kritisch
CVE-2021-43529
thunderbird: Memory corruption when processing S/MIME messages
In der Trivy Database seit spätestens 24. Okt. 2026, 07:11 UTCWann der Eintrag vor diesem Build hinzukam, ist nicht erfasst.
Einstufung nach Quelle
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Trivys eigenes Label ist CRITICAL. Kritisch laut NVD, Red Hat. Niedriger laut Amazon (hoch), Rocky Linux (hoch), Ubuntu (mittel).
Beschreibung
Thunderbird versions prior to 91.3.0 are vulnerable to the heap overflow described in CVE-2021-43527 when processing S/MIME messages. Thunderbird versions 91.3.0 and later will not call the vulnerable code when processing S/MIME messages that contain certificates with DER-encoded DSA or RSA-PSS signatures.
Betroffene Pakete und behobene Versionen
| Quelle | Paket | Behoben in |
|---|---|---|
| Red Hat | thunderbird | kein Fix angegeben |
| amazon linux 2 | thunderbird, thunderbird-debuginfo | 91.6.0-1.amzn2.0.1 |
| debian 10 | thunderbird | 1:91.4.1-1~deb10u1 |
| debian 11 | thunderbird | 1:91.4.1-1~deb11u1 |
| debian 12 | thunderbird | 1:91.3.0-1 |
| debian 13 | thunderbird | 1:91.3.0-1 |
| debian 14 | thunderbird | 1:91.3.0-1 |
| debian 9 | thunderbird | 1:91.4.1-1~deb9u1 |
| echo | thunderbird | 1:91.3.0-1 |
| rocky 8 | thunderbird | 91.3.0-2.el8 |
| ubuntu 18.04 | thunderbird | 1:91.5.0+build1-0ubuntu0.18.04.1 |
| ubuntu 20.04 | thunderbird | 1:91.5.0+build1-0ubuntu0.20.04.1 |
Alle 13 Einträge aus 12 Quellen zeigen
| Quelle | Paket | Behoben in |
|---|---|---|
| Red Hat | thunderbird | kein Fix angegeben |
| amazon linux 2 | thunderbird | 91.6.0-1.amzn2.0.1 |
| amazon linux 2 | thunderbird-debuginfo | 91.6.0-1.amzn2.0.1 |
| debian 10 | thunderbird | 1:91.4.1-1~deb10u1 |
| debian 11 | thunderbird | 1:91.4.1-1~deb11u1 |
| debian 12 | thunderbird | 1:91.3.0-1 |
| debian 13 | thunderbird | 1:91.3.0-1 |
| debian 14 | thunderbird | 1:91.3.0-1 |
| debian 9 | thunderbird | 1:91.4.1-1~deb9u1 |
| echo | thunderbird | 1:91.3.0-1 |
| rocky 8 | thunderbird | 91.3.0-2.el8 |
| ubuntu 18.04 | thunderbird | 1:91.5.0+build1-0ubuntu0.18.04.1 |
| ubuntu 20.04 | thunderbird | 1:91.5.0+build1-0ubuntu0.20.04.1 |
Referenzen
- https://access.redhat.com/errata/RHSA-2021:4130
- https://access.redhat.com/security/cve/CVE-2021-43527
- https://access.redhat.com/security/cve/CVE-2021-43529
- https://access.redhat.com/security/vulnerabilities/RHSB-2021-008
- https://bugzilla.mozilla.org/show_bug.cgi?id=1738501
- https://bugzilla.mozilla.org/show_bug.cgi?id=CVE-2021-43529
- https://bugzilla.redhat.com/show_bug.cgi?id=2019621
- https://bugzilla.redhat.com/show_bug.cgi?id=2019622
Alle 28 Referenzen
- https://bugzilla.redhat.com/show_bug.cgi?id=2019624
- https://bugzilla.redhat.com/show_bug.cgi?id=2019625
- https://bugzilla.redhat.com/show_bug.cgi?id=2019626
- https://bugzilla.redhat.com/show_bug.cgi?id=2019627
- https://bugzilla.redhat.com/show_bug.cgi?id=2019628
- https://bugzilla.redhat.com/show_bug.cgi?id=2019630
- https://creativecommons.org/licenses/by/4.0/
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-38503
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-38504
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-38506
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-38507
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-38508
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-38509
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43529
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43534
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43535
- https://errata.rockylinux.org/RLSA-2021:4130
- https://nvd.nist.gov/vuln/detail/CVE-2021-43529
- https://www.cve.org/CVERecord?id=CVE-2021-43529
- https://www.openwall.com/lists/oss-security/2021/12/01/6