QID 198641

Thunderbird ignored the configuration to requirestarttls for an smtp connection.
Javascript was unexpectedly enabled in thecomposition area.
Thunderbird's openpgp integration only consideredthe inner signed message when checking signature validity in a messagethat contains an additional outer mime layer.

Multiple security issues were discovered in thunderbird.
If a user weretricked into opening a specially crafted website in a browsing context, anattacker could potentially exploit these to cause a denial of service,obtain sensitive information, trick a user into accepting unwantedpermissions, conduct header splitting attacks, conduct spoofing attacks,bypass security restrictions, confuse the user, or execute arbitrary code.
A person-in-the-middle could potentiallyexploit this to perform a downgrade attack in order to intercept messagesor take control of a session.
An attacker could potentially exploit this incombination with another vulnerability, with unspecified impacts.
(cve-2021-43528)a buffer overflow was discovered in the matrix chat library bundled withthunderbird.
An attacker could potentially exploit this to cause a denialof service, or execute arbitrary code.
An attacker couldpotentially exploit this to trick the user into thinking that a messagehas a valid signature.