RHSA-2021:1193
Vulnerability from csaf_opensuse - Published: 2021-04-14 00:00 - Updated: 2026-09-20 11:14Summary
security update for thunderbird
Severity
Moderate
Notes
Title of the patch: security update for thunderbird
Description of the patch: This security update provides a functional equivalent of RHSA-2021:1193.
The original Red Hat(R) advisory is available from the Red Hat web site at
https://access.redhat.com/errata/RHSA-2021:1193.
Patchnames: RHSA-2021:1193
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
4.3 (Medium)
Affected products
Recommended
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Liberty Linux 8:thunderbird-0:78.9.1-1.el8_3.x86_64 | — |
Vendor Fix
|
Threats
Impact
moderate
6.5 (Medium)
Affected products
Recommended
1 product, the same list as for
CVE-2021-23991
Threats
Impact
moderate
4.3 (Medium)
Affected products
Recommended
1 product, the same list as for
CVE-2021-23991
Threats
Impact
moderate
4.2 (Medium)
Affected products
Recommended
1 product, the same list as for
CVE-2021-23991
Threats
Impact
moderate
6.1 (Medium)
Affected products
Recommended
1 product, the same list as for
CVE-2021-23991
Threats
Impact
moderate
References
17 references
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "Moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "security update for thunderbird",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This security update provides a functional equivalent of RHSA-2021:1193.\nThe original Red Hat(R) advisory is available from the Red Hat web site at\nhttps://access.redhat.com/errata/RHSA-2021:1193.\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "RHSA-2021:1193",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/rhsa-2021_1193.json"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2021-23991 page",
"url": "https://www.suse.com/security/cve/CVE-2021-23991/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2021-23992 page",
"url": "https://www.suse.com/security/cve/CVE-2021-23992/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2021-23993 page",
"url": "https://www.suse.com/security/cve/CVE-2021-23993/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2021-29949 page",
"url": "https://www.suse.com/security/cve/CVE-2021-29949/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2021-29950 page",
"url": "https://www.suse.com/security/cve/CVE-2021-29950/"
}
],
"title": "security update for thunderbird",
"tracking": {
"current_release_date": "2026-09-20T11:14:04Z",
"generator": {
"date": "2021-04-14T00:00:00Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "RHSA-2021:1193",
"initial_release_date": "2021-04-14T00:00:00Z",
"revision_history": [
{
"date": "2021-04-14T00:00:00Z",
"number": "1",
"summary": "Current version"
},
{
"date": "2026-09-20T11:14:04Z",
"number": "2",
"summary": "unknown changes"
}
],
"status": "final",
"version": "2"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "thunderbird-0:78.9.1-1.el8_3.x86_64",
"product": {
"name": "thunderbird-0:78.9.1-1.el8_3.x86_64",
"product_id": "thunderbird-0:78.9.1-1.el8_3.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/suse/thunderbird@78.9.1-1.el8_3?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Liberty Linux 8",
"product": {
"name": "SUSE Liberty Linux 8",
"product_id": "SUSE Liberty Linux 8",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sll:8"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "thunderbird-0:78.9.1-1.el8_3.x86_64 as component of SUSE Liberty Linux 8",
"product_id": "SUSE Liberty Linux 8:thunderbird-0:78.9.1-1.el8_3.x86_64"
},
"product_reference": "thunderbird-0:78.9.1-1.el8_3.x86_64",
"relates_to_product_reference": "SUSE Liberty Linux 8"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2021-23991",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2021-23991"
}
],
"notes": [
{
"category": "general",
"text": "If a Thunderbird user has previously imported Alice\u0027s OpenPGP key, and Alice has extended the validity period of her key, but Alice\u0027s updated key has not yet been imported, an attacker may send an email containing a crafted version of Alice\u0027s key with an invalid subkey, Thunderbird might subsequently attempt to use the invalid subkey, and will fail to send encrypted email to Alice. This vulnerability affects Thunderbird \u003c 78.9.1.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 8:thunderbird-0:78.9.1-1.el8_3.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2021-23991",
"url": "https://www.suse.com/security/cve/CVE-2021-23991"
},
{
"category": "external",
"summary": "SUSE Bug 1184536 for CVE-2021-23991",
"url": "https://bugzilla.suse.com/1184536"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 8:thunderbird-0:78.9.1-1.el8_3.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"SUSE Liberty Linux 8:thunderbird-0:78.9.1-1.el8_3.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2021-04-14T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2021-23991"
