{"id":"CVE-2021-23992","aliases":["DEBIAN-CVE-2021-23992","DLA-2632-1","DSA-4897-1","EUVD-2021-10912","GHSA-x89c-f42w-ch2g","MGASA-2021-0189","RHSA-2021:1190","RHSA-2021:1192","RHSA-2021:1193","RHSA-2021:1201","SUSE-SU-2021:1167-1","UBUNTU-CVE-2021-23992","USN-4995-1","USN-4995-2","openSUSE-SU-2021:0580-1"],"status":"published","title":"Thunderbird did not check if the user ID associated with an OpenPGP key has a valid self...","description":"Thunderbird did not check if the user ID associated with an OpenPGP key has a valid self signature. An attacker may create a crafted version of an OpenPGP key, by either replacing the original user ID, or by adding another user ID. If Thunderbird imports and accepts the crafted key, the Thunderbird user may falsely conclude that the false user ID belongs to the correspondent. This vulnerability affects Thunderbird \u003c 78.9.1.","severity":{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.00478,"percentile":0.4154,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-347"],"published":"2021-04-13T00:00:00Z","modified":"2026-10-23T18:02:52Z","fixes":[{"ecosystem":"Debian:12","package":"thunderbird","fixed_in":["1:78.10.0-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"thunderbird","fixed_in":["1:78.10.0-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"thunderbird","fixed_in":["1:78.10.0-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"thunderbird","fixed_in":["1:78.11.0+build1-0ubuntu0.18.04.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"thunderbird","fixed_in":["1:78.11.0+build1-0ubuntu0.20.04.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:78.10.0-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:78.10.0-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:78.10.0-1"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:78.10.0-1~deb9u1"}]}],"versions":["1.5-4","1.5.0.2-1","1.5.0.2-2","1.5.0.2-3","1.5.0.4-1","1.5.0.4-2","1.5.0.4-3","1.5.0.5-1","1.5.0.7-1","1.5.0.7-2","1:52.4.0-1","1:52.4.0-1~deb7u1","1:52.4.0-1~deb8u1","1:52.4.0-1~deb9u1","1:52.4.0-2~exp1","1:52.5.0-1","1:52.5.0-1~deb7u1","1:52.5.0-1~deb8u1","1:52.5.0-1~deb9u1","1:52.5.2-1","1:52.5.2-1~deb7u1","1:52.5.2-2","1:52.5.2-2~deb8u1","1:52.5.2-2~deb9u1","1:52.6.0-1","1:52.6.0-1+alpha.1","1:52.6.0-1+alpha.2","1:52.6.0-1~deb7u1","1:52.6.0-1~deb8u1","1:52.6.0-1~deb9u1","1:52.7.0-1","1:52.7.0-1~deb7u1","1:52.7.0-1~deb8u1","1:52.7.0-1~deb9u1","1:52.8.0-1","1:52.8.0-1~deb7u1","1:52.8.0-1~deb8u1","1:52.8.0-1~deb9u1","1:52.9.0-1","1:52.9.1-1","1:52.9.1-1~deb8u1","1:52.9.1-1~deb9u1","1:58.0~b3-1","1:60.0-1","1:60.0-2","1:60.0-2~deb9u1","1:60.0-3","1:60.0-3~deb9u1","1:60.0~b10-1","1:60.0~b2-1","1:60.0~b3-1","1:60.0~b4-1","1:60.0~b5-1","1:60.0~b6-1","1:60.0~b9-1","1:60.0~b9-2","1:60.2.1-1","1:60.2.1-2~deb9u1","1:60.3.0-1","1:60.3.0-1~deb8u1","1:60.3.0-1~deb9u1","1:60.3.1-1","1:60.4.0-1","1:60.4.0-1~deb8u1","1:60.4.0-1~deb9u1","1:60.5.0-1","1:60.5.0-2","1:60.5.0-3","1:60.5.1-1","1:60.5.1-1~deb8u1","1:60.5.1-1~deb9u1","1:60.6.1-1","1:60.6.1-1~deb8u1","1:60.6.1-1~deb9u1","1:60.7.0-1","1:60.7.0-1~deb8u1","1:60.7.0-1~deb9u1","1:60.7.1-1","1:60.7.1-1~deb8u1","1:60.7.1-1~deb9u1","1:60.7.2-1","1:60.7.2-1~deb8u1","1:60.7.2-1~deb9u1","1:60.8.0-1","1:60.8.0-1~deb10u1","1:60.8.0-1~deb8u1","1:60.8.0-1~deb9u1","1:60.8.0-2","1:60.9.0-1","1:60.9.0-1~deb10u1","1:60.9.0-1~deb8u1","1:60.9.0-1~deb9u1","1:65.0~b1-1","1:66.0~b1-1","1:67.0~b3-1","1:68.0~b1-1","1:68.1.1-1~exp1","1:68.1.2-1~exp1","1:68.10.0-1","1:68.10.0-1~deb10u1","1:68.10.0-1~deb9u1","1:68.11.0-1","1:68.11.0-1~deb10u1","1:68.11.0-1~deb9u1","1:68.11.0-2","1:68.11.0-3","1:68.12.0-1","1:68.12.0-1~deb10u1","1:68.12.0-1~deb9u1","1:68.12.0-1~deb9u2","1:68.2.1-1","1:68.2.2-1","1:68.2.2-1~deb10u1","1:68.2.2-1~deb8u1","1:68.2.2-1~deb9u1","1:68.3.0-1","1:68.3.0-2","1:68.3.0-2~deb10u1","1:68.3.0-2~deb8u1","1:68.3.0-2~deb9u1","1:68.3.1-1","1:68.4.1-1","1:68.4.1-1~deb10u1","1:68.4.1-1~deb8u1","1:68.4.1-1~deb9u1","1:68.4.2-1","1:68.5.0-1","1:68.5.0-