CVE-2021-29969

Name of the Vulnerable Software and Affected Versions Thunderbird versions prior to 78.12

Description The issue is related to insufficient input validation in the Mozilla Thunderbird email client. It can be exploited by a remote attacker in a "man-in-the-middle" (MITM) scenario, allowing the execution of arbitrary code. Specifically, if Thunderbird is configured to use STARTTLS for an IMAP connection and an attacker injects IMAP server responses before the STARTTLS handshake is complete, Thunderbird may display incorrect information, such as non-existent folders on the IMAP server.

Recommendations For versions prior to 78.12, update to version 78.12 or later to resolve the issue. As a temporary workaround, consider disabling the use of STARTTLS for IMAP connections until a patch is applied. Restrict access to IMAP servers to minimize the risk of exploitation. Avoid using IMAP connections that do not complete the STARTTLS handshake.