{"kind": "product", "path": "vulns/suse-linux-enterprise-workstation-extension-15-sp1/mozillathunderbird", "name": "mozillathunderbird", "product": "mozillathunderbird", "ecosystem": "SUSE:Linux Enterprise Workstation Extension 15 SP1", "items": [{"id": "SUSE-SU-2021:0245-1", "noindex": false, "published": "2021-01-29T09:13:49Z", "modified": "2026-02-04T02:22:26.860421Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/suse-su-2021:0245-1", "title": "Security update for MozillaThunderbird", "description": "This update for MozillaThunderbird fixes the following issues:\n\n- Mozilla Thunderbird was updated to 78.7.0 ESR  (MFSA 2021-05, bsc#1181414)\n  * CVE-2021-23953: Fixed a Cross-origin information leakage via redirected PDF requests\n  * CVE-2021-23954: Fixed a type confusion when using logical assignment operators in JavaScript switch statements\n  * CVE-2020-26976: Fixed an issue where HTTPS pages could have been intercepted by a registered service worker when they should not have been\n  * CVE-2021-23960: Fixed a use-after-poison for incorrectly redeclared JavaScript variables during GC\n  * CVE-2021-23964: Fixed Memory safety bugs\n  * CVE-2020-1", "references": ["https://www.suse.com/support/update/announcement/2021/suse-su-20210245-1/", "https://bugzilla.suse.com/1181414", "https://www.suse.com/security/cve/CVE-2020-15685"], "fixes": ["78.7.0-3.119.1"], "products": [{"name": "mozillathunderbird", "path": "vulns/suse-linux-enterprise-workstation-extension-15-sp1/mozillathunderbird", "ecosystem": "SUSE:Linux Enterprise Workstation Extension 15 SP1"}]}, {"id": "SUSE-SU-2021:0122-1", "noindex": false, "published": "2021-01-14T09:28:05Z", "modified": "2026-02-04T04:31:59.909588Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/suse-su-2021:0122-1", "title": "Security update for MozillaThunderbird", "description": "This update for MozillaThunderbird fixes the following issues:\n\n- Mozilla Thunderbird 78.6.1\n  * changed: MailExtensions: browserAction, composeAction, and\n    messageDisplayAction toolbar buttons now support label and\n    default_label properties (bmo#1583478)\n  * fixed: Running a quicksearch that returned no results did not\n    offer to re-run as a global search (bmo#1663153)\n  * fixed: Message search toolbar fixes (bmo#1681010)\n  * fixed: Very long subject lines distorted the message compose\n    and display windows, making them unusable (bmo#77806)\n  * fixed: Compose window: Recipient addresses that had not yet\n    been autocompleted were ", "references": ["https://www.suse.com/support/update/announcement/2021/suse-su-20210122-1/", "https://bugzilla.suse.com/1180623", "https://www.suse.com/security/cve/CVE-2020-16044"], "fixes": ["78.6.1-3.116.1"], "products": [{"name": "mozillathunderbird", "path": "vulns/suse-linux-enterprise-workstation-extension-15-sp1/mozillathunderbird", "ecosystem": "SUSE:Linux Enterprise Workstation Extension 15 SP1"}]}, {"id": "SUSE-SU-2020:3900-1", "noindex": false, "published": "2020-12-21T19:07:14Z", "modified": "2026-02-04T02:30:24.957896Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/suse-su-2020:3900-1", "title": "Security update for MozillaThunderbird", "description": "This update for MozillaThunderbird fixes the following issues:\n\n- Mozilla Thunderbird 78.6\n  * new: MailExtensions: Added\n    browser.windows.openDefaultBrowser() (bmo#1664708)\n  * changed: Thunderbird now only shows quota exceeded\n    indications on the main window (bmo#1671748)\n  * changed: MailExtensions: menus API enabled in messages being\n    composed (bmo#1670832)\n  * changed: MailExtensions: Honor allowScriptsToClose argument\n    in windows.create API function (bmo#1675940)\n  * changed: MailExtensions: APIs that returned an accountId will\n    reflect the account the message belongs to, not what is\n    stored in message headers (bmo#164", "references": ["https://www.suse.com/support/update/announcement/2020/suse-su-20203900-1/", "https://bugzilla.suse.com/1180039", "https://www.suse.com/security/cve/CVE-2020-16042"], "fixes": ["78.6.0-3.113.1"], "products": [{"name": "mozillathunderbird", "path": "vulns/suse-linux-enterprise-workstation-extension-15-sp1/mozillathunderbird", "ecosystem": "SUSE:Linux Enterprise Workstation Extension 15 SP1"}]}, {"id": "SUSE-SU-2020:3642-1", "noindex": false, "published": "2020-12-07T12:30:26Z", "modified": "2026-02-04T03:36:46.238841Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/suse-su-2020:3642-1", "title": "Security update for MozillaThunderbird", "description": "This update for MozillaThunderbird fixes the following issues:\n\n- Mozilla Thunderbird was updated to 78.5.1 (MFSA 2020-53, bsc#1179530)\n- CVE-2020-26970: Fixed a stack overflow due to incorrect parsing of SMTP server response codes.\n- Various bug fixes\n", "references": ["https://www.suse.com/support/update/announcement/2020/suse-su-20203642-1/", "https://bugzilla.suse.com/1179530", "https://www.suse.com/security/cve/CVE-2020-26970"], "fixes": ["78.5.1-3.110.2"], "products": [{"name": "mozillathunderbird", "path": "vulns/suse-linux-enterprise-workstation-extension-15-sp1/mozillathunderbird", "ecosystem": "SUSE:Linux Enterprise Workstation Extension 15 SP1"}]}, {"id": "SUSE-SU-2020:3528-1", "noindex": false, "published": "2020-11-26T10:52:39Z", "modified": "2026-02-04T03:58:16.762Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/suse-su-2020:3528-1", "title": "Security update for MozillaThunderbird", "description": "This update for MozillaThunderbird fixes the following issues:\n\n    TODO\n- Mozilla Thunderbird 78.5.0\n  * new: OpenPGP: Added option to disable attaching the public\n    key to a signed message (bmo#1654950)\n  * new: MailExtensions: 'compose_attachments' context added to\n    Menus API (bmo#1670822)\n  * new: MailExtensions: Menus API now available on displayed\n    messages (bmo#1670825)\n  * changed: MailExtensions: browser.tabs.create will now wait\n    for 'mail-delayed-startup-finished' event (bmo#1674407)\n  * fixed: OpenPGP: Support for inline PGP messages improved\n    (bmo#1672851)\n  * fixed: OpenPGP: Message security dialog showed unverifie", "references": ["https://www.suse.com/support/update/announcement/2020/suse-su-20203528-1/", "https://bugzilla.suse.com/1178894", "https://www.suse.com/security/cve/CVE-2020-15999"], "fixes": ["78.5.0-3.107.1"], "products": [{"name": "mozillathunderbird", "path": "vulns/suse-linux-enterprise-workstation-extension-15-sp1/mozillathunderbird", "ecosystem": "SUSE:Linux Enterprise Workstation Extension 15 SP1"}]}, {"id": "SUSE-SU-2020:3418-1", "noindex": false, "published": "2020-11-19T12:27:11Z", "modified": "2026-02-04T04:26:56.727541Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/suse-su-2020:3418-1", "title": "Security update for MozillaThunderbird", "description": "This update for MozillaThunderbird fixes the following issues:\n\n- Mozilla Thunderbird 78.4.2 \n  MFSA 2020-49 (bsc#1178611)\n  * CVE-2020-26950 (bmo#1675905)\n    Write side effects in MCallGetProperty opcode not accounted\n    for\n- Mozilla Thunderbird 78.4.1\n  * new: Thunderbird prompts for an address to use when starting\n    an email from an address book entry with multiple addresses\n    (bmo#84028)\n  * fixed: Searching global search results did not work\n    (bmo#1664761)\n  * fixed: Link location was not focused by default when adding a\n    hyperlink in message composer (bmo#1670660)\n  * fixed: Advanced address book search dialog was unusable\n", "references": ["https://www.suse.com/support/update/announcement/2020/suse-su-20203418-1/", "https://bugzilla.suse.com/1178611", "https://www.suse.com/security/cve/CVE-2020-26950"], "fixes": ["78.4.2-3.103.2"], "products": [{"name": "mozillathunderbird", "path": "vulns/suse-linux-enterprise-workstation-extension-15-sp1/mozillathunderbird", "ecosystem": "SUSE:Linux