VulnerableCode Package Details - pkg:alpm/archlinux/thunderbird@78.8.0-1

Search for packages

Vulnerability	Summary	Fixed by
VCID-jzqw-c9tg-r3d3 Aliases: CVE-2021-29950	Thunderbird unprotects a secret OpenPGP key prior to using it for a decryption, signing or key import task. If the task runs into a failure, the secret key may remain in memory in its unprotected state.	78.8.1-1 Affected by 4 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }}

Vulnerability

Summary

Fixed by

VCID-jzqw-c9tg-r3d3
Aliases:
CVE-2021-29950

Thunderbird unprotects a secret OpenPGP key prior to using it for a decryption, signing or key import task. If the task runs into a failure, the secret key may remain in memory in its unprotected state.

78.8.1-1
Affected by 4 other vulnerabilities.

Vulnerability	Summary	Aliases
VCID-2h48-21h2-bbgs	If Content Security Policy blocked frame navigation, the full destination of a redirect served in the frame was reported in the violation report; as opposed to the original frame URI. This could be used to leak sensitive information contained in such URIs.	CVE-2021-23968
VCID-61bf-8zpz-vyhz	Mozilla developers Alexis Beingessner, Tyson Smith, Nika Layzell, and Mats Palmgren reported memory safety bugs present in Thunderbird 78.7. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.	CVE-2021-23978
VCID-kkes-taub-zucz	As specified in the W3C Content Security Policy draft, when creating a violation report, "User agents need to ensure that the source file is the URL requested by the page, pre-redirects. If that’s not possible, user agents need to strip the URL down to an origin to avoid unintentional leakage." Under certain types of redirects, Thunderbird incorrectly set the source file to be the destination of the redirects. This was fixed to be the redirect destination's origin.	CVE-2021-23969
VCID-mrm7-fnxn-7fdq	When trying to load a cross-origin resource in an audio/video context a decoding error may have resulted, and the content of that error may have revealed information about the resource.	CVE-2021-23973

Vulnerability

Summary

Aliases

VCID-2h48-21h2-bbgs

If Content Security Policy blocked frame navigation, the full destination of a redirect served in the frame was reported in the violation report; as opposed to the original frame URI. This could be used to leak sensitive information contained in such URIs.

CVE-2021-23968

VCID-61bf-8zpz-vyhz

Mozilla developers Alexis Beingessner, Tyson Smith, Nika Layzell, and Mats Palmgren reported memory safety bugs present in Thunderbird 78.7. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.

CVE-2021-23978

VCID-kkes-taub-zucz

As specified in the W3C Content Security Policy draft, when creating a violation report, "User agents need to ensure that the source file is the URL requested by the page, pre-redirects. If that’s not possible, user agents need to strip the URL down to an origin to avoid unintentional leakage." Under certain types of redirects, Thunderbird incorrectly set the source file to be the destination of the redirects. This was fixed to be the redirect destination's origin.

CVE-2021-23969

VCID-mrm7-fnxn-7fdq

When trying to load a cross-origin resource in an audio/video context a decoding error may have resulted, and the content of that error may have revealed information about the resource.

CVE-2021-23973

Date	Actor	Action	Vulnerability	Source	VulnerableCode Version
2025-07-31T11:37:57.199435+00:00	Arch Linux Importer	Affected by	VCID-jzqw-c9tg-r3d3	https://security.archlinux.org/AVG-1845	37.0.0
2025-07-31T11:36:39.369765+00:00	Arch Linux Importer	Fixing	VCID-2h48-21h2-bbgs	https://security.archlinux.org/AVG-1601	37.0.0
2025-07-31T11:36:39.344473+00:00	Arch Linux Importer	Fixing	VCID-kkes-taub-zucz	https://security.archlinux.org/AVG-1601	37.0.0
2025-07-31T11:36:39.319173+00:00	Arch Linux Importer	Fixing	VCID-mrm7-fnxn-7fdq	https://security.archlinux.org/AVG-1601	37.0.0
2025-07-31T11:36:39.293540+00:00	Arch Linux Importer	Fixing	VCID-61bf-8zpz-vyhz	https://security.archlinux.org/AVG-1601	37.0.0