CVE-2021-29956

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

OpenPGP secret keys that were imported using Thunderbird version 78.8.1 up to version 78.10.1 were stored unencrypted on the user's local disk. The master password protection was inactive for those keys. Version 78.10.2 will restore the protection mechanism for newly imported keys, and will automatically protect keys that had been imported using affected Thunderbird versions. This vulnerability affects Thunderbird < 78.10.2.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-312

Affected software

No affected versions have been published.

Timeline

Published: Jun 24, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-299574.3If a MIME encoded email contains an OpenPGP inline signed or encrypted message part, but also contains an additional unprotected part, Thund CVE-2021-299584.3When a download was initiated, the client did not check whether it was in normal or private browsing mode, which led to private mode cookies CVE-2021-299594.3When a user has already allowed a website to access microphone and camera, disabling camera sharing would not fully prevent the website from CVE-2021-299604.3Firefox used to cache the last filename used for printing a file. When generating a filename for printing, Firefox usually suggests the web CVE-2021-299614.3When styling and rendering an oversized `<select>` element, Firefox did not apply correct clipping which allowed an attacker to paint over t CVE-2021-299624.3Firefox for Android would become unstable and hard-to-recover when a website opened too many popups. *This bug only affects Firefox for Andr CVE-2021-299634.3Address bar search suggestions in private browsing mode were re-using session data from normal mode. *This bug only affects Firefox for Andr CVE-2021-299647.1A locally-installed hostile program could send `WM_COPYDATA` messages that Firefox would process incorrectly, leading to an out-of-bounds re CVE-2021-299655.3A malicious website that causes an HTTP Authentication dialog to be spawned could trick the built-in password manager to suggest passwords f CVE-2021-299668.8Mozilla developers reported memory safety bugs present in Firefox 88. Some of these bugs showed evidence of memory corruption and we presume CVE-2021-299678.8Mozilla developers reported memory safety bugs present in Firefox 88 and Firefox ESR 78.11. Some of these bugs showed evidence of memory cor CVE-2021-299688.1When drawing text onto a canvas with WebRender disabled, an out of bounds read could occur. *This bug only affects Firefox on Windows. Other