Magnus Melin

When setting up an account, Thunderbird's Exchange AutoDiscover lookup also queried the domain's AutoDiscover service over plain HTTP. Due to a bug, that unencrypted request included the credentials the user had entered, allowing a network attacker to obtain the user's password. This vulnerability was fixed in Thunderbird 158.0.1 and Thunderbird 153.5.1.

Thunderbird did not escape attribute values when serializing outgoing XMPP stanzas. Because values from incoming requests were echoed back in automatic replies, a remote XMPP user could send a crafted request that caused Thunderbird to inject arbitrary stanzas into the user's connection, which the server would then process as if sent by the user. This could be used to send messages or change contact and subscription settings on behalf of the user, without any interaction. This bug only affects Thunderbird's chat feature with XMPP accounts. This vulnerability was fixed in Thunderbird 158.0.1 and Thunderbird 153.5.1.

Name of the Vulnerable Software and Affected Versions: Thunderbird versions prior to 128.4.3 Thunderbird versions prior to 132.0.1 Description: The issue is related to the use of remote content in OpenPGP encrypted messages, which can lead to the disclosure of plaintext. This is due to insufficient protection of service data in the implementation of the OpenPGP email encryption standard in the Mozilla Thunderbird email client. An attacker can exploit this vulnerability to reveal protected information. Recommendations: For Thunderbird versions prior to 128.4.3, update to version 128.4.3 or later. For Thunderbird versions prior to 132.0.1, update to version 132.0.1 or later. As a temporary workaround, consider avoiding the use of remote content in OpenPGP encrypted messages until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Thunderbird versions prior to 68.10.0 **Description** The issue arises when an attacker intercepts Thunderbird's initial attempt to set up an account automatically using the Microsoft Exchange autodiscovery mechanism. If the attacker sends a crafted response, Thunderbird will send the `username` and `password` over https to a server controlled by the attacker. **Recommendations** For versions prior to 68.10.0, update to version 68.10.0 or later to resolve the issue. As a temporary workaround, consider disabling the autodiscovery mechanism for Microsoft Exchange until a patch is applied. Restrict access to sensitive information and avoid using automatic account setup features until the issue is resolved.