Enterprise Workstation Extension 15 SP1"}]}, {"id": "SUSE-SU-2020:3091-1", "noindex": false, "published": "2020-10-29T15:35:50Z", "modified": "2026-02-04T04:07:56.157777Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/suse-su-2020:3091-1", "title": "Security update for MozillaThunderbird and mozilla-nspr", "description": "This update for MozillaThunderbird and mozilla-nspr fixes the following issues:\n\n- Mozilla Thunderbird 78.4\n  * new: MailExtensions: browser.tabs.sendMessage API added\n  * new: MailExtensions: messageDisplayScripts API added\n  * changed: Yahoo and AOL mail users using password authentication will be migrated to OAuth2\n  * changed: MailExtensions: messageDisplay APIs extended to support multiple selected messages\n  * changed: MailExtensions: compose.begin functions now support creating a message with attachments\n  * fixed: Thunderbird could freeze when updating global search index\n  * fixed: Multiple issues with handling of self-signed SSL cer", "references": ["https://www.suse.com/support/update/announcement/2020/suse-su-20203091-1/", "https://bugzilla.suse.com/1174230", "https://bugzilla.suse.com/1176384"], "fixes": ["78.4.0-3.99.1"], "products": [{"name": "mozillathunderbird", "path": "vulns/suse-linux-enterprise-workstation-extension-15-sp1/mozillathunderbird", "ecosystem": "SUSE:Linux Enterprise Workstation Extension 15 SP1"}]}, {"id": "SUSE-SU-2020:2552-1", "noindex": false, "published": "2020-09-07T09:23:09Z", "modified": "2026-02-04T03:58:15.036550Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/suse-su-2020:2552-1", "title": "Security update for MozillaThunderbird", "description": "This update for MozillaThunderbird fixes the following issues:\n\n- Mozilla Thunderbird was updated to 68.12 (bsc#1175686)\n\n- CVE-2020-15663: Downgrade attack on the Mozilla Maintenance Service could\n  have resulted in escalation of privilege\n- CVE-2020-15664: Attacker-induced prompt for extension installation\n- CVE-2020-15669: Use-After-Free when aborting an operation\n", "references": ["https://www.suse.com/support/update/announcement/2020/suse-su-20202552-1/", "https://bugzilla.suse.com/1175686", "https://www.suse.com/security/cve/CVE-2020-15663"], "fixes": ["68.12.0-3.94.1"], "products": [{"name": "mozillathunderbird", "path": "vulns/suse-linux-enterprise-workstation-extension-15-sp1/mozillathunderbird", "ecosystem": "SUSE:Linux Enterprise Workstation Extension 15 SP1"}]}, {"id": "SUSE-SU-2020:2179-1", "noindex": false, "published": "2020-08-10T08:06:37Z", "modified": "2026-02-04T04:05:33.962556Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/suse-su-2020:2179-1", "title": "Security update for MozillaThunderbird", "description": "This update for MozillaThunderbird fixes the following issues:\n\n- Updated to Mozilla Thunderbird 68.11:\n  * Fixed various security issues (MFSA-2020-35, bsc#1174538).\n  * Fixed CVE-2020-15652: Potential leak of redirect targets when loading scripts in a worker (bsc#1174538).\n  * Fixed CVE-2020-6514: WebRTC data channel leaks internal address to peer (bsc#1174538).\n  * Fixed CVE-2020-6463: Use-after-free in ANGLE gl::Texture::onUnbindAsSamplerTexture (bsc#1174538).\n  * Fixed CVE-2020-15659: Memory safety bugs fixed in Thunderbird 68.11 (bsc#1174538).\n  * Fixed a bug with FileLink attachments included as a link and file when added from a networ", "references": ["https://www.suse.com/support/update/announcement/2020/suse-su-20202179-1/", "https://bugzilla.suse.com/1174538", "https://www.suse.com/security/cve/CVE-2020-15652"], "fixes": ["68.11.0-3.91.1"], "products": [{"name": "mozillathunderbird", "path": "vulns/suse-linux-enterprise-workstation-extension-15-sp1/mozillathunderbird", "ecosystem": "SUSE:Linux Enterprise Workstation Extension 15 SP1"}]}, {"id": "SUSE-SU-2020:1900-1", "noindex": false, "published": "2020-07-13T13:07:40Z", "modified": "2026-02-04T02:55:06.742629Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/suse-su-2020:1900-1", "title": "Security update for MozillaThunderbird", "description": "This update for MozillaThunderbird to version 68.10.0 ESR fixes the following issues:\n\n- CVE-2020-12417: Memory corruption due to missing sign-extension for ValueTags on ARM64 (bsc#1173576).