MediumFix available
thunderbird — security advisory
If a MIME encoded email contains an OpenPGP inline signed or encrypted message part, but also contains an additional unprotected part, Thunderbird did not indicate that only parts of the message are protected. This vulnerability affects Thunderbird < 78.10.2.
- Products
- thunderbird
- Affected versions
- Not specified
- Fixed versions
- 1:78.10.2-1
- CVEs
- CVE-2021-29957
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 00:21 UTC · Revision 1
Source evidence
If a MIME encoded email contains an OpenPGP inline signed or encrypted message part, but also contains an additional unprotected part, Thunderbird did not indicate that only parts of the message are protected. This vulnerability affects Thunderbird < 78.10.2.
osv:DEBIAN-CVE-2021-29957
thunderbird
Fixed versions: 1:78.10.2-1
thunderbird
Fixed versions: 1:78.10.2-1
thunderbird
Fixed versions: 1:78.10.2-1
Complete source record
{
"id": "f6ce85f5bed8d16dc6a4381ef82ca3b86281a3058b37877284e21be5883ad1c1",
"url": "https://osv.dev/vulnerability/DEBIAN-CVE-2021-29957",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "DEBIAN-CVE-2021-29957",
"summary": "If a MIME encoded email contains an OpenPGP inline signed or encrypted message part, but also contains an additional unprotected part, Thunderbird did not indicate that only parts of the message are protected. This vulnerability affects Thunderbird < 78.10.2.",
"evidence": "osv:DEBIAN-CVE-2021-29957",
"products": [
{
"name": {
"value": "thunderbird",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1:78.10.2-1",
"evidence": "/affected/0/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "thunderbird",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1:78.10.2-1",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "thunderbird",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1:78.10.2-1",
"evidence": "/affected/2/ranges"
}
],
"affected_versions": []
}
],
"severity": "medium",
"structured": {
"id": "DEBIAN-CVE-2021-29957",
"aliases": [
"DEBIAN-CVE-2021-29957"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1:78.10.2-1"
}
]
}
],
"package": {
"name": "thunderbird",
"purl": "pkg:deb/debian/thunderbird?arch=source&distro=bookworm",
"ecosystem": "Debian:12"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2021-29957.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1:78.10.2-1"
}
]
}
],
"package": {
"name": "thunderbird",
"purl": "pkg:deb/debian/thunderbird?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2021-29957.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1:78.10.2-1"
}
]
}
],
"package": {
"name": "thunderbird",
"purl": "pkg:deb/debian/thunderbird?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2021-29957.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
}
],
"modified": "2026-10-23T18:03:12.737491242Z",
"provider": "osv",
"upstream": [
"CVE-2021-29957"
],
"references": [
"https://security-tracker.debian.org/tracker/CVE-2021-29957"
]
},
"related_cves": [
{
"value": "CVE-2021-29957",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 420819,
"published_at": "2021-06-24T14:15:10.11+00:00"
}