UBUNTU-CVE-2026-126135: Medium severity ubuntu/thunderbird vulnerability
If an attacker was able to perform a man-in-the-middle attack on an SMTP or POP3 server connection using STARTTLS, the attacker could inject server responses before the TLS handshake completed. Thunderbird would process these responses after the handshake, as if they had been received from the server over the encrypted connection. This could be used to make Thunderbird report a different outcome for sending or fetching mail, and to show attacker-controlled text in error messages. The encrypted connection itself was not compromised, and credentials were not exposed. Connections using SSL/TLS instead of STARTTLS were not affected. This vulnerability was fixed in Thunderbird 160 and Thunderbird 153.7.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Thunderbirdto a version that resolves this vulnerability.Fixed in 160
Event History
Frequently Asked Questions
Which mail connections are affected?
Only SMTP or POP3 connections that use STARTTLS are affected. Connections configured to use SSL/TLS rather than STARTTLS are not affected.
What must an attacker be able to do to exploit this?
The attacker must be able to perform a man-in-the-middle attack on the SMTP or POP3 server connection and inject server responses before the TLS handshake completes.
What is the impact of successful exploitation?
An attacker can cause Thunderbird to report an incorrect result for sending or fetching mail and can display attacker-controlled text in error messages. The encrypted connection is not compromised, and credentials are not exposed.
Which Thunderbird releases contain the fix?
The issue was fixed in Thunderbird 160 and Thunderbird 153.7.