1~deb10u1","1:68.5.0-1~deb8u1","1:68.5.0-1~deb9u1","1:68.6.0-1","1:68.6.0-1~deb10u1","1:68.6.0-1~deb8u1","1:68.6.0-1~deb9u1","1:68.7.0-1","1:68.7.0-1~deb10u1","1:68.7.0-1~deb8u1","1:68.7.0-1~deb9u1","1:68.8.0-1","1:68.8.0-1~deb10u1","1:68.8.0-1~deb8u1","1:68.8.0-1~deb9u1","1:68.8.1-1","1:68.9.0-1","1:68.9.0-1~deb10u1","1:68.9.0-1~deb8u1","1:68.9.0-1~deb8u2","1:68.9.0-1~deb9u1","1:76.0~b1-1","1:76.0~b2-1","1:77.0~b1-1","1:77.0~b2-1","1:77.0~b3-1","1:78.0-1","1:78.0.1-1","1:78.0~b1-1","1:78.0~b2-1","1:78.1.0-1","1:78.1.1-1","1:78.2.0-1","1:78.2.1-1","1:78.2.2-1","1:78.3.1-1","1:78.3.1-2","1:78.3.1-2~deb10u1","1:78.3.1-2~deb10u2","1:78.3.1-2~deb9u1","1:78.3.2-1","1:78.3.3-1","1:78.4.0-1","1:78.4.0-1~deb10u1","1:78.4.0-1~deb9u1","1:78.4.1-1","1:78.4.2-1","1:78.4.2-1~deb10u1","1:78.4.2-1~deb9u1","1:78.5.0-1","1:78.5.0-1~deb10u1","1:78.5.0-1~deb9u1","1:78.5.1-1","1:78.5.1-1~deb10u1","1:78.5.1-1~deb9u1","1:78.6.0-1","1:78.6.0-1~deb10u1","1:78.6.0-1~deb9u1","1:78.6.1-1","1:78.7.0-1","1:78.7.0-1~deb10u1","1:78.7.0-1~deb9u1","1:78.7.1-1","1:78.8.0-1","1:78.8.0-1~deb10u1","1:78.8.0-1~deb9u1","1:78.9.0-1","1:78.9.0-1~deb10u1","1:78.9.0-1~deb9u1"],"bundled":13},{"source":"osv","ecosystem":"Debian:10","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:78.10.0-1~deb10u1"}]}],"versions":["1:60.7.2-1","1:60.8.0-1","1:60.8.0-1~deb10u1","1:60.8.0-1~deb8u1","1:60.8.0-1~deb9u1","1:60.8.0-2","1:60.9.0-1","1:60.9.0-1~deb10u1","1:60.9.0-1~deb8u1","1:60.9.0-1~deb9u1","1:65.0~b1-1","1:66.0~b1-1","1:67.0~b3-1","1:68.0~b1-1","1:68.1.1-1~exp1","1:68.1.2-1~exp1","1:68.10.0-1","1:68.10.0-1~deb10u1","1:68.10.0-1~deb9u1","1:68.11.0-1","1:68.11.0-1~deb10u1","1:68.11.0-1~deb9u1","1:68.11.0-2","1:68.11.0-3","1:68.12.0-1","1:68.12.0-1~deb10u1","1:68.12.0-1~deb9u1","1:68.12.0-1~deb9u2","1:68.2.1-1","1:68.2.2-1","1:68.2.2-1~deb10u1","1:68.2.2-1~deb8u1","1:68.2.2-1~deb9u1","1:68.3.0-1","1:68.3.0-2","1:68.3.0-2~deb10u1","1:68.3.0-2~deb8u1","1:68.3.0-2~deb9u1","1:68.3.1-1","1:68.4.1-1","1:68.4.1-1~deb10u1","1:68.4.1-1~deb8u1","1:68.4.1-1~deb9u1","1:68.4.2-1","1:68.5.0-1","1:68.5.0-1~deb10u1","1:68.5.0-1~deb8u1","1:68.5.0-1~deb9u1","1:68.6.0-1","1:68.6.0-1~deb10u1","1:68.6.0-1~deb8u1","1:68.6.0-1~deb9u1","1:68.7.0-1","1:68.7.0-1~deb10u1","1:68.7.0-1~deb8u1","1:68.7.0-1~deb9u1","1:68.8.0-1","1:68.8.0-1~deb10u1","1:68.8.0-1~deb8u1","1:68.8.0-1~deb9u1","1:68.8.1-1","1:68.9.0-1","1:68.9.0-1~deb10u1","1:68.9.0-1~deb8u1","1:68.9.0-1~deb8u2","1:68.9.0-1~deb9u1","1:76.0~b1-1","1:76.0~b2-1","1:77.0~b1-1","1:77.0~b2-1","1:77.0~b3-1","1:78.0-1","1:78.0.1-1","1:78.0~b1-1","1:78.0~b2-1","1:78.1.0-1","1:78.1.1-1","1:78.10.0-1~deb9u1","1:78.2.0-1","1:78.2.1-1","1:78.2.2-1","1:78.3.1-1","1:78.3.1-2","1:78.3.1-2~deb10u1","1:78.3.1-2~deb10u2","1:78.3.1-2~deb9u1","1:78.3.2-1","1:78.3.3-1","1:78.4.0-1","1:78.4.0-1~deb10u1","1:78.4.0-1~deb9u1","1:78.4.1-1","1:78.4.2-1","1:78.4.2-1~deb10u1","1:78.4.2-1~deb9u1","1:78.5.0-1","1:78.5.0-1~deb10u1","1:78.5.0-1~deb9u1","1:78.5.1-1","1:78.5.1-1~deb10u1","1:78.5.1-1~deb9u1","1:78.6.0-1","1:78.6.0-1~deb10u1","1:78.6.0-1~deb9u1","1:78.6.1-1","1:78.7.0-1","1:78.7.0-1~deb10u1","1:78.7.0-1~deb9u1","1:78.7.1-1","1:78.8.0-1","1:78.8.0-1~deb10u1","1:78.8.0-1~deb9u1","1:78.9.0-1","1:78.9.0-1~deb10u1","1:78.9.0-1~deb9u1"],"bundled":13},{"source":"osv","ecosystem":"Mageia:7","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"78.9.1-1.mga7"}]}],"bundled":3},{"source":"osv","ecosystem":"Mageia:7","package":"thunderbird-l10n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"78.9.1-1.mga7"}]}],"bundled":3},{"source":"osv","ecosystem":"Mageia:8","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"78.9.1-1.mga8"}]}],"bundled":3},{"source":"osv","ecosystem":"Mageia:8","package":"thunderbird-l10n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"78.9.1-1.mga8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:78.9.1-1.el8_1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"thunderbird-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