\n- CVE-2020-12418: Information disclosure due to manipulated URL object (bsc#1173576).\n- CVE-2020-12419: Use-after-free in nsGlobalWindowInner (bsc#1173576).\n- CVE-2020-12420: Use-After-Free when trying to connect to a STUN server (bsc#1173576).\n- CVE-2020-12421: Add-On updates did not respect the same certificate trust rules as software updates (bsc#1173576).\n", "references": ["https://www.suse.com/support/update/announcement/2020/suse-su-20201900-1/", "https://bugzilla.suse.com/1173576", "https://www.suse.com/security/cve/CVE-2020-12417"], "fixes": ["68.10.0-3.88.1"], "products": [{"name": "mozillathunderbird", "path": "vulns/suse-linux-enterprise-workstation-extension-15-sp1/mozillathunderbird", "ecosystem": "SUSE:Linux Enterprise Workstation Extension 15 SP1"}]}, {"id": "SUSE-SU-2020:1591-1", "noindex": false, "published": "2020-06-10T08:08:57Z", "modified": "2026-02-04T03:20:21.649855Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/suse-su-2020:1591-1", "title": "Security update for MozillaThunderbird", "description": "This update for MozillaThunderbird fixes the following issues:\n\nMozilla Thunderbird 68.9.0 (bsc#1172402)\n\n- CVE-2020-12405: Fixed a use-after-free in SharedWorkerService.\n- CVE-2020-12406: Fixed a JavaScript Type confusion with NativeTypes.\n- CVE-2020-12410: Fixed multiple memory safety issues\n- CVE-2020-12398: Fixed a potential information leak due to security downgrade \n  with IMAP STARTTLS\n- Use a symbolic icon from branding internals\n", "references": ["https://www.suse.com/support/update/announcement/2020/suse-su-20201591-1/", "https://bugzilla.suse.com/1172402", "https://www.suse.com/security/cve/CVE-2020-12398"], "fixes": ["68.9.0-3.85.2"], "products": [{"name": "mozillathunderbird", "path": "vulns/suse-linux-enterprise-workstation-extension-15-sp1/mozillathunderbird", "ecosystem": "SUSE:Linux Enterprise Workstation Extension 15 SP1"}]}, {"id": "SUSE-SU-2020:1225-1", "noindex": false, "published": "2020-05-08T08:48:22Z", "modified": "2026-02-04T02:37:06.551375Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/suse-su-2020:1225-1", "title": "Security update for MozillaThunderbird", "description": "This update for MozillaThunderbird fixes the following issues:\n- Update to 68.8.0 ESR\n  MFSA 2020-18 (bsc#1171186)\n  * CVE-2020-12397 (bmo#1617370)\n    Sender Email Address Spoofing using encoded Unicode\n    characters\n  * CVE-2020-12387 (bmo#1545345)\n    Use-after-free during worker shutdown\n  * CVE-2020-6831 (bmo#1632241)\n    Buffer overflow in SCTP chunk input validation\n  * CVE-2020-12392 (bmo#1614468)\n    Arbitrary local file access with 'Copy as cURL'\n  * CVE-2020-12393 (bmo#1615471)\n    Devtools' 'Copy as cURL' feature did not fully escape\n    website-controlled data, potentially leading to command\n    injection\n  * CVE-2020-12395 (bmo", "references": ["https://www.suse.com/support/update/announcement/2020/suse-su-20201225-1/", "https://bugzilla.suse.com/1171186", "https://www.suse.com/security/cve/CVE-2020-12387"], "fixes": ["68.8.0-3.80.2"], "products": [{"name": "mozillathunderbird", "path": "vulns/suse-linux-enterprise-workstation-extension-15-sp1/mozillathunderbird", "ecosystem": "SUSE:Linux Enterprise Workstation Extension 15 SP1"}]}, {"id": "SUSE-SU-2020:1027-1", "noindex": false, "published": "2020-04-17T15:48:02Z", "modified": "2026-02-04T02:59:57.868670Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/suse-su-2020:1027-1", "title": "Security update for