Kai Engert

The issue is related to the processing of OpenPGP and OpenPGP MIME data in a specific way, which could cause Thunderbird's user interface to lock up and no longer respond to user actions. An attacker could send a crafted message to attempt a DoS attack by exploiting this error.

The issue is related to how Thunderbird handles OpenPGP/MIME signed email messages with additional outer MIME message layers. Previously, Thunderbird only considered the inner signed message for signature validity, giving the false impression that the additional contents were also covered by the digital signature. This could allow a remote attacker to perform a spoofing attack due to insufficient warning about dangerous actions.

The issue is related to the storage of OpenPGP secret keys in an unencrypted form on the user's local disk, which could allow an attacker to access confidential information. The master password protection was inactive for the imported keys.

A flaw in Mozilla's embedded certificate code might allow web sites to install root certificates on devices without user approval.

Name of the Vulnerable Software and Affected Versions: Thunderbird versions prior to 78.10 Description: The issue is caused by a synchronization error when using a shared resource, which might be subject to a race condition when a malicious local process or user is replacing a file. This could allow a remote attacker to bypass existing security restrictions. Signatures are written to disk before and read during verification, which can be exploited. Recommendations: For versions prior to 78.10, update to version 78.10 or later to resolve the issue. As a temporary workaround, consider restricting access to the file system to minimize the risk of exploitation. Avoid using shared resources until the issue is resolved.

The issue arises when certain input to the CSS Sanitizer causes it to incorrectly remove components, potentially leading to a sanitizer bypass.

A Null pointer dereference issue exists due to a missing NULL check in `PK11 SignWithSymKey` / `ssl3 ComputeRecordMACConstantTime`, which could let a remote malicious user cause a Denial of Service.

The issue concerns multiple vulnerabilities in the nss package of Debian GNU/Linux, which can be exploited remotely to disrupt the availability of protected information. The vulnerabilities in Mozilla Network Security Services (NSS) before version 3.15.2 are related to the failure to ensure that data structures are initialized before read operations. This can allow remote attackers to cause a denial of service or possibly have other unspecified impacts via vectors that trigger a decryption failure.

The issue allows remote attackers to cause a denial of service and possibly trigger memory corruption via certain vectors related to specific methods, including `nsTableFrame::GetFrameAtOrBefore`, `nsAccessibilityService::GetAccessible`, `nsBindingManager::GetNestedInsertionPoint`, `nsXBLPrototypeBinding::AttributeChanged`, `nsColumnSetFrame::GetContentInsertionFrame`, and `nsLineLayout::TrimTrailingWhiteSpaceIn`.