Magnus Melin

Name of the Vulnerable Software and Affected Versions: Thunderbird versions prior to 128.4.3 Thunderbird versions prior to 132.0.1 Description: The issue is related to the use of remote content in OpenPGP encrypted messages, which can lead to the disclosure of plaintext. This is due to insufficient protection of service data in the implementation of the OpenPGP email encryption standard in the Mozilla Thunderbird email client. An attacker can exploit this vulnerability to reveal protected information. Recommendations: For Thunderbird versions prior to 128.4.3, update to version 128.4.3 or later. For Thunderbird versions prior to 132.0.1, update to version 132.0.1 or later. As a temporary workaround, consider avoiding the use of remote content in OpenPGP encrypted messages until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Thunderbird versions prior to 68.10.0 **Description** The issue arises when an attacker intercepts Thunderbird's initial attempt to set up an account automatically using the Microsoft Exchange autodiscovery mechanism. If the attacker sends a crafted response, Thunderbird will send the `username` and `password` over https to a server controlled by the attacker. **Recommendations** For versions prior to 68.10.0, update to version 68.10.0 or later to resolve the issue. As a temporary workaround, consider disabling the autodiscovery mechanism for Microsoft Exchange until a patch is applied. Restrict access to sensitive information and avoid using automatic account setup features until the issue is resolved.