{"url":"http://public2.vulnerablecode.io/api/packages/2674?format=json","purl":"pkg:alpm/archlinux/thunderbird@68.8.1-1","type":"alpm","namespace":"archlinux","name":"thunderbird","version":"68.8.1-1","qualifiers":{},"subpath":"","is_vulnerable":true,"next_non_vulnerable_version":"68.9.0-1","latest_non_vulnerable_version":"91.10-1","affected_by_vulnerabilities":[{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/1093?format=json","vulnerability_id":"VCID-4qav-6sgf-1qfc","summary":"Mozilla developer Iain Ireland discovered a missing type check during unboxed objects removal, resulting in a crash. We presume that with enough effort that it could be exploited to run arbitrary code.","references":[{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12398","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12398"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12399","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12399"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12405","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12405"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12406","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12406"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12410","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12410"},{"reference_url":"https://security.archlinux.org/ASA-202006-1","reference_id":"ASA-202006-1","reference_type":"","scores":[],"url":"https://security.archlinux.org/ASA-202006-1"},{"reference_url":"https://security.archlinux.org/ASA-202006-4","reference_id":"ASA-202006-4","reference_type":"","scores":[],"url":"https://security.archlinux.org/ASA-202006-4"},{"reference_url":"https://security.archlinux.org/AVG-1173","reference_id":"AVG-1173","reference_type":"","scores":[{"value":"High","scoring_system":"archlinux","scoring_elements":""}],"url":"https://security.archlinux.org/AVG-1173"},{"reference_url":"https://security.archlinux.org/AVG-1179","reference_id":"AVG-1179","reference_type":"","scores":[{"value":"High","scoring_system":"archlinux","scoring_elements":""}],"url":"https://security.archlinux.org/AVG-1179"},{"reference_url":"https://www.mozilla.org/en-US/security/advisories/mfsa2020-20","reference_id":"mfsa2020-20","reference_type":"","scores":[{"value":"high","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2020-20"},{"reference_url":"https://www.mozilla.org/en-US/security/advisories/mfsa2020-21","reference_id":"mfsa2020-21","reference_type":"","scores":[{"value":"high","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2020-21"},{"reference_url":"https://www.mozilla.org/en-US/security/advisories/mfsa2020-22","reference_id":"mfsa2020-22","reference_type":"","scores":[{"value":"high","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2020-22"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/2675?format=json","purl":"pkg:alpm/archlinux/thunderbird@68.9.0-1","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:alpm/archlinux/thunderbird@68.9.0-1"}],"aliases":["CVE-2020-12406"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-4qav-6sgf-1qfc"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/1095?format=json","vulnerability_id":"VCID-f21u-xmkh-qqcz","summary":"If Thunderbird is configured to use STARTTLS for an IMAP\nserver, and the server sends a PREAUTH response, then\nThunderbird will continue with an unencrypted connection,\ncausing email data to be sent without protection.","references":[{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12398","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12398"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12399","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12399"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12405","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12405"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12406","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12406"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12410","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12410"},{"reference_url":"https://security.archlinux.org/ASA-202006-4","reference_id":"ASA-202006-4","reference_type":"","scores":[],"url":"https://security.archlinux.org/ASA-202006-4"},{"reference_url":"https://security.archlinux.org/AVG-1179","reference_id":"AVG-1179","reference_type":"","scores":[{"value":"High","scoring_system":"archlinux","scoring_elements":""}],"url":"https://security.archlinux.org/AVG-1179"},{"reference_url":"https://www.mozilla.org/en-US/security/advisories/mfsa2020-22","reference_id":"mfsa2020-22","reference_type":"","scores":[{"value":"high","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2020-22"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/2675?format=json","purl":"pkg:alpm/archlinux/thunderbird@68.9.0-1","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:alpm/archlinux/thunderbird@68.9.0-1"}],"aliases":["CVE-2020-12398"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-f21u-xmkh-qqcz"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/1091?format=json","vulnerability_id":"VCID-kzju-7twc-fya8","summary":"NSS has shown timing differences when performing DSA signatures, which was exploitable and could eventually leak private keys.","references":[{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17006","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17006"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17023","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17023"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12398","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12398"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12399","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12399"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12402","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12402"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12405","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12405"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12406","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12406"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12410","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12410"},{"reference_url":"https://security.archlinux.org/ASA-202006-1","reference_id":"ASA-202006-1","reference_type":"","scores":[],"url":"https://security.archlinux.org/ASA-202006-1"},{"reference_url":"https://security.archlinux.org/ASA-202006-4","reference_id":"ASA-202006-4","reference_type":"","scores":[],"url":"https://security.archlinux.org/ASA-202006-4"},{"reference_url":"https://security.archlinux.org/AVG-1173","reference_id":"AVG-1173","reference_type":"","scores":[{"value":"High","scoring_system":"archlinux","scoring_elements