:78.9.1-1.el8_1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"thunderbird-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:78.9.1-1.el8_1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:78.9.1-1.el7_9"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"thunderbird-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:78.9.1-1.el7_9"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:78.9.1-1.el7_9"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"thunderbird-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:78.9.1-1.el7_9"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:78.9.1-1.el7_9"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"thunderbird-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:78.9.1-1.el7_9"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:78.9.1-1.el8_3"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"thunderbird-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:78.9.1-1.el8_3"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"thunderbird-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:78.9.1-1.el8_3"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::appstream","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:78.9.1-1.el8_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::appstream","package":"thunderbird-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:78.9.1-1.el8_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::appstream","package":"thunderbird-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:78.9.1-1.el8_2"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP2","package":"MozillaThunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"78.9.1-8.20.1"}]}],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:78.11.0+build1-0ubuntu0.18.04.2"}]}],"versions":["1:52.4.0+build1-0ubuntu2","1:52.6.0+build1-0ubuntu1","1:52.7.0+build1-0ubuntu1","1:52.8.0+build1-0ubuntu0.18.04.1","1:52.9.1+build3-0ubuntu0.18.04.1","1:60.2.1+build1-0ubuntu0.18.04.2","1:60.4.0+build2-0ubuntu0.18.04.1","1:60.5.1+build2-0ubuntu0.18.04.1","1:60.6.1+build2-0ubuntu0.18.04.1","1:60.7.0+build1-0ubuntu0.18.04.1","1:60.7.1+build1-0ubuntu0.18.04.1","1:60.7.2+build2-0ubuntu0.18.04.1","1:60.8.0+build1-0ubuntu0.18.04.1","1:60.9.0+build1-0ubuntu0.18.04.1","1:68.2.1+build1-0ubuntu0.18.04.1","1:68.2.2+build1-0ubuntu0.18.04.1","1:68.4.1+build1-0ubuntu0.18.04.1","1:68.7.0+build1-0ubuntu0.18.04.1","1:68.8.0+build2-0ubuntu0.18.04.2","1:68.10.0+build1-0ubuntu0.18.04.1","1:78.8.1+build1-0ubuntu0.18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:78.11.0+build1-0ubuntu0.20.04.2"}]}],"versions":["1:68.1.2+build1-0ubuntu1","1:68.1.2+build1-0ubuntu2","1:68.2.1+build1-0ubuntu1","1:68.2.2+build1-0ubuntu1","1:68.3.0+build2-0ubuntu1","1:68.3.1+build1-0ubuntu2","1:68.4.1+build1-0ubuntu1","1:68.4.2+build2-0ubuntu1","1:68.5.0+build1-0ubuntu1","1:68.6.0+build2-0ubuntu1","1:68.7.0+build1-0ubuntu1","1:68.7.0+build1-0ubuntu2","1:68.8.0+build2-0ubuntu0.20.04.2","1:68.10.0+build1-0ubuntu0.20.04.1","1:78.7.1+build1-0ubuntu0.20.04.1","1:78.8.1+build1-0ubuntu0.20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:78.11.0+build1-0ubuntu0.20.04.2"}]}],"versions":["1:68.1.2+build1-0ubuntu1","1:68.1.2+build1-0ubuntu2","1:68.2.1+build1-0ubuntu1","1:68.2.2+build1-0ubuntu1","1:68.3.0+build2-0ubuntu1","1:68.3.1+build1-0ubuntu2","1:68.4.1+build1-0ubuntu1","1:68.4.2+build2-0ubuntu1","1:68.5.0+build1-0ubuntu1","1:68.6.0+build2-0ubuntu1","1:68.7.0+build1-0ubuntu1","1:68.7.0+build1-0ubuntu2","1:68.8.0+build2-0ubuntu0.20.04.2","1:68.10.0+build1-0ubuntu0.20.04.1","1:78.7.1+build1-0ubuntu0.20.04.1","1:78.8.1+build1-0ubuntu0.20.04.1"],"bundled":20},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:78.11.0+build1-0ubuntu0.18.04.2"}]}],"versions":["1:52.4.0+build1-0ubuntu2","1:52.6.0+build1-0ubuntu1","1:52.7.0+build1-0ubuntu1","1:52.8.0+build1-0ubuntu0.18.04.1","1:52.9.1+build3-0ubuntu0.18.04.1","1:60.2.1+build1-0ubuntu0.18.04.2","1:60.4.0+build2-0ubuntu