{"schemaVersion":3,"id":"OPENSUSE-SU-2021:4150-1","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"Security update for MozillaThunderbird\n\nThis update for MozillaThunderbird fixes the following issues:\n\n- Update to version 91.4 MFSA 2021-54 (bsc#1193485)\n- CVE-2021-43536: URL leakage when navigating while executing asynchronous function\n- CVE-2021-43537: Heap buffer overflow when using structured clone\n- CVE-2021-43538: Missing fullscreen and pointer lock notification when requesting both\n- CVE-2021-43539: GC rooting failure when calling wasm instance methods\n- CVE-2021-43541: External protocol handler parameters were unescaped\n- CVE-2021-43542: XMLHttpRequest error codes could have leaked the existence of an external protocol handler\n- CVE-2021-43543: Bypass of CSP sandbox directive when embedding\n- CVE-2021-43545: Denial of Service when using the Location API in a loop\n- CVE-2021-43546: Cursor spoofing could overlay user interface when native cursor is zoomed\n- CVE-2021-43528: JavaScript unexpectedly enabled for the composition area\n\n- Update to version 91.3.2\n- CVE-2021-40529: Fixed ElGamal implementation could allow plaintext recovery (bsc#1190244)\n\n- Update to version 91.3 MFSA 2021-50 (bsc#1192250)\n- CVE-2021-38503: Fixed iframe sandbox rules did not apply to XSLT stylesheets\n- CVE-2021-38504: Fixed use-after-free in file picker dialog\n- CVE-2021-38505: Fixed Windows 10 Cloud Clipboard may have recorded sensitive user data\n- CVE-2021-38506: Fixed Thunderbird could be coaxed into going into fullscreen mode without notification or warning\n- CVE-2021-38507: Fixed opportunistic Encryption in HTTP2 could be used to bypass the Same-Origin-Policy on services hosted on other ports\n- CVE-2021-38508: Fixed permission Prompt could be overlaid, resulting in user confusion and potential spoofing\n- CVE-2021-38509: Fixed Javascript alert box could have been spoofed onto an arbitrary domain\n- CVE-2021-38510: Fixed Download Protections were bypassed by .inetloc files on Mac OS\n- Fixed plain text reformatting regression (bsc#1182863)\n\n- Update to version 91.2 MFSA 2021-47 (bsc#1191332)\n- CVE-2021-29981: Live range splitting could have led to conflicting assignments in the JIT\n- CVE-2021-29982: Single bit data leak due to incorrect JIT optimization and type confusion\n- CVE-2021-29987: Users could have been tricked into accepting unwanted permissions on Linux\n- CVE-2021-32810: Data race in crossbeam-deque\n- CVE-2021-38493: Memory safety bugs fixed in Thunderbird 78.14 and Thunderbird 91.1\n- CVE-2021-38496: Use-after-free in MessageTask\n- CVE-2021-38497: Validation message could have been overlaid on another origin\n- CVE-2021-38498: Use-after-free of nsLanguageAtomService object\n- CVE-2021-38500: Memory safety bugs fixed in Thunderbird 91.2\n- CVE-2021-38501: Memory safety bugs fixed in Thunderbird 91.2\n- CVE-2021-38502: Downgrade attack on SMTP STARTTLS connections\n\n- Update to version 91.1.0 MFSA 2021-41 (bsc#1190269)\n- CVE-2021-38492: Navigating to `mk:` URL scheme could load Internet Explorer\n- CVE-2021-38495: Memory safety bugs fixed in Thunderbird 91.1\n\n- Update to version 91.0.1 MFSA 2021-37 (bsc#1189547)\n- CVE-2021-29991: Header Splitting possible with HTTP/3 Responses","dates":{"published":"2021-12-22T09:58:05.000Z","modified":"2026-02-04T03:41:09.329Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":null,"severity":"unknown","version":null,"versionLabel":null,"source":null,"vector":null,"computed":false,"selection":"none"},"metrics":[]},"epss":{"probability":null,"percentile":null,"severity":"unknown","asOf":null,"change":{"pp":null,"baselineDate":null,"baselineScore":null},"history":[],"last30":[]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[],"affected":[{"vendor":"opensuse","product":"MozillaThunderbird&distro=openSUSE Leap 15.3","name":"MozillaThunderbird","label":"MozillaThunderbird&distro=openSUSE Leap 15.3","ecosystem":"openSUSE","cpePart":null,"purl":"pkg:rpm/opensuse/MozillaThunderbird&distro=openSUSE Leap 15.3","purlType":"rpm","versions":[{"text":"< 91.4.0-8.45.2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 91.4.0-8.45.2","eol":null,"hubHref":null}],"affectedCount":1,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/OQOGFW6JISWI3PQR7AHD3OEX3SPELMFB/","label":"lists.opensuse.org/archives/…","hostname":"lists.opensuse.org","tags":["Advisory"]},{"url":"https://bugzilla.suse.com/1182863","label":"bugzilla.suse.com/1182863","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1189547","label":"bugzilla.suse.com/1189547","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1190244","label":"bugzilla.suse.com/1190244","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1190269","label":"bugzilla.suse.com/1190269","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1191332","label":"bugzilla.suse.com/1191332","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1192250","label":"bugzilla.suse.com/1192250","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1193485","label":"bugzilla.suse.com/1193485","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://www.suse.com/security/cve/CVE-2021-29981","label":"www.suse.com/security/cve/CVE-2021-29981","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