MozillaThunderbird", "description": "This update for MozillaThunderbird to version 68.7.0 fixes the following issues:\n\n- CVE-2020-6819: Use-after-free while running the nsDocShell destructor (boo#1168630)\n- CVE-2020-6820: Use-after-free when handling a ReadableStream (boo#1168630)\n- CVE-2020-6821: Uninitialized memory could be read when using the WebGL copyTexSubImage() (boo#1168874)\n- CVE-2020-6822: Out of bounds write in GMPDecodeData when processing large images (boo#1168874)\n- CVE-2020-6825: Memory safety bugs fixed (boo#1168874)\n", "references": ["https://www.suse.com/support/update/announcement/2020/suse-su-20201027-1/", "https://bugzilla.suse.com/1168630", "https://bugzilla.suse.com/1168874"], "fixes": ["68.7.0-3.77.1"], "products": [{"name": "mozillathunderbird", "path": "vulns/suse-linux-enterprise-workstation-extension-15-sp1/mozillathunderbird", "ecosystem": "SUSE:Linux Enterprise Workstation Extension 15 SP1"}]}, {"id": "SUSE-SU-2020:0721-1", "noindex": false, "published": "2020-03-19T10:12:56Z", "modified": "2026-02-04T03:40:05.489940Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/suse-su-2020:0721-1", "title": "Security update for MozillaThunderbird", "description": "This update for MozillaThunderbird fixes the following issues:\n\nMozillaThunderbird was updated to 68.6.0 ESR (MFSA 2020-10 bsc#1166238)\n\n- CVE-2020-6805: Fixed a use-after-free when removing data about origins\n- CVE-2020-6806: Fixed improper protections against state confusion\n- CVE-2020-6807: Fixed a use-after-free in cubeb during stream destruction \n- CVE-2020-6811: Fixed an issue where copy as cURL' feature did not fully \n  escape website-controlled data potentially leading to command injection \n- CVE-2019-20503: Fixed out of bounds reads in sctp_load_addresses_from_init\n- CVE-2020-6812: Fixed an issue where the names of AirPods with perso", "references": ["https://www.suse.com/support/update/announcement/2020/suse-su-20200721-1/", "https://bugzilla.suse.com/1166238", "https://www.suse.com/security/cve/CVE-2019-20503"], "fixes": ["68.6.0-3.74.1"], "products": [{"name": "mozillathunderbird", "path": "vulns/suse-linux-enterprise-workstation-extension-15-sp1/mozillathunderbird", "ecosystem": "SUSE:Linux Enterprise Workstation Extension 15 SP1"}]}, {"id": "SUSE-SU-2020:0385-1", "noindex": false, "published": "2020-02-17T07:54:20Z", "modified": "2026-02-04T03:10:12.412847Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/suse-su-2020:0385-1", "title": "Security update for MozillaThunderbird", "description": "This update for MozillaThunderbird fixes the following issues:\n\n- Mozilla Thunderbird 68.5 (bsc#1162777)\n  MFSA 2020-07 (bsc#1163368)\n  * CVE-2020-6793 (bmo#1608539)\n    Out-of-bounds read when processing certain email messages\n  * CVE-2020-6794 (bmo#1606619)\n    Setting a master password post-Thunderbird 52 does not delete\n    unencrypted previously stored passwords\n  * CVE-2020-6795 (bmo#1611105)\n    Crash processing S/MIME messages with multiple signatures\n  * CVE-2020-6797 (bmo#1596668)\n    Extensions granted downloads.open permission could open\n    arbitrary applications on Mac OSX\n  * CVE-2020-6798 (bmo#1602944)\n    Incorrect parsing of", "references": ["https://www.suse.com/support/update/announcement/2020/suse-su-20200385-1/", "https://bugzilla.suse.com/1162777", "https://bugzilla.suse.com/1163368"], "fixes": ["68.5.0-3.71.1"], "products": [{"name": "mozillathunderbird", "path": "vulns/suse-linux-enterprise-workstation-extension-15-sp1/mozillathunderbird", "ecosystem": "SUSE:Linux Enterprise Workstation Extension 15 SP1"}]}, {"id": "SUSE-SU-2020:0142-1", "noindex": false, "published": "2020-01-20T14:31:35Z", "modified": "2026-02-04T02:20:44.550076Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/suse-su-2020:0142-1", "title": "Security update for MozillaThunderbird", "description": "This update for