0.18.04.1","1:60.5.1+build2-0ubuntu0.18.04.1","1:60.6.1+build2-0ubuntu0.18.04.1","1:60.7.0+build1-0ubuntu0.18.04.1","1:60.7.1+build1-0ubuntu0.18.04.1","1:60.7.2+build2-0ubuntu0.18.04.1","1:60.8.0+build1-0ubuntu0.18.04.1","1:60.9.0+build1-0ubuntu0.18.04.1","1:68.2.1+build1-0ubuntu0.18.04.1","1:68.2.2+build1-0ubuntu0.18.04.1","1:68.4.1+build1-0ubuntu0.18.04.1","1:68.7.0+build1-0ubuntu0.18.04.1","1:68.8.0+build2-0ubuntu0.18.04.2","1:68.10.0+build1-0ubuntu0.18.04.1","1:78.8.1+build1-0ubuntu0.18.04.1"],"bundled":20},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"MozillaThunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"78.9.1-lp152.2.38.1"}]}],"bundled":7}],"products":[{"vendor":"mozilla","product":"thunderbird"}],"references":[{"url":"https://www.mozilla.org/security/advisories/mfsa2021-13/","tags":["x_refsource_MISC","x_transferred","Release Notes","Vendor Advisory","advisory"]},{"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=1666236","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Permissions Required","Vendor Advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-23992","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-x89c-f42w-ch2g"},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-23992","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2021-0189.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=28764","tags":["report"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2021-13/","tags":["advisory"]},{"url":"https://www.thunderbird.net/en-US/thunderbird/78.9.1/releasenotes/","tags":["web"]},{"url":"https://access.redhat.com/errata/RHSA-2021:1190","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1948393","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1948394","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1948395","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_1190.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-23991","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-23991","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-23991","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-23992","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-23992","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-23993","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-23993","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-23993","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-29949","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1951872","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-29949","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-29949","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-29950","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1951873","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-29950","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-29950","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2021:1192","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_1192.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2021:1193","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_1193.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2021:1201","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_1201.json","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20211167-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1177542","tags":["report"]},{"url":"https://bugzilla.suse.com/1183942","tags":["report"]},{"url":"https://bugzilla.suse.com/1184536","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-23981","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-23982","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-23984","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-23987","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-23991","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-23992","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2021-23992","tags":["report"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