{"schemaVersion":3,"id":"USN-5943-1","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"thunderbird vulnerabilities\n\nMultiple security issues were discovered in Thunderbird. If a user were\ntricked into opening a specially crafted website in a browsing context, an\nattacker could potentially exploit these to cause a denial of service,\nobtain sensitive information, bypass security restrictions, cross-site\ntracing, or execute arbitrary code. (CVE-2023-0616, CVE-2023-25735,\nCVE-2023-25737, CVE-2023-25739, CVE-2023-25729, CVE-2023-25742,\nCVE-2023-25746)\n\nJohan Carlsson discovered that Thunderbird did not properly implement CSP\npolicy on a header when using iframes. An attacker could potentially\nexploits this to exfiltrate data. (CVE-2023-25728)\n\nIrvan Kurniawan discovered that Thunderbird was not properly handling\nbackground fullscreen scripts when the window goes into fullscreen mode.\nAn attacker could possibly use this issue to spoof the user and obtain\nsensitive information. (CVE-2023-25730)\n\nChristian Holler discovered that Thunderbird did not properly check the\nSafe Bag attributes in PKCS 12 certificate bundle. An attacker could\npossibly use this issue to write to arbitrary memory by sending malicious\nPKCS 12 certificate. (CVE-2023-0767)\n\nRonald Crane discovered that Thunderbird did not properly check the size of\nthe input being encoded in xpcom. An attacker could possibly use this issue\nto perform out of bound memory write operations. (CVE-2023-25732)","dates":{"published":"2023-03-13T04:00:01.000Z","modified":"2026-04-22T10:33:50.325Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":null,"severity":"unknown","version":null,"versionLabel":null,"source":null,"vector":null,"computed":false,"selection":"none"},"metrics":[]},"epss":{"probability":null,"percentile":null,"severity":"unknown","asOf":null,"change":{"pp":null,"baselineDate":null,"baselineScore":null},"history":[],"last30":[]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[],"affected":[{"vendor":"ubuntu","product":"thunderbird","name":"thunderbird","label":"thunderbird","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/thunderbird","purlType":"deb","versions":[{"text":"< 1:102.8.0+build2-0ubuntu0.18.04.1","noFixRecorded":false,"fixedIn":null},{"text":"< 1:102.8.0+build2-0ubuntu0.20.04.1","noFixRecorded":false,"fixedIn":null},{"text":"< 1:102.8.0+build2-0ubuntu0.22.04.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1:102.8.0+build2-0ubuntu0.18.04.1 | < 1:102.8.0+build2-0ubuntu0.20.04.1 | < 1:102.8.0+build2-0ubuntu0.22.04.1","eol":null,"hubHref":null}],"affectedCount":1,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://ubuntu.com/security/notices/USN-5943-1","label":"ubuntu.com/security/notices/USN-5943-1","hostname":"ubuntu.com","tags":["Advisory"]},{"url":"https://ubuntu.com/security/CVE-2023-0616","label":"ubuntu.com/security/CVE-2023-0616","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2023-0767","label":"ubuntu.com/security/CVE-2023-0767","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2023-25728","label":"ubuntu.com/security/CVE-2023-25728","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2023-25729","label":"ubuntu.com/security/CVE-2023-25729","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2023-25730","label":"ubuntu.com/security/CVE-2023-25730","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2023-25732","label":"ubuntu.com/security/CVE-2023-25732","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2023-25735","label":"ubuntu.com/security/CVE-2023-25735","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2023-25737","label":"ubuntu.com/security/CVE-2023-25737","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2023-25739","label":"ubuntu.com/security/CVE-2023-25739","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2023-25742","label":"ubuntu.com/security/CVE-2023-25742","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2023-25746","label":"ubuntu.com/security/CVE-2023-25746","hostname":"ubuntu.com","tags":["REPORT"]}],"lineage":{"upstream":["CVE-2023-0616","CVE-2023-0767","CVE-2023-25728","CVE-2023-25729","CVE-2023-25730","CVE-2023-25732","CVE-2023-25735","CVE-2023-25737","CVE-2023-25739","CVE-2023-25742","CVE-2023-25746"],"downstream":[],"duplicates":[],"related":["CVE-2023-0616","CVE-2023-0767","CVE-2023-25728","CVE-2023-25729","CVE-2023-25730","CVE-2023-25732","CVE-2023-25735","CVE-2023-25737","CVE-2023-25739","CVE-2023-25742","CVE-2023-25746"]},"timeline":[{"kind":"published","date":"2023-03-13T04:00:01.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-04-22T10:33:50.325Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":0,"level":"minimal","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-19T21:49:53.601Z","stale":false,"partial":false}}