are all security issues fixed in the MozillaThunderbird-91.1.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2025-05-07T18:08:23.188336Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"SUSE-SU-2020:0385-1","title":"Security update for MozillaThunderbird","description":"This update for MozillaThunderbird fixes the following issues:\n\n- Mozilla Thunderbird 68.5 (bsc#1162777)\n  MFSA 2020-07 (bsc#1163368)\n  * CVE-2020-6793 (bmo#1608539)\n    Out-of-bounds read when processing certain email messages\n  * CVE-2020-6794 (bmo#1606619)\n    Setting a master password post-Thunderbird 52 does not delete\n    unencrypted previously stored passwords\n  * CVE-2020-6795 (bmo#1611105)\n    Crash processing S/MIME messages with multiple signatures\n  * CVE-2020-6797 (bmo#1596668)\n    Extensions granted downloads.open permission could open\n    arbitrary applications on Mac OSX\n  * CVE-2020-6798 (bmo#1602944)\n    Incorrect parsing of template tag could result in JavaScript\n    injection\n  * CVE-2020-6792 (bmo#1609607)\n    Message ID calculcation was based on uninitialized data\n  * CVE-2020-6800 (bmo#1595786, bmo#1596706, bmo#1598543,\n    bmo#1604851, bmo#1605777, bmo#1608580, bmo#1608785)\n    Memory safety bugs fixed in Thunderbird 68.5\n\n  * new: Support for Client Identity IMAP/SMTP Service Extension\n    (bmo#1532388)\n  * new: Support for OAuth 2.0 authentication for POP3 accounts\n    (bmo#1538409)\n  * fixed: Status area goes blank during account setup\n    (bmo#1593122)\n  * fixed: Calendar: Could not remove color for default\n    categories (bmo#1584853)\n  * fixed: Calendar: Prevent calendar component loading multiple\n    times (bmo#1606375)\n  * fixed: Calendar: Today pane did not retain width between\n    sessions (bmo#1610207)\n  * unresolved: When upgrading from Thunderbird version 60 to\n    version 68, add-ons are not automatically updated during the\n    upgrade process. They will however be updated during the add-\n    on update check. It is of course possible to reinstall\n    compatible add-ons via the Add-ons Manager or via\n    addons.thunderbird.net. (bmo#1574183)\n  * changed: Calendar: Task and Event tree colours adjusted for\n    the dark theme (bmo#1608344)\n  * fixed: Retrieval of S/MIME certificates from LDAP failed\n    (bmo#1604773)\n  * fixed: Address-parsing crash on some IMAP servers when\n    preference mail.imap.use_envelope_cmd was set (bmo#1609690)\n  * fixed: Incorrect forwarding of HTML messages caused SMTP\n    servers to respond with a timeout (bmo#1222046)\n  * fixed: Calendar: Various parts of the calendar UI stopped\n    working when a second Thunderbird window opened (bmo#1608407)\n\n","status":"published","published":"2020-02-17T07:54:20Z","modified":"2026-02-04T03:10:12.412847Z","updated_at":"2026-11-02T15:53:47.06185Z"},{"id":"USN-4328-1","title":"thunderbird vulnerabilities","description":"It was discovered that Message ID calculation was based on uninitialized\ndata. An attacker could potentially exploit this to obtain sensitive\ninformation. (CVE-2020-6792)\n\nMutiple security issues were discovered in Thunderbird. If a user were\ntricked in to opening a specially crafted message, an attacker could\npotentially exploit these to cause a denial of service, obtain sensitive\ninformation, or execute arbitrary code. (CVE-2020-6793, CVE-2020-6795,\nCVE-2020-6822)\n\nIt was discovered that if a user saved passwords before Thunderbird 60\nand then later set a master password, an unencrypted copy of these\npasswords would still be accessible. A local user could exploit this to\nobtain sensitive information. (CVE-2020-6794)\n\nMultiple security issues were discovered in Thunderbird. If a user were\ntricked in to opening a specially crafted website in a browsing context,\nan attacker could