2021-13/#CVE-2021-23992","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4995-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-4995-2","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2021-23961","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-23981","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-23982","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-23984","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-23987","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-23991","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-23993","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-23994","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-23995","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-23998","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-23999","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-24002","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-29945","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-29946","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-29948","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-29949","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-29956","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-29957","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-29967","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/46S264KIM7ZLJMHW66XPM4XKEAJEZUEJ/","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2021-23993","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2021-23992","description":"Thunderbird did not check if the user ID associated with an OpenPGP key has a valid self signature. An attacker may create a crafted version of an OpenPGP key, by either replacing the original user ID, or by adding another user ID. If Thunderbird imports and accepts the crafted key, the Thunderbird user may falsely conclude that the false user ID belongs to the correspondent. This vulnerability affects Thunderbird \u003c 78.9.1.","status":"published","published":"2021-06-24T13:26:45Z","modified":"2024-08-03T19:14:10.02Z","updated_at":"2026-11-02T14:33:00.819444Z"}],"euvd":[{"id":"EUVD-2021-10912","description":"Thunderbird did not check if the user ID associated with an OpenPGP key has a valid self signature. An attacker may create a crafted version of an OpenPGP key, by either replacing the original user ID, or by adding another user ID. If Thunderbird imports and accepts the crafted key, the Thunderbird user may falsely conclude that the false user ID belongs to the correspondent. This vulnerability affects Thunderbird \u003c 78.9.1.","status":"published","published":"2021-06-24T13:26:45Z","modified":"2024-08-03T19:14:10Z","updated_at":"2026-11-03T03:24:59.661237Z"}],"ghsa":[{"id":"GHSA-x89c-f42w-ch2g","title":"Thunderbird did not check if the user ID associated with an OpenPGP key has a valid self...","description":"Thunderbird did not check if the user ID associated with an OpenPGP key has a valid self signature. An attacker may create a crafted version of an OpenPGP key, by either replacing the original user ID, or by adding another user ID. If Thunderbird imports and accepts the crafted key, the Thunderbird user may falsely conclude that the false user ID belongs to the correspondent. This vulnerability affects Thunderbird \u003c 78.9.1.","status":"published","published":"2022-05-24T19:06:12Z","modified":"2023-01-30T05:00:30Z","cwes":["CWE-347"],"updated_at":"2026-11-02T14:46:13.0899Z"}],"nvd":[{"id":"CVE-2021-23992","description":"Thunderbird did not check if the user ID associated with an OpenPGP key has a valid self signature. An attacker may create a crafted version of an OpenPGP key, by either replacing the original user ID, or by adding another user ID. If Thunderbird imports and accepts the crafted key, the Thunderbird user may falsely conclude that the false user ID belongs to the correspondent. This vulnerability affects Thunderbird \u003c 78.9.1.","status":"published","published":"2021-06-24T14:15:09.227Z","modified":"2026-06-17T03:39:07.4Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-347"],"updated_at":"2026-11-02T14:06:54.892562Z"}],"osv":[{"id":"CVE-2021-23992","description":"Thunderbird did not check if the user ID associated with an OpenPGP key has a valid self signature. An attacker may create a crafted version of an OpenPGP key, by either replacing the original user ID, or by adding another user ID. If Thunderbird imports and accepts the crafted key, the Thunderbird user may falsely conclude that the false user ID belongs to the correspondent. This vulnerability affects Thunderbird \u003c 78.9.1.","status":"published","published":"2021-06-24T14:15:09.227Z","modified":"2026-04-16T04:37:39.318150174Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:18.778776Z"},{"id":"DEBIAN-CVE-2021-23992","description":"Thunderbird did not check if the user ID associated with an OpenPGP key has a valid self signature. An attacker may create a crafted version of an OpenPGP key, by either replacing the original user ID, or by adding another user ID. If Thunderbird imports and accepts the crafted key, the Thunderbird user may falsely conclude that the false user ID belongs to the correspondent. This vulnerability affects Thunderbird \u003c 78.9.1.","status":"published","published":"2021-06-24T14:15:09.227Z","modified":"2026-10-23T18:02:52.060801389Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:34.637046Z"},{"id":"RHSA-2021:1190","title":"Red Hat Security Advisory: thunderbird security update","status":"published","published":"2024-09-16T05:39:29Z","modified":"2025-11-22T12:19:03Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:08.071325Z"},{"id":"RHSA-2021:1192","title":"Red Hat Security Advisory: thunderbird security update","status":"published","published":"2024-09-16T05:39:36Z","modified":"2026-06-26T10:53:45Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:08.071325Z"},{"id":"RHSA-2021:1193","title":"Red Hat Security Advisory: thunderbird security update","status":"published","published":"2024-09-16T05:39:43Z","modified":"2025-11-22T12:19:04Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:08.071325Z"},{"id":"RHSA-2021:1201","title":"Red Hat Security Advisory: thunderbird security update","status":"published","published":"2024-09-16T05:39:49Z","modified":"2025-11-22T12:19:06Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:08.071325Z"},{"id":"UBUNTU-CVE-2021-23992","description":"Thunderbird did not check if the user ID associated with an OpenPGP key has a valid self signature. An attacker may create a crafted version of an OpenPGP key, by either replacing the original user ID, or by adding another user ID. If Thunderbird imports and accepts the crafted key, the Thunderbird user may falsely conclude that the false user ID belongs to the correspondent. This vulnerability affects Thunderbird \u003c 78.9.1.","status":"published","published":"2021-04-13T00:00:00Z","modified":"2026-04-22T12:49:25.151725Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:26.779273Z"},{"id":"DLA-2632-1","title":"thunderbird - security update","status":"published","published":"2021-04-22T00:00:00Z","modified":"2026-03-09T01:23:31.786314Z","updated_at":"2026-11-02T15:46:10.712745Z"},{"id":"DSA-4897-1","title":"thunderbird - security update","status":"published","published":"2021-04-22T00:00:00Z","modified":"2026-03-09T02:11:15.045459Z","updated_at":"2026-11-02T15:46:17.19998Z"},{"id":"MGASA-2021-0189","title":"Updated thunderbird packages fix security vulnerabilities","description":"An attacker may use Thunderbird's OpenPGP key refresh mechanism to poison an\nexisting key (CVE-2021-23991).\n\nA crafted OpenPGP key with an invalid user ID could be used to confuse the\nuser (CVE-2021-23992).\n\nInability to send encrypted OpenPGP email after importing a crafted OpenPGP\nkey (CVE-2021-23993).