MozillaThunderbird to version 68.4.1 fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2019-17026: IonMonkey type confusion with StoreElementHole and FallibleStoreElement\n- CVE-2019-17016: Bypass of @namespace CSS sanitization during pasting\n- CVE-2019-17017: Type Confusion in XPCVariant.cpp\n- CVE-2019-17022: CSS sanitization does not escape HTML tags\n- CVE-2019-17024: multiple Memory safety bugs fixed\n\nNon-security issues fixed:\n\n- Various improvements when setting up an account for a Microsoft Exchange \n  server. For example better detection for Office 365 accounts.\n", "references": ["https://www.suse.com/support/update/announcement/2020/suse-su-20200142-1/", "https://bugzilla.suse.com/1160305", "https://bugzilla.suse.com/1160498"], "fixes": ["68.4.1-3.66.1"], "products": [{"name": "mozillathunderbird", "path": "vulns/suse-linux-enterprise-workstation-extension-15-sp1/mozillathunderbird", "ecosystem": "SUSE:Linux Enterprise Workstation Extension 15 SP1"}]}, {"id": "SUSE-SU-2019:3339-1", "noindex": false, "published": "2019-12-18T17:18:32Z", "modified": "2026-02-04T03:13:54.813470Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/suse-su-2019:3339-1", "title": "Security update for MozillaThunderbird", "description": "This update for MozillaThunderbird fixes the following issues:\n\nMozilla Thunderbird was updated to 68.3esr (MFSA 2019-38 bsc#1158328) \t  \n\nSecurity issues fixed: \n\n- CVE-2019-17008: Fixed a use-after-free in worker destruction (bmo#1546331)\n- CVE-2019-13722: Fixed a stack corruption due to incorrect number of arguments \n  in WebRTC code (bmo#1580156)\n- CVE-2019-11745: Fixed an out of bounds write in NSS when encrypting with a \n  block cipher (bmo#1586176)\n- CVE-2019-17009: Fixed an issue where updater temporary files accessible to \n  unprivileged processes (bmo#1510494)\n- CVE-2019-17010: Fixed a use-after-free when performing device orientati", "references": ["https://www.suse.com/support/update/announcement/2019/suse-su-20193339-1/", "https://bugzilla.suse.com/1158328", "https://www.suse.com/security/cve/CVE-2019-11745"], "fixes": ["68.3.0-3.61.2"], "products": [{"name": "mozillathunderbird", "path": "vulns/suse-linux-enterprise-workstation-extension-15-sp1/mozillathunderbird", "ecosystem": "SUSE:Linux Enterprise Workstation Extension 15 SP1"}]}, {"id": "SUSE-SU-2019:2912-1", "noindex": false, "published": "2019-11-07T10:31:34Z", "modified": "2026-02-04T04:39:26.458432Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/suse-su-2019:2912-1", "title": "Recommended update for MozillaThunderbird", "description": "This update for MozillaThunderbird to version 68.2.1 provides the following fixes:\n\n- Security issues fixed (bsc#1154738):\n  * CVE-2019-15903: Fixed a heap overflow in the expat library (bsc#1149429).\n  * CVE-2019-11757: Fixed a use-after-free when creating index updates in IndexedDB (bsc#1154738).\n  * CVE-2019-11758: Fixed a potentially exploitable crash due to 360 Total Security (bsc#1154738).\n  * CVE-2019-11759: Fixed a stack buffer overflow in HKDF output (bsc#1154738).\n  * CVE-2019-11760: Fixed a stack buffer overflow in WebRTC networking (bsc#1154738).\n  * CVE-2019-11761: Fixed an unintended access to a privileged JSONView object (bsc#1", "references": ["https://www.suse.com/support/update/announcement/2019/suse-su-20192912-1/", "https://bugzilla.suse.com/1149126", "https://bugzilla.suse.com/1149429"], "fixes": ["68.2.1-3.58.1"], "products": [{"name": "mozillathunderbird", "path": "vulns/suse-linux-enterprise-workstation-extension-15-sp1/mozillathunderbird", "ecosystem": "SUSE:Linux Enterprise Workstation Extension 15 SP1"}]}, {"id": "SUSE-SU-2019:2515-1", "noindex": false, "published": "2019-10-02T08:48:54Z", "modified": "2026-02-04T02:16:06.273767Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/suse-su-2019:2515-1", "title": "Security update for