Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
4.3

Thunderbird may generate incorrect email identifiers

CVE-2020-6792 · published 6 years ago
Summary

Versions of Thunderbird earlier than 68.5 use leftover memory when creating an ID for each email, which can produce duplicate identifiers or expose random data from the computer’s memory. This could cause email threads to be mixed up or reveal unintended information. Update Thunderbird to version 68.5 or later (or the latest Debian package) to fix the issue.

What to do
  • Update debian thunderbird to version 1:68.5.0-1.
  • Update mozilla thunderbird to version 68.5.0 or later.
Affected software
Ecosystem VendorProductAffected versions
Debian:12 debian thunderbird < 1:68.5.0-1
Fix: upgrade to 1:68.5.0-1
Debian:13 debian thunderbird < 1:68.5.0-1
Fix: upgrade to 1:68.5.0-1
Debian:14 debian thunderbird < 1:68.5.0-1
Fix: upgrade to 1:68.5.0-1
– mozilla thunderbird < 68.5.0
cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*
– canonical ubuntu_linux 16.04
18.04
19.10
cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*
Original advisory text
When deriving an identifier for an email message, uninitialized memory was used in addition to the message contents. This vulnerability affects Thunderbird < 68.5.
When deriving an identifier for an email message, uninitialized memory was used in addition to the message contents. This vulnerability affects Thunderbird < 68.5.
References
Severity
4.3 Medium
Exploitation
1% chance of attack within 30 days
Type
CWE-908Use of Uninitialized Resource
CWE-909Missing Initialization of Resource
Timeline
Published2 Mar 2020
Updated4 Nov 2026
First seen11 Sep 2026
Sources
DEBIAN-CVE-2020-6792 · OSV
CVE-2020-6792 · NVD
Track software like this
Free during beta