Kai Engert

**Name of the Vulnerable Software and Affected Versions** Thunderbird versions prior to 102.8 **Description** The issue is related to the processing of OpenPGP and OpenPGP MIME data in a specific way, which could cause Thunderbird's user interface to lock up and no longer respond to user actions. An attacker could send a crafted message to attempt a DoS attack by exploiting this error. **Recommendations** For versions prior to 102.8, update to version 102.8 or later to resolve the issue. As a temporary workaround, consider avoiding the use of OpenPGP and OpenPGP MIME data in emails until the update is applied.

**Name of the Vulnerable Software and Affected Versions** Thunderbird versions prior to 91.4.1 **Description** The issue is related to how Thunderbird handles OpenPGP/MIME signed email messages with additional outer MIME message layers. Previously, Thunderbird only considered the inner signed message for signature validity, giving the false impression that the additional contents were also covered by the digital signature. This could allow a remote attacker to perform a spoofing attack due to insufficient warning about dangerous actions. **Recommendations** For Thunderbird versions prior to 91.4.1, update to version 91.4.1 or later to ensure that only the signature belonging to the top-level MIME part is considered for the displayed status, thus preventing the false impression of additional contents being covered by the digital signature.

**Name of the Vulnerable Software and Affected Versions** Thunderbird versions 78.8.1 through 78.10.1 **Description** The issue is related to the storage of OpenPGP secret keys in an unencrypted form on the user's local disk, which could allow an attacker to access confidential information. The master password protection was inactive for the imported keys. **Recommendations** For Thunderbird versions 78.8.1 through 78.10.1, update to version 78.10.2 or later to restore the protection mechanism for newly imported keys and to automatically protect keys that had been imported using affected Thunderbird versions.

**Name of the Vulnerable Software and Affected Versions** Mozilla (affected versions not specified) **Description** A flaw in Mozilla's embedded certificate code might allow web sites to install root certificates on devices without user approval. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Thunderbird versions prior to 78.10 Description: The issue is caused by a synchronization error when using a shared resource, which might be subject to a race condition when a malicious local process or user is replacing a file. This could allow a remote attacker to bypass existing security restrictions. Signatures are written to disk before and read during verification, which can be exploited. Recommendations: For versions prior to 78.10, update to version 78.10 or later to resolve the issue. As a temporary workaround, consider restricting access to the file system to minimize the risk of exploitation. Avoid using shared resources until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 84 Thunderbird versions prior to 78.6 Firefox ESR versions prior to 78.6 **Description** The issue arises when certain input to the CSS Sanitizer causes it to incorrectly remove components, potentially leading to a sanitizer bypass. **Recommendations** For Firefox versions prior to 84, update to version 84 or later. For Thunderbird versions prior to 78.6, update to version 78.6 or later. For Firefox ESR versions prior to 78.6, update to version 78.6 or later.

**Name of the Vulnerable Software and Affected Versions** Mozilla Network Security Services (affected versions not specified) **Description** A Null pointer dereference issue exists due to a missing NULL check in `PK11 SignWithSymKey` / `ssl3 ComputeRecordMACConstantTime`, which could let a remote malicious user cause a Denial of Service. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Debian GNU/Linux versions (affected versions not specified) Mozilla Network Security Services (NSS) versions prior to 3.15.2 **Description** The issue concerns multiple vulnerabilities in the nss package of Debian GNU/Linux, which can be exploited remotely to disrupt the availability of protected information. The vulnerabilities in Mozilla Network Security Services (NSS) before version 3.15.2 are related to the failure to ensure that data structures are initialized before read operations. This can allow remote attackers to cause a denial of service or possibly have other unspecified impacts via vectors that trigger a decryption failure. **Recommendations** For Mozilla Network Security Services (NSS) versions prior to 3.15.2, update to version 3.15.2 or later to resolve the issue. For Debian GNU/Linux, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Mozilla Firefox versions prior to 2.0.0.12 Thunderbird versions prior to 2.0.0.12 SeaMonkey versions prior to 1.1.8 **Description** The issue allows remote attackers to cause a denial of service and possibly trigger memory corruption via certain vectors related to specific methods, including `nsTableFrame::GetFrameAtOrBefore`, `nsAccessibilityService::GetAccessible`, `nsBindingManager::GetNestedInsertionPoint`, `nsXBLPrototypeBinding::AttributeChanged`, `nsColumnSetFrame::GetContentInsertionFrame`, and `nsLineLayout::TrimTrailingWhiteSpaceIn`. **Recommendations** For Mozilla Firefox versions prior to 2.0.0.12, update to version 2.0.0.12 or later. For Thunderbird versions prior to 2.0.0.12, update to version 2.0.0.12 or later. For SeaMonkey versions prior to 1.1.8, update to version 1.1.8 or later.