2021-29982","label":"www.suse.com/security/cve/CVE-2021-29982","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2021-29987","label":"www.suse.com/security/cve/CVE-2021-29987","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2021-29991","label":"www.suse.com/security/cve/CVE-2021-29991","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2021-32810","label":"www.suse.com/security/cve/CVE-2021-32810","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2021-38492","label":"www.suse.com/security/cve/CVE-2021-38492","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2021-38493","label":"www.suse.com/security/cve/CVE-2021-38493","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2021-38495","label":"www.suse.com/security/cve/CVE-2021-38495","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2021-38496","label":"www.suse.com/security/cve/CVE-2021-38496","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2021-38497","label":"www.suse.com/security/cve/CVE-2021-38497","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2021-38498","label":"www.suse.com/security/cve/CVE-2021-38498","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2021-38500","label":"www.suse.com/security/cve/CVE-2021-38500","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2021-38501","label":"www.suse.com/security/cve/CVE-2021-38501","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2021-38502","label":"www.suse.com/security/cve/CVE-2021-38502","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2021-38503","label":"www.suse.com/security/cve/CVE-2021-38503","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2021-38504","label":"www.suse.com/security/cve/CVE-2021-38504","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2021-38505","label":"www.suse.com/security/cve/CVE-2021-38505","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2021-38506","label":"www.suse.com/security/cve/CVE-2021-38506","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2021-38507","label":"www.suse.com/security/cve/CVE-2021-38507","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2021-38508","label":"www.suse.com/security/cve/CVE-2021-38508","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2021-38509","label":"www.suse.com/security/cve/CVE-2021-38509","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2021-38510","label":"www.suse.com/security/cve/CVE-2021-38510","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2021-40529","label":"www.suse.com/security/cve/CVE-2021-40529","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2021-43528","label":"www.suse.com/security/cve/CVE-2021-43528","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2021-43536","label":"www.suse.com/security/cve/CVE-2021-43536","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2021-43537","label":"www.suse.com/security/cve/CVE-2021-43537","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2021-43538","label":"www.suse.com/security/cve/CVE-2021-43538","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2021-43539","label":"www.suse.com/security/cve/CVE-2021-43539","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2021-43541","label":"www.suse.com/security/cve/CVE-2021-43541","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2021-43542","label":"www.suse.com/security/cve/CVE-2021-43542","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2021-43543","label":"www.suse.com/security/cve/CVE-2021-43543","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2021-43545","label":"www.suse.com/security/cve/CVE-2021-43545","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2021-43546","label":"www.suse.com/security/cve/CVE-2021-43546","hostname":"www.suse.com","tags":["WEB"]}],"lineage":{"upstream":["CVE-2021-29981","CVE-2021-29982","CVE-2021-29987","CVE-2021-29991","CVE-2021-32810","CVE-2021-38492","CVE-2021-38493","CVE-2021-38495","CVE-2021-38496","CVE-2021-38497","CVE-2021-38498","CVE-2021-38500","CVE-2021-38501","CVE-2021-38502","CVE-2021-38503","CVE-2021-38504","CVE-2021-38505","CVE-2021-38506","CVE-2021-38507","CVE-2021-38508","CVE-2021-38509","CVE-2021-38510","CVE-2021-40529","CVE-2021-43528","CVE-2021-43536","CVE-2021-43537","CVE-2021-43538","CVE-2021-43539","CVE-2021-43541","CVE-2021-43542","CVE-2021-43543","CVE-2021-43545","CVE-2021-43546"],"downstream":[],"duplicates":[],"related":["CVE-2021-29981","CVE-2021-29982","CVE-2021-29987","CVE-2021-29991","CVE-2021-32810","CVE-2021-38492","CVE-2021-38493","CVE-2021-38495","CVE-2021-38496","CVE-2021-38497","CVE-2021-38498","CVE-2021-38500","CVE-2021-38501","CVE-2021-38502","CVE-2021-38503","CVE-2021-38504","CVE-2021-38505","CVE-2021-38506","CVE-2021-38507","CVE-2021-38508","CVE-2021-38509","CVE-2021-38510","CVE-2021-40529","CVE-2021-43528","CVE-2021-43536","CVE-2021-43537","CVE-2021-43538","CVE-2021-43539","CVE-2021-43541","CVE-2021-43542","CVE-2021-43543","CVE-2021-43545","CVE-2021-43546"]},"timeline":[{"kind":"published","date":"2021-12-22T09:58:05.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-02-04T03:41:09.329Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":0,"level":"minimal","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-22T08:57:12.082Z","stale":false,"partial":false}}