| Package | Affected versions | Patched versions |
|---|---|---|
| thunderbird | ≥ 141.0, < 153.3.0≥ 154.0, < 156.0< 140.16.0 | 153.3.0156.0140.16.0 |
A malicious or compromised IMAP server can trigger an out-of-bounds read in the IMAP response parser by sending an untagged '* ID' response, crashing Thunderbird. The affected parsing path is reachable before authentication. This vulnerability was fixed in Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free