},
{
"cve": "CVE-2021-23992",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2021-23992"
}
],
"notes": [
{
"category": "general",
"text": "Thunderbird did not check if the user ID associated with an OpenPGP key has a valid self signature. An attacker may create a crafted version of an OpenPGP key, by either replacing the original user ID, or by adding another user ID. If Thunderbird imports and accepts the crafted key, the Thunderbird user may falsely conclude that the false user ID belongs to the correspondent. This vulnerability affects Thunderbird \u003c 78.9.1.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 8:thunderbird-0:78.9.1-1.el8_3.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2021-23992",
"url": "https://www.suse.com/security/cve/CVE-2021-23992"
},
{
"category": "external",
"summary": "SUSE Bug 1184536 for CVE-2021-23992",
"url": "https://bugzilla.suse.com/1184536"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 8:thunderbird-0:78.9.1-1.el8_3.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"SUSE Liberty Linux 8:thunderbird-0:78.9.1-1.el8_3.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2021-04-14T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2021-23992"
},
{
"cve": "CVE-2021-23993",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2021-23993"
}
],
"notes": [
{
"category": "general",
"text": "An attacker may perform a DoS attack to prevent a user from sending encrypted email to a correspondent. If an attacker creates a crafted OpenPGP key with a subkey that has an invalid self signature, and the Thunderbird user imports the crafted key, then Thunderbird may try to use the invalid subkey, but the RNP library rejects it from being used, causing encryption to fail. This vulnerability affects Thunderbird \u003c 78.9.1.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 8:thunderbird-0:78.9.1-1.el8_3.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2021-23993",
"url": "https://www.suse.com/security/cve/CVE-2021-23993"
},
{
"category": "external",
"summary": "SUSE Bug 1184536 for CVE-2021-23993",
"url": "https://bugzilla.suse.com/1184536"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 8:thunderbird-0:78.9.1-1.el8_3.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"SUSE Liberty Linux 8:thunderbird-0:78.9.1-1.el8_3.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2021-04-14T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2021-23993"
},
{
"cve": "CVE-2021-29949",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2021-29949"
}
],
"notes": [
{
"category": "general",
"text": "When loading the shared library that provides the OTR protocol implementation, Thunderbird will initially attempt to open it using a filename that isn\u0027t distributed by Thunderbird. If a computer has already been infected with a malicious library of the alternative filename, and the malicious library has been copied to a directory that is contained in the search path for executable libraries, then Thunderbird will load the incorrect library. This vulnerability affects Thunderbird \u003c 78.9.1.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 8:thunderbird-0:78.9.1-1.el8_3.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2021-29949",
"url": "https://www.suse.com/security/cve/CVE-2021-29949"
},
{
"category": "external",
"summary": "SUSE Bug 1185088 for CVE-2021-29949",
"url": "https://bugzilla.suse.com/1185088"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 8:thunderbird-0:78.9.1-1.el8_3.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.2,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"SUSE Liberty Linux 8:thunderbird-0:78.9.1-1.el8_3.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2021-04-14T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2021-29949"
},
{
"cve": "CVE-2021-29950",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2021-29950"
}
],
"notes": [
{
"category": "general",
"text": "Thunderbird unprotects a secret OpenPGP key prior to using it for a decryption, signing or key import task. If the task runs into a failure, the secret key may remain in memory in its unprotected state. This vulnerability affects Thunderbird \u003c 78.8.1.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 8:thunderbird-0:78.9.1-1.el8_3.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2021-29950",
"url": "https://www.suse.com/security/cve/CVE-2021-29950"
},
{
"category": "external",
"summary": "SUSE Bug 1185086 for CVE-2021-29950",
"url": "https://bugzilla.suse.com/1185086"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 8:thunderbird-0:78.9.1-1.el8_3.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"SUSE Liberty Linux 8:thunderbird-0:78.9.1-1.el8_3.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2021-04-14T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2021-29950"
}
]
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…