potentially exploit these to cause a denial of service,\nconduct cross-site scripting (XSS) attacks, obtain sensitive information,\nor execute arbitrary code. (CVE-2019-20503, CVE-2020-6798, CVE-2020-6800,\nCVE-2020-6805, CVE-2020-6806, CVE-2020-6807, CVE-2020-6812, CVE-2020-6814,\nCVE-2020-6819, CVE-2020-6820, CVE-2020-6821, CVE-2020-6825)\n\nIt was discovered that the Devtools’ ‘Copy as cURL’ feature did not\nfully escape website-controlled data. If a user were tricked in to using\nthe ‘Copy as cURL’ feature to copy and paste a command with specially\ncrafted data in to a terminal, an attacker could potentially exploit this\nto execute arbitrary commands via command injection. (CVE-2020-6811)\n","status":"published","published":"2020-04-13T19:46:18Z","modified":"2026-04-27T15:48:46.659399859Z","updated_at":"2026-11-02T16:58:14.547547Z"},{"id":"USN-4335-1","title":"thunderbird vulnerabilities","description":"Multiple security issues were discovered in Thunderbird. If a user were\ntricked in to opening a specially crafted website in a browsing context,\nan attacker could potentially exploit these to cause a denial of service,\nobtain sensitive information, bypass security restrictions, bypass\nsame-origin restrictions, conduct cross-site scripting (XSS) attacks, or\nexecute arbitrary code. (CVE-2019-11757, CVE-2019-11758, CVE-2019-11759,\nCVE-2019-11760, CVE-2019-11761, CVE-2019-11762, CVE-2019-11763,\nCVE-2019-11764, CVE-2019-17005, CVE-2019-17008, CVE-2019-17010,\nCVE-2019-17011, CVE-2019-17012, CVE-2019-17016, CVE-2019-17017,\nCVE-2019-17022, CVE-2019-17024, CVE-2019-17026, CVE-2019-20503,\nCVE-2020-6798, CVE-2020-6800, CVE-2020-6805, CVE-2020-6806, CVE-2020-6807,\nCVE-2020-6812, CVE-2020-6814, CVE-2020-6819, CVE-2020-6820, CVE-2020-6821,\nCVE-2020-6825)\n\nIt was discovered that NSS incorrectly handled certain memory operations.\nA remote attacker could potentially exploit this to cause a denial of\nservice, or execute arbitrary code. (CVE-2019-11745)\n\nIt was discovered that a specially crafted S/MIME message with an inner\nencryption layer could be displayed as having a valid signature in some\ncircumstances, even if the signer had no access to the encrypted message.\nAn attacker could potentially exploit this to spoof the message author.\n(CVE-2019-11755)\n\nA heap overflow was discovered in the expat library in Thunderbird. If a\nuser were tricked in to opening a specially crafted message, an attacker\ncould potentially exploit this to cause a denial of service, or execute\narbitrary code. (CVE-2019-15903)\n\nIt was discovered that Message ID calculation was based on uninitialized\ndata. An attacker could potentially exploit this to obtain sensitive\ninformation. (CVE-2020-6792)\n\nMutiple security issues were discovered in Thunderbird. If a user were\ntricked in to opening a specially crafted message, an attacker could\npotentially exploit these to cause a denial of service, obtain sensitive\ninformation, or execute arbitrary code. (CVE-2020-6793, CVE-2020-6795,\nCVE-2020-6822)\n\nIt was discovered that if a user saved passwords before Thunderbird 60 and\nthen later set a primary password, an unencrypted copy of these passwords\nwould still be accessible. A local user could exploit this to obtain\nsensitive information. (CVE-2020-6794)\n\nIt was discovered that the Devtools’ ‘Copy as cURL’ feature did not\nfully escape website-controlled data. If a user were tricked in to using\nthe ‘Copy as cURL’ feature to copy and paste a command with specially\ncrafted data in to a terminal, an attacker could potentially exploit this\nto execute arbitrary commands via command injection. (CVE-2020-6811)\n","status":"published","published":"2020-04-21T20:14:22Z","modified":"2026-04-27T15:48:45.185510058Z","updated_at":"2026-11-02T16:58:14.547547Z"}]}}