CVE-2021-29969

MediumCVSS 5.9/10Last modified Jun 17, 2026

Description

If Thunderbird was configured to use STARTTLS for an IMAP connection, and an attacker injected IMAP server responses prior to the completion of the STARTTLS handshake, then Thunderbird didn't ignore the injected data. This could have resulted in Thunderbird showing incorrect information, for example the attacker could have tricked Thunderbird to show folders that didn't exist on the IMAP server. This vulnerability affects Thunderbird < 78.12.

Metrics

CVSS 3.1 5.9/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-552

Affected software

No affected versions have been published.

Timeline

Published: Aug 5, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-299708.8A malicious webpage could have triggered a use-after-free, memory corruption, and a potentially exploitable crash. *This bug could only be t CVE-2021-299719.8If a user had granted a permission to a webpage and saved that grant, any webpage running on the same host - irrespective of scheme or port CVE-2021-299728.8A use-after-free vulnerability was found via testing, and traced to an out-of-date Cairo library. Updating the library resolved the issue, a CVE-2021-299738.8Password autofill was enabled without user interaction on insecure websites on Firefox for Android. This was corrected to require user inter CVE-2021-299744.3When network partitioning was enabled, e.g. as a result of Enhanced Tracking Protection settings, a TLS error page would allow the user to o CVE-2021-299756.5Through a series of DOM manipulations, a message, over which the attacker had control of the text but not HTML or formatting, could be overl CVE-2021-299768.8Mozilla developers reported memory safety bugs present in code shared between Firefox and Thunderbird. Some of these bugs showed evidence of CVE-2021-299778.8Mozilla developers reported memory safety bugs present in Firefox 89. Some of these bugs showed evidence of memory corruption and we presume CVE-2021-299789.8Multiple low security issues were discovered and fixed in a security audit of Mozilla VPN 2.x branch as part of a 3rd party security audit. CVE-2021-299796.1Hubs Cloud allows users to download shared content, specifically HTML and JS, which could allow javascript execution in the Hub Cloud instan CVE-2021-299808.8Uninitialized memory in a canvas object could have caused an incorrect free() leading to memory corruption and a potentially exploitable cra CVE-2021-299818.8An issue present in lowering/register allocation could have led to obscure but deterministic register confusion failures in JITted code that