CVE-2021-23991

MediumCVSS 6.8/10Last modified Jun 17, 2026

Description

If a Thunderbird user has previously imported Alice's OpenPGP key, and Alice has extended the validity period of her key, but Alice's updated key has not yet been imported, an attacker may send an email containing a crafted version of Alice's key with an invalid subkey, Thunderbird might subsequently attempt to use the invalid subkey, and will fail to send encrypted email to Alice. This vulnerability affects Thunderbird < 78.9.1.

Metrics

CVSS 3.1 6.8/10CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

Affected software

No affected versions have been published.

Timeline

Published: Jun 24, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-239924.3Thunderbird did not check if the user ID associated with an OpenPGP key has a valid self signature. An attacker may create a crafted version CVE-2021-239936.5An attacker may perform a DoS attack to prevent a user from sending encrypted email to a correspondent. If an attacker creates a crafted Ope CVE-2021-239948.8A WebGL framebuffer was not initialized early enough, resulting in memory corruption and an out of bound write. This vulnerability affects F CVE-2021-239958.8When Responsive Design Mode was enabled, it used references to objects that were previously freed. We presume that with enough effort this c CVE-2021-239966.5By utilizing 3D CSS in conjunction with Javascript, content could have been rendered outside the webpage's viewport, resulting in a spoofing CVE-2021-239978.8Due to unexpected data type conversions, a use-after-free could have occurred when interacting with the font cache. We presume that with eno CVE-2021-239986.5Through complicated navigations with new windows, an HTTP page could have inherited a secure lock icon from an HTTPS page. This vulnerabilit CVE-2021-239998.8If a Blob URL was loaded through some unusual user interaction, it could have been loaded by the System Principal and granted additional pri CVE-2021-24007.5Vulnerability in the Oracle BI Publisher product of Oracle Fusion Middleware (component: E-Business Suite - XDO). Supported versions that ar CVE-2021-240003.1A race condition with requestPointerLock() and setTimeout() could have resulted in a user interacting with one tab when they believed they w CVE-2021-240014.3A compromised content process could have performed session history manipulations it should not have been able to due to testing infrastructu CVE-2021-240028.8When a user clicked on an FTP URL containing encoded newline characters (%0A and %0D), the newlines would have been interpreted as such and