- http://developer.mozilla.org/devnews/index…-now-available/
"Please note: If you’re still using Thunderbird 1.5.0.x, this version is no longer supported and contains known security vulnerabilities. Please upgrade to Thunderbird 2 by downloading Thunderbird 2.0.0.12.."
Thunderbird v2.0.0.16 released
- http://www.mozilla.com/thunderbird/
Thunderbird - email client from Mozilla
July 23, 2008
2.0.0.16 for Windows (6.4MB)
Security Advisories:
- http://www.mozilla.org/security/known-vuln…derbird2.0.0.18
Fixed in Thunderbird 2.0.0.18
MFSA 2008-59 Script access to .documentURI and .textContent in mail
MFSA 2008-58 Parsing error in E4X default namespace
MFSA 2008-56 nsXMLHttpRequest::NotifyEventListeners() same-origin violation
MFSA 2008-55 Crash and remote code execution in nsFrameManager
MFSA 2008-52 Crashes with evidence of memory corruption (rv:1.9.0.4/1.8.1.18 )
MFSA 2008-50 Crash and remote code execution via __proto__ tampering
MFSA 2008-48 Image stealing via canvas and HTTP redirect …
Fixed in Thunderbird 2.0.0.19
- http://www.mozilla.org/security/known-vuln…derbird2.0.0.19
MFSA 2008-68 XSS and JavaScript privilege escalation
MFSA 2008-67 Escaped null characters ignored by CSS parser
MFSA 2008-66 Errors parsing URLs with leading whitespace and control characters
MFSA 2008-65 Cross-domain data theft via script redirect error message
MFSA 2008-64 XMLHttpRequest 302 response disclosure
MFSA 2008-61 Information stealing via loadBindingDocument
MFSA 2008-60 Crashes with evidence of memory corruption (rv:1.9.0.5/1.8.1.19)
Fixed in Thunderbird 2.0.0.21
- http://www.mozilla.org/security/known-vuln…derbird2.0.0.21
MFSA 2009-10 Upgrade PNG library to fix memory safety hazards
MFSA 2009-09 XML data theft via RDFXMLDataSource and cross-domain redirect
MFSA 2009-07 Crashes with evidence of memory corruption (rv:1.9.0.7)
MFSA 2009-01 Crashes with evidence of memory corruption (rv:1.9.0.6)
- http://secunia.com/advisories/35440/2/
Last Update: 2009-06-23
Critical: Highly critical
Impact: Security Bypass, Spoofing, DoS, System access
Where: From remote…
Solution: Update to version 2.0.0.22, which fixes some of the vulnerabilities…
- http://www.mozilla.org/security/known-vuln…derbird2.0.0.22
Fixed in Thunderbird 2.0.0.22
MFSA 2009-33 Crash viewing multipart/alternative message with text/enhanced part
MFSA 2009-32 JavaScript chrome privilege escalation
MFSA 2009-29 Arbitrary code execution using event listeners attached to an element whose owner document is null
MFSA 2009-27 SSL tampering via non-200 responses to proxy CONNECT requests
MFSA 2009-24 Crashes with evidence of memory corruption (rv:[removed])
MFSA 2009-17 Same-origin violations when Adobe Flash loaded via view-source: scheme
MFSA 2009-14 Crashes with evidence of memory corruption (rv:1.9.0.9)
- http://secunia.com/advisories/36125/2/
Last Update: 2009-08-21
Critical: Highly critical
Impact: Security Bypass, DoS, System access
Where: From remote
Solution Status: Partial Fix
Software: Mozilla SeaMonkey 1.1.x, Mozilla Thunderbird 2.x
Solution: Update to Mozilla Thunderbird version 2.0.0.23, which fixes the security bypass vulnerability…
- http://www.fourmilab.ch/fourmilog/archives…-08/001175.html
August 21, 2009 - "… What appears to have happened is that this security update, which is being deployed across all Mozilla Foundation products, has changed the rules for security certificates generated with wildcards. While a certificate generated for “*.fourmilab.ch” would previously be accepted for a machine with a name such as “ceres.lan.fourmilab.ch” (the mail server), now the warning pops up on every such connection. This is going to strike lots of people who use a common site-wide certificate across all the machines in a server farm, or use a single server to host sites in several different domains. Fortunately, there is a Thunderbird add-on, “Remember Mismatched Domains”*, which adds a check box to the warning dialogue which allows accepting the “mismatch” and not warning further about that specific mismatch. This add-on has already been downloaded more than 125,000 times, and methinks it's about become even more popular in the near future. Just download and install the add-on, accept the domain(s) which are generating the warning, and you're back in business."
* https://addons.mozilla.org/thunderbird/addon/2131
- http://www.mozillamessaging.com/en-US/thun…0/releasenotes/
December 8, 2009 - "… installing Thunderbird 3 may overwrite your existing installation of Thunderbird on Linux. Windows and Mac OS X will install to different locations, however it is recommended that you check the messages during installation. For all systems, you won't lose any of your messages or address books, but some of your extensions and other add-ons might not work until updates for them are made available. Users are highly encouraged to install Thunderbird 3 in another folder (on Windows, this is done using Custom Install) and backup their profiles before testing Thunderbird 3…"
Thunderbird v.3.0.3 released
- http://www.mozillamessaging.com/en-US/thun…3/releasenotes/
March 1, 2010 - "Thunderbird 3.0.3 fixes the following issue in Thunderbird 3.0.2:
* Fix for missing folders or empty folder pane after updating to Thunderbird 3.0.2…"
Thunderbird v3.0.4 released
- https://developer.mozilla.org/devnews/index…-free-download/
March 30, 2010 - "As part of Mozilla’s ongoing security and stability update process, Thunderbird 3.0.4 is now available for Windows, Mac, and Linux for free download from http://getthunderbird.com/ . We strongly recommend that all Thunderbird users upgrade to this release… You can also manually fetch this update by selecting 'Check for Updates…' from the Help menu. For a list of changes and more information, please review the Thunderbird release notes*."
* http://www.mozillamessaging.com/thunderbir…4/releasenotes/
Thunderbird v3.1 released
- http://www.mozillamessaging.com/en-US/thun…1/releasenotes/
June 24, 2010 - "… based on the Gecko 1.9.2 platform to provide improved performance, stability, web compatibility, and code simplification and sustainability…
Thunderbird 3.1 no longer supports versions of Windows prior to Windows 2000 (e.g. Windows 95, 98, ME, and NT) and Mac OS X versions prior to 10.4 Tiger. Linux requirements have also changed…"
