Plaintext of decrypted emails can leak through by user submitting an embedded form by pressing enter key within a text input field. This vulnerability affects Thunderbird < 52.9.

Plaintext of decrypted emails can leak through by user submitting an embedded form by pressing enter key within a text input field. This vulnerability affects Thunderbird < 52.9.

MozillaThunderbird-91.1.1-1.1 on GA media

Mozilla: Memory safety bugs fixed in Firefox 61, Firefox ESR 60.1, and Firefox ESR 52.9 Mozilla: Buffer overflow using computed size of canvas element Mozilla: Use-after-free using focus() Mozilla: Integer overflow in SSSE3 scaler Mozilla: Use-after-free when appending DOM nodes Mozilla: CSRF attacks through 307 redirects and NPAPI plugins Mozilla: Compromised IPC child process can list local filenames Mozilla: Invalid data handling during QCMS transformations thunderbird: S/MIME and PGP decryption oracles can be built with HTML emails thunderbird: S/MIME plaintext can be leaked through HTML reply/forward thunderbird: Using form to exfiltrate encrypted mail part by pressing enter in form field

Security update for Mozilla Thunderbird

Affected: Ubuntu:14.04:LTS: thunderbird, Ubuntu:16.04:LTS: thunderbird, Ubuntu:18.04:LTS: thunderbird

Plaintext of decrypted emails can leak through by user submitting an embedded form by pressing enter key within a text input field. This vulnerability affects Thunderbird < 52.9.