It was discovered that Message ID calculation was based on uninitialized data. An attacker could potentially exploit this to obtain sensitive information. (CVE-2020-6792)
Mutiple security issues were discovered in Thunderbird. If a user were tricked in to opening a specially crafted message, an attacker could potentially exploit these to cause a denial of service, obtain sensitive information, or execute arbitrary code. (CVE-2020-6793, CVE-2020-6795, CVE-2020-6822)
It was discovered that if a user saved passwords before Thunderbird 60 and then later set a master password, an unencrypted copy of these passwords would still be accessible. A local user could exploit this to obtain sensitive information. (CVE-2020-6794)
Multiple security issues were discovered in Thunderbird. If a user were tricked in to opening a specially crafted website in a browsing context, an attacker could potentially exploit these to cause a denial of service, conduct cross-site scripting (XSS) attacks, obtain sensitive information, or execute arbitrary code. (CVE-2019-20503, CVE-2020-6798, CVE-2020-6800, CVE-2020-6805, CVE-2020-6806, CVE-2020-6807, CVE-2020-6812, CVE-2020-6814, CVE-2020-6819, CVE-2020-6820, CVE-2020-6821, CVE-2020-6825)
It was discovered that the Devtools’ ‘Copy as cURL’ feature did not fully escape website-controlled data. If a user were tricked in to using the ‘Copy as cURL’ feature to copy and paste a command with specially crafted data in to a terminal, an attacker could potentially exploit this to execute arbitrary commands via command injection. (CVE-2020-6811)
{ "binaries": [ { "binary_version": "1:68.7.0+build1-0ubuntu0.18.04.1", "binary_name": "thunderbird" }, { "binary_version": "1:68.7.0+build1-0ubuntu0.18.04.1", "binary_name": "thunderbird-dev" }, { "binary_version": "1:68.7.0+build1-0ubuntu0.18.04.1", "binary_name": "thunderbird-gnome-support" }, { "binary_version": "1:68.7.0+build1-0ubuntu0.18.04.1", "binary_name": "thunderbird-mozsymbols" }, { "binary_version": "1:68.7.0+build1-0ubuntu0.18.04.1", "binary_name": "xul-ext-calendar-timezones" }, { "binary_version": "1:68.7.0+build1-0ubuntu0.18.04.1", "binary_name": "xul-ext-gdata-provider" }, { "binary_version": "1:68.7.0+build1-0ubuntu0.18.04.1", "binary_name": "xul-ext-lightning" } ], "availability": "No subscription required" }