\n","status":"published","published":"2021-04-15T19:03:58Z","modified":"2026-04-16T04:42:11.437444034Z","updated_at":"2026-11-02T15:49:41.509337Z"},{"id":"openSUSE-SU-2021:0580-1","title":"Security update for MozillaThunderbird","description":"This update for MozillaThunderbird fixes the following issues:\n\n- Mozilla Thunderbird was updated to version 78.9.1 (MFSA 2021-12,MFSA 2021-13, bsc#1183942, bsc#1184536)\n  * CVE-2021-23981: Texture upload into an unbound backing buffer resulted in an out-of-bound read\n  * CVE-2021-23982: Internal network hosts could have been probed by a malicious webpage\n  * CVE-2021-23984: Malicious extensions could have spoofed popup information\n  * CVE-2021-23987: Memory safety bugs\n  * CVE-2021-23991: An attacker may use Thunderbird's OpenPGP key refresh mechanism to poison an existing key\n  * CVE-2021-23992: A crafted OpenPGP key with an invalid user ID could be used to confuse the user\n  * CVE-2021-23993: Inability to send encrypted OpenPGP email after importing a crafted OpenPGP key\n- cleaned up and fixed mozilla.sh.in for wayland (bsc#1177542)\n\nThis update was imported from the SUSE:SLE-15-SP2:Update update project.","status":"published","published":"2021-04-19T12:10:39Z","modified":"2026-02-04T02:57:13.138563Z","updated_at":"2026-11-02T16:58:31.879684Z"},{"id":"SUSE-SU-2021:1167-1","title":"Security update for MozillaThunderbird","description":"This update for MozillaThunderbird fixes the following issues:\n\n- Mozilla Thunderbird was updated to version 78.9.1 (MFSA 2021-12,MFSA 2021-13, bsc#1183942, bsc#1184536)\n  * CVE-2021-23981: Texture upload into an unbound backing buffer resulted in an out-of-bound read\n  * CVE-2021-23982: Internal network hosts could have been probed by a malicious webpage\n  * CVE-2021-23984: Malicious extensions could have spoofed popup information\n  * CVE-2021-23987: Memory safety bugs\n  * CVE-2021-23991: An attacker may use Thunderbird's OpenPGP key refresh mechanism to poison an existing key\n  * CVE-2021-23993: Inability to send encrypted OpenPGP email after importing a crafted OpenPGP key\n- cleaned up and fixed mozilla.sh.in for wayland (bsc#1177542)\n","status":"published","published":"2021-04-13T12:04:16Z","modified":"2026-02-04T04:27:37.535786Z","updated_at":"2026-11-02T15:53:49.138643Z"},{"id":"USN-4995-1","title":"thunderbird vulnerabilities","description":"Multiple security issues were discovered in Thunderbird. If a user were\ntricked into opening a specially crafted website in a browsing context, an\nattacker could potentially exploit these to cause a denial of service,\nobtain sensitive information, spoof the UI, bypass security restrictions,\nor execute arbitrary code. (CVE-2021-23961, CVE-2021-23981,\nCVE-2021-23982, CVE-2021-23987, CVE-2021-23994, CVE-2021-23998,\nCVE-2021-23999, CVE-2021-29945, CVE-2021-29946, CVE-2021-29967)\n\nIt was discovered that extensions could open popup windows with control\nof the window title in some circumstances. If a user were tricked into\ninstalling a specially crafted extension, an attacker could potentially\nexploit this to spoof a website and trick the user into providing\ncredentials. (CVE-2021-23984)\n\nMultiple security issues were discovered in Thunderbird's OpenPGP\nintegration. If a user were tricked into importing a specially crafted\nkey in some circumstances, an attacker could potentially exploit this\nto cause a denial of service (inability to send encrypted email) or\nconfuse the user. (CVE-2021-23991, CVE-2021-23992, CVE-2021-23993)\n\nA use-after-free was discovered when Responsive Design Mode was\nenabled. If a user were tricked into opening a specially crafted\nwebsite with Responsive Design Mode enabled, an attacker could\npotentially exploit this to cause a denial of service, or execute\narbitrary code. (CVE-2021-23995)\n\nIt was discovered that Thunderbird mishandled ftp URLs with encoded\nnewline characters. If a user were tricked into clicking on a specially\ncrafted link, an attacker could potentially