critical
CVE-2021-43529
thunderbird: Memory corruption when processing S/MIME messages
In the Trivy database since at least 24 Oct 2026, 07:11 UTCWhen it arrived before that build is not recorded.
Severity by source
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Trivy's own label is CRITICAL. Rated critical by NVD, Red Hat. Rated lower by Amazon (high), Rocky Linux (high), Ubuntu (medium).
Description
Thunderbird versions prior to 91.3.0 are vulnerable to the heap overflow described in CVE-2021-43527 when processing S/MIME messages. Thunderbird versions 91.3.0 and later will not call the vulnerable code when processing S/MIME messages that contain certificates with DER-encoded DSA or RSA-PSS signatures.
Affected packages and fixed versions
| Source | Package | Fixed in |
|---|---|---|
| Red Hat | thunderbird | no fix listed |
| amazon linux 2 | thunderbird, thunderbird-debuginfo | 91.6.0-1.amzn2.0.1 |
| debian 10 | thunderbird | 1:91.4.1-1~deb10u1 |
| debian 11 | thunderbird | 1:91.4.1-1~deb11u1 |
| debian 12 | thunderbird | 1:91.3.0-1 |
| debian 13 | thunderbird | 1:91.3.0-1 |
| debian 14 | thunderbird | 1:91.3.0-1 |
| debian 9 | thunderbird | 1:91.4.1-1~deb9u1 |
| echo | thunderbird | 1:91.3.0-1 |
| rocky 8 | thunderbird | 91.3.0-2.el8 |
| ubuntu 18.04 | thunderbird | 1:91.5.0+build1-0ubuntu0.18.04.1 |
| ubuntu 20.04 | thunderbird | 1:91.5.0+build1-0ubuntu0.20.04.1 |
Show all 13 entries from 12 sources
| Source | Package | Fixed in |
|---|---|---|
| Red Hat | thunderbird | no fix listed |
| amazon linux 2 | thunderbird | 91.6.0-1.amzn2.0.1 |
| amazon linux 2 | thunderbird-debuginfo | 91.6.0-1.amzn2.0.1 |
| debian 10 | thunderbird | 1:91.4.1-1~deb10u1 |
| debian 11 | thunderbird | 1:91.4.1-1~deb11u1 |
| debian 12 | thunderbird | 1:91.3.0-1 |
| debian 13 | thunderbird | 1:91.3.0-1 |
| debian 14 | thunderbird | 1:91.3.0-1 |
| debian 9 | thunderbird | 1:91.4.1-1~deb9u1 |
| echo | thunderbird | 1:91.3.0-1 |
| rocky 8 | thunderbird | 91.3.0-2.el8 |
| ubuntu 18.04 | thunderbird | 1:91.5.0+build1-0ubuntu0.18.04.1 |
| ubuntu 20.04 | thunderbird | 1:91.5.0+build1-0ubuntu0.20.04.1 |
References
- https://access.redhat.com/errata/RHSA-2021:4130
- https://access.redhat.com/security/cve/CVE-2021-43527
- https://access.redhat.com/security/cve/CVE-2021-43529
- https://access.redhat.com/security/vulnerabilities/RHSB-2021-008
- https://bugzilla.mozilla.org/show_bug.cgi?id=1738501
- https://bugzilla.mozilla.org/show_bug.cgi?id=CVE-2021-43529
- https://bugzilla.redhat.com/show_bug.cgi?id=2019621
- https://bugzilla.redhat.com/show_bug.cgi?id=2019622
All 28 references
- https://bugzilla.redhat.com/show_bug.cgi?id=2019624
- https://bugzilla.redhat.com/show_bug.cgi?id=2019625
- https://bugzilla.redhat.com/show_bug.cgi?id=2019626
- https://bugzilla.redhat.com/show_bug.cgi?id=2019627
- https://bugzilla.redhat.com/show_bug.cgi?id=2019628
- https://bugzilla.redhat.com/show_bug.cgi?id=2019630
- https://creativecommons.org/licenses/by/4.0/
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-38503
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-38504
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-38506
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-38507
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-38508
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-38509
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43529
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43534
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43535
- https://errata.rockylinux.org/RLSA-2021:4130
- https://nvd.nist.gov/vuln/detail/CVE-2021-43529
- https://www.cve.org/CVERecord?id=CVE-2021-43529
- https://www.openwall.com/lists/oss-security/2021/12/01/6