Thunderbird Stable Releases

Mozilla Thunderbird 102.11.0 stable has been released. (10-May-2023)

Home | Release Notes | Download Thunderbird in your language | FAQ | Blog

Spoiler

Fixes

fixed

During Account Setup, the “Checking password…” message was not removed after a failure


fixed

Miscellaneous UI fixes


fixed

Security fixes

Security Vulnerabilities fixed in Thunderbird 102.11

Spoiler

Mozilla Foundation Security Advisory 2023-18
Security Vulnerabilities fixed in Thunderbird 102.11
Announced
May 10, 2023
Impact
high
Products
Thunderbird
Fixed in

• Thunderbird 102.11

#CVE-2023-32205: Browser prompts could have been obscured by popups
Reporter
Alesandro Ortiz
Impact
high
Description

In multiple cases, browser prompts could have been obscured by popups controlled by content. These could have led to potential user confusion and spoofing attacks.

References

• Bug 1753339
• Bug 1753341

#CVE-2023-32206: Crash in RLBox Expat driver
Reporter
Irvan Kurniawan
Impact
high
Description
An out-of-bound read could have led to a crash in the RLBox Expat driver.

References

• Bug 1824892

#CVE-2023-32207: Potential permissions request bypass via clickjacking
Reporter
Hafiizh
Impact
high
Description
A missing delay in popup notifications could have made it possible for an attacker to trick a user into granting permissions.

References

• Bug 1826116

#CVE-2023-32211: Content process crash due to invalid wasm code
Reporter
P1umer and xmzyshypnc
Impact
moderate
Description
A type checking bug would have led to invalid code being compiled.

References

• Bug 1823379

#CVE-2023-32212: Potential spoof due to obscured address bar
Reporter
Hafiizh
Impact
moderate
Description
An attacker could have positioned a datalist element to obscure the address bar.

References

• Bug 1826622

#CVE-2023-32213: Potential memory corruption in FileReader:oReadData()
Reporter
Ronald Crane
Impact
moderate
Description
When reading a file, an uninitialized value could have been used as read limit.

References

• Bug 1826666

#CVE-2023-32214: Potential DoS via exposed protocol handlers
Reporter
Gijs Kruitbosch
Impact
low
Description
Protocol handlers ms-cxh and ms-cxh-full could have been leveraged to trigger a denial of service.
Note: This attack only affects Windows. Other operating systems are not affected.

References

• Bug 1828716

#CVE-2023-32215: Memory safety bugs fixed in Thunderbird 102.11
Reporter
Mozilla's developers and community
Impact
high
Description
Mozilla's developers and community members Gabriele Svelto, Andrew Osmond, Emily McDonough, Sebastian Hengst, Andrew McCreight and the Mozilla Fuzzing Team reported memory safety bugs present in Thunderbird 102.10. Some of these bugs showed evidence of memory corruption, and we presume that with enough effort some of these could have been exploited to run arbitrary code.

References

• Memory safety bugs fixed in Thunderbird 102.11

 

Mozilla Thunderbird 102.11.1 stable has been released. (24-May-2023)

Home | Release Notes | Download Thunderbird in your language

Spoiler

Fixes


fixed

POP message retrieval stopped after a network error occurred and connectivity was restored


fixed

Reused SMTP connections sometimes silently disconnected, causing timeouts


fixed

Thunderbird could freeze if saving a sent message to IMAP failed


fixed

Creating OpenPGP keys with no expiration was not possible


fixed

Newsreader did not always issue GROUP command after authentication with remote server, preventing Thunderbird from displaying or refreshing news from the server

 

Version 102.11.2, first offered to channel users on May 27, 2023

I just got it offered some minutes ago.

 

I use Thunderbird portable and I recently noticed a change in the Thunderbird drop-down menus that do not look right to me. Is this showing up for others as well?

 

Fwiw, on my portable TB setup with dark theme, it looks ok

 

Mine....

 

Okay, thanks for the feedback, so decided the problem was on my side and found that one of my userchrome.css entries started causing the border to appear after updating to one of the newer ESR 102 versions . Fixed the .css and everything is back to normal now.

 

Oddity…

Many are accustomed to a lesser degree of interest and support for the Thunderbird Email client.

Mozilla published the https://www.mozilla.org/en-US/security/advisories/mfsa2023-24/ notice on 04-July-2023.

Yet no Thunderbird stable release resulted, and no release candidate followed the 04-July-2023 version at
https://ftp.mozilla.org/pub/thunderbird/candidates/102.13.0-candidates/ nor are any betas noticed.

Just saying…

 

Thanks!

I just was notified by my TB that there is a new version:
Version 102.13.0

https://www.thunderbird.net/en-US/thunderbird/102.13.0/releasenotes/

 

Hello @FanJ:

The hash of today's Thunderbird stable release differs from those in yesterday's Thunderbird candidate. I wonder if the Thunderbird developers were waiting to see if today's Firefox dot release would affect their code. Perhaps it did…

Thank you.

 

Hi @1PW,

These are the hashes of the TB installer which I manually installed about an hour ago for the EN-US version for Win 64-bit:
The file <...Thunderbird\Version 102_13_0\Thunderbird Setup 102.13.0.exe> has the following Checksum(s)

MD5 - BCF669FA9AAF668E1923B33275E701BF
SHA-160 - C0D7F1A0A8ADADF0FE3D4994654C76713D3D46C3
SHA-256 - 000FD53729E1EA280375306DFDF4236819B09CB06931D508719CBFA1CA068749

Edited to add:
That installer was digital signed on 4 July 2023

 

Version 102.13.1

I'm confused.... Perhaps I have a "senior moment" ..... (could very well be).

The following site https://www.thunderbird.net/en-US/thunderbird/102.13.1/releasenotes/ says

But at this site https://ftp.mozilla.org/pub/thunderbird/releases/102.13.1/win64/en-US/ you can manually download it.

Senior moment at me?

 

OK, thanks!