MozillaThunderbird", "description": "This update for MozillaThunderbird to version 68.1.1 fixes the following issues:\n  \n- CVE-2019-11709: Fixed several memory safety bugs. (bsc#1140868)\n- CVE-2019-11710: Fixed several memory safety bugs. (bsc#1140868)\n- CVE-2019-11711: Fixed a script injection within domain through inner window reuse. (bsc#1140868)\n- CVE-2019-11712: Fixed an insufficient validation of cross-origin POST requests within NPAPI plugins. (bsc#1140868)\n- CVE-2019-11713: Fixed a use-after-free with HTTP/2 cached stream. (bsc#1140868)\n- CVE-2019-11714: Fixed a crash in NeckoChild. (bsc#1140868)\n- CVE-2019-11715: Fixed an HTML parsing error that can contribute to conten", "references": ["https://www.suse.com/support/update/announcement/2019/suse-su-20192515-1/", "https://bugzilla.suse.com/1140868", "https://bugzilla.suse.com/1141322"], "fixes": ["68.1.1-3.51.1"], "products": [{"name": "mozillathunderbird", "path": "vulns/suse-linux-enterprise-workstation-extension-15-sp1/mozillathunderbird", "ecosystem": "SUSE:Linux Enterprise Workstation Extension 15 SP1"}]}, {"id": "SUSE-SU-2019:1960-1", "noindex": false, "published": "2019-07-24T08:32:08Z", "modified": "2026-02-04T03:33:51.391659Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/suse-su-2019:1960-1", "title": "Security update for MozillaThunderbird", "description": "This update for MozillaThunderbird version 60.8 fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2019-9811: Sandbox escape via installation of malicious language pack (bsc#1140868).\n- CVE-2019-11711: Script injection within domain through inner window reuse (bsc#1140868).\n- CVE-2019-11712: Cross-origin POST requests can be made with NPAPI plugins by following 308 redirects (bsc#1140868).\n- CVE-2019-11713: Use-after-free with HTTP/2 cached stream (bsc#1140868).\n- CVE-2019-11729: Empty or malformed p256-ECDH public keys may trigger a segmentation fault (bsc#1140868).\n- CVE-2019-11715: HTML parsing error can contribute to content XSS (", "references": ["https://www.suse.com/support/update/announcement/2019/suse-su-20191960-1/", "https://bugzilla.suse.com/1140868", "https://www.suse.com/security/cve/CVE-2019-11709"], "fixes": ["60.8.0-3.46.2"], "products": [{"name": "mozillathunderbird", "path": "vulns/suse-linux-enterprise-workstation-extension-15-sp1/mozillathunderbird", "ecosystem": "SUSE:Linux Enterprise Workstation Extension 15 SP1"}]}], "total": 23, "unknown_count": 0, "release_unconfirmed": false, "page": 1, "pages": 2, "filtered": false, "noindex": false, "filters": {}, "page_size": 20, "products": [{"name": "mozillathunderbird", "path": "vulns/suse-linux-enterprise-workstation-extension-15-sp1/mozillathunderbird", "ecosystem": "SUSE:Linux Enterprise Workstation Extension 15 SP1"}], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}, {"name": "php", "path": "vulns/stack/php", "slug": "php"}, {"name": "python", "path": "vulns/stack/python", "slug": "python"}, {"name": "node", "path": "vulns/stack/node", "slug": "node"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "versions": [], "stats": {"recent": 0, "kev": 0}, "lastmod": "2026-02-04T04:39:26.458432Z", "early_advisories": [], "license": "You may freely use the PatchFirst selection and our additions (priorities, early warnings, texts, summaries and aggregates) for your own purposes, including internal business use. Resale, commercial distribution and bulk mirroring of this selection or these additions require a written agreement with the operator. Whenever you use or publish the selection or our additions, credit PatchFirst (https://patchfirst.dev/vulns/) with this link to the regional feed page. Original records from open sources remain subject to their respective licenses and terms. These conditions do not restrict your rights to the original data, which you can obtain directly from those