exploit this to send arbitrary\nFTP commands. (CVE-2021-24002)\n\nIt was discovered that Thunderbird wrote signatures to disk and read them\nback during verification. A local attacker could potentially exploit this\nto replace the data with another signature file. (CVE-2021-29948)\n\nIt was discovered that Thunderbird might load an alternative OTR\nlibrary. If a user were tricked into copying a specially crafted\nlibrary to one of Thunderbird's search paths, an attacker could\npotentially exploit this to execute arbitrary code. (CVE-2021-29949)\n\nIt was discovered that secret keys imported into Thunderbird were\nstored unencrypted. A local attacker could potentially exploit this to\nobtain private keys. (CVE-2021-29956)\n\nIt was discovered that Thunderbird did not indicate when an inline signed\nor encrypted message contained additional unprotected parts.\n(CVE-2021-29957)\n","status":"published","published":"2021-06-22T16:43:02Z","modified":"2026-04-22T10:15:28.673707Z","updated_at":"2026-11-02T16:58:15.683829Z"},{"id":"USN-4995-2","title":"thunderbird vulnerabilities","description":"USN-4995-1 fixed vulnerabilities in Thunderbird. This update provides\nthe corresponding updates for Ubuntu 18.04 LTS.\n\nOriginal advisory details:\n\n Multiple security issues were discovered in Thunderbird. If a user were\n tricked into opening a specially crafted website in a browsing context, an\n attacker could potentially exploit these to cause a denial of service,\n obtain sensitive information, spoof the UI, bypass security restrictions,\n or execute arbitrary code. (CVE-2021-23961, CVE-2021-23981,\n CVE-2021-23982, CVE-2021-23987, CVE-2021-23994, CVE-2021-23998,\n CVE-2021-23999, CVE-2021-29945, CVE-2021-29946, CVE-2021-29967)\n \n It was discovered that extensions could open popup windows with control\n of the window title in some circumstances. If a user were tricked into\n installing a specially crafted extension, an attacker could potentially\n exploit this to spoof a website and trick the user into providing\n credentials. (CVE-2021-23984)\n \n Multiple security issues were discovered in Thunderbird's OpenPGP\n integration. If a user were tricked into importing a specially crafted\n key in some circumstances, an attacker could potentially exploit this\n to cause a denial of service (inability to send encrypted email) or\n confuse the user. (CVE-2021-23991, CVE-2021-23992, CVE-2021-23993)\n \n A use-after-free was discovered when Responsive Design Mode was\n enabled. If a user were tricked into opening a specially crafted\n website with Responsive Design Mode enabled, an attacker could\n potentially exploit this to cause a denial of service, or execute\n arbitrary code. (CVE-2021-23995)\n \n It was discovered that Thunderbird mishandled ftp URLs with encoded\n newline characters. If a user were tricked into clicking on a specially\n crafted link, an attacker could potentially exploit this to send arbitrary\n FTP commands. (CVE-2021-24002)\n \n It was discovered that Thunderbird wrote signatures to disk and read them\n back during verification. A local attacker could potentially exploit this\n to replace the data with another signature file. (CVE-2021-29948)\n \n It was discovered that Thunderbird might load an alternative OTR\n library. If a user were tricked into copying a specially crafted\n library to one of Thunderbird's search paths, an attacker could\n potentially exploit this to execute arbitrary code. (CVE-2021-29949)\n \n It was discovered that secret keys imported into Thunderbird were\n stored unencrypted. A local attacker could potentially exploit this to\n obtain private keys. (CVE-2021-29956)\n \n It was discovered that Thunderbird did not indicate when an inline signed\n or encrypted message contained additional unprotected parts.\n (CVE-2021-29957)\n","status":"published","published":"2021-06-25T14:44:38Z","modified":"2026-04-22T10:16:05.579337Z","updated_at":"2026-11-02T16:58:15.683829Z"}]}}