crítica
CVE-2021-43529
thunderbird: Memory corruption when processing S/MIME messages
En la Trivy database desde, como mínimo, el 24 oct 2026, 07:11 UTCNo consta cuándo entró antes de ese build.
Severidad por fuente
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
La etiqueta propia de Trivy es CRITICAL. Crítica según NVD, Red Hat. Más baja según Amazon (alta), Rocky Linux (alta), Ubuntu (media).
Descripción
Thunderbird versions prior to 91.3.0 are vulnerable to the heap overflow described in CVE-2021-43527 when processing S/MIME messages. Thunderbird versions 91.3.0 and later will not call the vulnerable code when processing S/MIME messages that contain certificates with DER-encoded DSA or RSA-PSS signatures.
Paquetes afectados y versiones corregidas
| Fuente | Paquete | Corregido en |
|---|---|---|
| Red Hat | thunderbird | sin corrección indicada |
| amazon linux 2 | thunderbird, thunderbird-debuginfo | 91.6.0-1.amzn2.0.1 |
| debian 10 | thunderbird | 1:91.4.1-1~deb10u1 |
| debian 11 | thunderbird | 1:91.4.1-1~deb11u1 |
| debian 12 | thunderbird | 1:91.3.0-1 |
| debian 13 | thunderbird | 1:91.3.0-1 |
| debian 14 | thunderbird | 1:91.3.0-1 |
| debian 9 | thunderbird | 1:91.4.1-1~deb9u1 |
| echo | thunderbird | 1:91.3.0-1 |
| rocky 8 | thunderbird | 91.3.0-2.el8 |
| ubuntu 18.04 | thunderbird | 1:91.5.0+build1-0ubuntu0.18.04.1 |
| ubuntu 20.04 | thunderbird | 1:91.5.0+build1-0ubuntu0.20.04.1 |
Mostrar las 13 entradas de 12 fuentes
| Fuente | Paquete | Corregido en |
|---|---|---|
| Red Hat | thunderbird | sin corrección indicada |
| amazon linux 2 | thunderbird | 91.6.0-1.amzn2.0.1 |
| amazon linux 2 | thunderbird-debuginfo | 91.6.0-1.amzn2.0.1 |
| debian 10 | thunderbird | 1:91.4.1-1~deb10u1 |
| debian 11 | thunderbird | 1:91.4.1-1~deb11u1 |
| debian 12 | thunderbird | 1:91.3.0-1 |
| debian 13 | thunderbird | 1:91.3.0-1 |
| debian 14 | thunderbird | 1:91.3.0-1 |
| debian 9 | thunderbird | 1:91.4.1-1~deb9u1 |
| echo | thunderbird | 1:91.3.0-1 |
| rocky 8 | thunderbird | 91.3.0-2.el8 |
| ubuntu 18.04 | thunderbird | 1:91.5.0+build1-0ubuntu0.18.04.1 |
| ubuntu 20.04 | thunderbird | 1:91.5.0+build1-0ubuntu0.20.04.1 |
Referencias
- https://access.redhat.com/errata/RHSA-2021:4130
- https://access.redhat.com/security/cve/CVE-2021-43527
- https://access.redhat.com/security/cve/CVE-2021-43529
- https://access.redhat.com/security/vulnerabilities/RHSB-2021-008
- https://bugzilla.mozilla.org/show_bug.cgi?id=1738501
- https://bugzilla.mozilla.org/show_bug.cgi?id=CVE-2021-43529
- https://bugzilla.redhat.com/show_bug.cgi?id=2019621
- https://bugzilla.redhat.com/show_bug.cgi?id=2019622
Las 28 referencias
- https://bugzilla.redhat.com/show_bug.cgi?id=2019624
- https://bugzilla.redhat.com/show_bug.cgi?id=2019625
- https://bugzilla.redhat.com/show_bug.cgi?id=2019626
- https://bugzilla.redhat.com/show_bug.cgi?id=2019627
- https://bugzilla.redhat.com/show_bug.cgi?id=2019628
- https://bugzilla.redhat.com/show_bug.cgi?id=2019630
- https://creativecommons.org/licenses/by/4.0/
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-38503
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-38504
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-38506
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-38507
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-38508
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-38509
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43529
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43534
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43535
- https://errata.rockylinux.org/RLSA-2021:4130
- https://nvd.nist.gov/vuln/detail/CVE-2021-43529
- https://www.cve.org/CVERecord?id=CVE-2021-43529
- https://www.openwall.com/lists/oss-security/2021/12/01/6