CVE-2021-29969

State: Published
Severity: Not scored
Published: Aug 5, 2021
Updated: Aug 3, 2024
Reserved: Apr 1, 2021

Description

If Thunderbird was configured to use STARTTLS for an IMAP connection, and an attacker injected IMAP server responses prior to the completion of the STARTTLS handshake, then Thunderbird didn't ignore the injected data. This could have resulted in Thunderbird showing incorrect information, for example the attacker could have tricked Thunderbird to show folders that didn't exist on the IMAP server. This vulnerability affects Thunderbird < 78.12.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
ThunderbirdMozilla	before 78.12Affected

References

https://www.mozilla.org/security/advisories/mfsa2021-30/
https://bugzilla.mozilla.org/show_bug.cgi?id=1682370
GLSA-202208-14vendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.