sources.", "terms_url": "https://patchfirst.dev/vulns/#feed-terms", "attribution": {"name": "PatchFirst", "url": "https://patchfirst.dev/vulns/"}, "source_changes": "Records are selected, normalized and combined by PatchFirst; summaries and translations may be added. News is credited with a link to the original source in each entry.", "sources": [{"id": "cve", "name": "CVE List / CVE.org", "url": "https://www.cve.org/", "license": "CVE Terms of Use", "terms_url": "https://www.cve.org/Legal/TermsOfUse", "notice": "Copyright © 1999–2021, The MITRE Corporation. LICENSE Submissions : For all materials you submit to the Common Vulnerabilities and Exposures (CVE™), you hereby grant to The MITRE Corporation (MITRE) and all CVE Numbering Authorities (CNAs) a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute such materials and derivative works. Unless required by applicable law or agreed to in writing, you provide such materials on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. CVE Usage : MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. DISCLAIMERS ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE."}, {"id": "osv", "name": "OSV", "url": "https://osv.dev/", "terms_url": "https://google.github.io/osv.dev/data/", "terms": "Upstream licenses vary; see the source catalog."}, {"id": "kev", "name": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "license": "CC0-1.0", "terms_url": "https://github.com/cisagov/kev-data/blob/develop/LICENSE"}, {"id": "epss", "name": "FIRST EPSS", "url": "https://www.first.org/epss/", "terms_url": "https://www.first.org/epss/faq", "terms": "Free public scores; attribution requested (FIRST EPSS, scores generated by Empirical Security)."}, {"id": "github-advisory", "name": "GitHub Advisory Database", "url": "https://github.com/advisories", "license": "CC-BY-4.0", "terms_url": "https://github.com/github/advisory-database/blob/main/LICENSE.md"}, {"id": "exploitdb", "name": "Exploit-DB", "url": "https://www.exploit-db.com/", "license": "GPL-2.0", "terms_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/LICENSE.md"}, {"id": "metasploit", "name": "Metasploit", "url": "https://github.com/rapid7/metasploit-framework", "license": "BSD-3-Clause", "terms_url": "https://github.com/rapid7/metasploit-framework/blob/master/LICENSE", "notice": "Copyright (c) 2006-2026, Rapid7, Inc.\nLicense: BSD-3-clause\n Redistribution and use in source and binary forms, with or without modification,\n are permitted provided that the following conditions are met:\n .\n * Redistributions of source code must retain the above copyright notice,\n this list of conditions and the following disclaimer.\n .\n * Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n .\n * Neither the name of Rapid7, Inc. nor the names of its contributors\n may be used to endorse or promote products derived from this software\n without specific prior written permission.\n .\n THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\n ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\n WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\n DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\n ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\n LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\n ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\n SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."}, {"id": "nuclei", "name": "Nuclei Templates", "url": "https://github.com/projectdiscovery/nuclei-templates", "license": "MIT", "terms_url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/LICENSE.md", "notice": "MIT License\n\nCopyright (c) 2025 ProjectDiscovery, Inc.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE."}, {"id": "linux-kernel", "name": "Linux kernel releases", "url": "https://www.kernel.org/", "license": "CC-BY-SA-4.0", "terms_url": "https://www.kernel.org/legal.html", "notice": "Copyright (C) 1997-2014 by The Linux Kernel Organization, Inc."}]}