":""}],"url":"https://security.archlinux.org/AVG-1173"},{"reference_url":"https://security.archlinux.org/AVG-1179","reference_id":"AVG-1179","reference_type":"","scores":[{"value":"High","scoring_system":"archlinux","scoring_elements":""}],"url":"https://security.archlinux.org/AVG-1179"},{"reference_url":"https://www.mozilla.org/en-US/security/advisories/mfsa2020-20","reference_id":"mfsa2020-20","reference_type":"","scores":[{"value":"high","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2020-20"},{"reference_url":"https://www.mozilla.org/en-US/security/advisories/mfsa2020-21","reference_id":"mfsa2020-21","reference_type":"","scores":[{"value":"high","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2020-21"},{"reference_url":"https://www.mozilla.org/en-US/security/advisories/mfsa2020-22","reference_id":"mfsa2020-22","reference_type":"","scores":[{"value":"high","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2020-22"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/2675?format=json","purl":"pkg:alpm/archlinux/thunderbird@68.9.0-1","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:alpm/archlinux/thunderbird@68.9.0-1"}],"aliases":["CVE-2020-12399"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-kzju-7twc-fya8"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/1092?format=json","vulnerability_id":"VCID-u3t9-ty7y-vkb8","summary":"When browsing a malicious page, a race condition in our SharedWorkerService could occur and lead to a potentially exploitable crash.","references":[{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12398","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12398"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12399","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12399"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12405","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12405"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12406","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12406"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12410","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12410"},{"reference_url":"https://security.archlinux.org/ASA-202006-1","reference_id":"ASA-202006-1","reference_type":"","scores":[],"url":"https://security.archlinux.org/ASA-202006-1"},{"reference_url":"https://security.archlinux.org/ASA-202006-4","reference_id":"ASA-202006-4","reference_type":"","scores":[],"url":"https://security.archlinux.org/ASA-202006-4"},{"reference_url":"https://security.archlinux.org/AVG-1173","reference_id":"AVG-1173","reference_type":"","scores":[{"value":"High","scoring_system":"archlinux","scoring_elements":""}],"url":"https://security.archlinux.org/AVG-1173"},{"reference_url":"https://security.archlinux.org/AVG-1179","reference_id":"AVG-1179","reference_type":"","scores":[{"value":"High","scoring_system":"archlinux","scoring_elements":""}],"url":"https://security.archlinux.org/AVG-1179"},{"reference_url":"https://www.mozilla.org/en-US/security/advisories/mfsa2020-20","reference_id":"mfsa2020-20","reference_type":"","scores":[{"value":"high","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2020-20"},{"reference_url":"https://www.mozilla.org/en-US/security/advisories/mfsa2020-21","reference_id":"mfsa2020-21","reference_type":"","scores":[{"value":"high","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2020-21"},{"reference_url":"https://www.mozilla.org/en-US/security/advisories/mfsa2020-22","reference_id":"mfsa2020-22","reference_type":"","scores":[{"value":"high","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2020-22"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/2675?format=json","purl":"pkg:alpm/archlinux/thunderbird@68.9.0-1","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:alpm/archlinux/thunderbird@68.9.0-1"}],"aliases":["CVE-2020-12405"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-u3t9-ty7y-vkb8"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/1094?format=json","vulnerability_id":"VCID-xcz4-bmu6-kfe2","summary":"Mozilla developers Tom Tung and Karl Tomlinson reported memory safety bugs present in Firefox 68.8. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.","references":[{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12398","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12398"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12399","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12399"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12405","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12405"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12406","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12406"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12410","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12410"},{"reference_url":"https://security.archlinux.org/ASA-202006-1","reference_id":"ASA-202006-1","reference_type":"","scores":[],"url":"https://security.archlinux.org/ASA-202006-1"},{"reference_url":"https://security.archlinux.org/ASA-202006-4","reference_id":"ASA-202006-4","reference_type":"","scores":[],"url":"https://security.archlinux.org/ASA-202006-4"},{"reference_url":"https://security.archlinux.org/AVG-1173","reference_id":"AVG-1173","reference_type":"","scores":[{"value":"High","scoring_system":"archlinux","scoring_elements":""}],"url":"https://security.archlinux.org/AVG-1173"},{"reference_url":"https://security.archlinux.org/AVG-1179","reference_id":"AVG-1179","reference_type":"","scores":[{"value":"High","scoring_system":"archlinux","scoring_elements":""}],"url":"https://security.archlinux.org/AVG-1179"},{"reference_url":"https://www.mozilla.org/en-US/security/advisories/mfsa2020-20","reference_id":"mfsa2020-20","reference_type":"","scores":[{"value":"high","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2020-20"},{"reference_url":"https://www.mozilla.org/en-US/security/advisories/mfsa2020-21","reference_id":"mfsa2020-21","reference_type":"","scores":[{"value":"high","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2020-21"},{"reference_url":"https://www.mozilla.org/en-US/security/advisories/mfsa2020-22","reference_id":"mfsa2020-22","reference_type":"","scores":[{"value":"high","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2020-22"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/2675?format=json","purl":"pkg:alpm/archlinux/thunderbird@68.9.0-1","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:alpm/archlinux/thunderbird@68.9.0-1"}],"aliases":["CVE-2020-12410"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-xcz4-bmu6-kfe2"}],"fixing_vulnerabilities":[],"risk_score":null,"resource_url":"http://public2.vulnerablecode.io/packages/pkg:alpm/archlinux/thunderbird@68.8.1-1"}