Insufficient UI Warning of Dangerous Operations in Mozilla Thunderbird - CVE-2021-4126

Vulnerability identifier: #VU59081

CSH Severity: Low

CVSS v4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-4126

CWE-ID: CWE-357

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform spoofing attacks.

The vulnerability exists in the way Thunderbird handles signed email messages. When receiving an OpenPGP/MIME signed email message that contains an additional outer MIME message layer, for example a message footer added by a mailing list gateway, Thunderbird only considered the inner signed message for the signature validity. This gave the false impression that the additional contents were also covered by the digital signature.

Mozilla Thunderbird
SUSE Linux Enterprise Workstation Extension
Ubuntu
thunderbird (Debian package)
MozillaThunderbird
MozillaThunderbird-debuginfo
MozillaThunderbird-debugsource
MozillaThunderbird-translations-common
MozillaThunderbird-translations-other
thunderbird (Ubuntu package)

Install updates from vendor's website.

Mozilla Thunderbird - update to 91.4.1
thunderbird (Debian package) - addressed in versions 1:91.4.1-1~deb10u1, 1:91.4.1-1~deb11u1
MozillaThunderbird - update to 91.4.1-8.48.1
MozillaThunderbird-debuginfo - update to 91.4.1-8.48.1
MozillaThunderbird-debugsource - update to 91.4.1-8.48.1
MozillaThunderbird-translations-common - update to 91.4.1-8.48.1
MozillaThunderbird-translations-other - update to 91.4.1-8.48.1
thunderbird (Ubuntu package) - addressed in versions 1:91.5.0+build1-0ubuntu0.18.04.1, 1:91.5.0+build1-0ubuntu0.20.04.1, 1:91.5.0+build1-0ubuntu0.21.10.1

• https://www.mozilla.org/en-US/security/advisories/mfsa2021-55/

• Multiple vulnerabilities in Mozilla Thunderbird
• Debian update for thunderbird
• SUSE update for MozillaThunderbird
• Ubuntu update for thunderbird
• Ubuntu update for thunderbird