CVE-2026-40014

An attacker that can send mail to a user can craft a message header that makes the IMAP THREAD command consume CPU disproportionate to the size of the message. When a mail client issues a THREAD command on the affected mailbox, this can cause degradation or denial of service for IMAP. Monitor...

CVE-2026-40014

An attacker that can send mail to a user can craft a message header that makes the IMAP THREAD command consume CPU disproportionate to the size of the message. When a mail client issues a THREAD command on the affected mailbox, this can cause degradation or denial of service for IMAP. Monitor...

CVE-2026-65053 Horde IMP before 7.2.0 Stored Cross-Site Scripting via AppleDouble Viewer Part Name

Horde IMP's AppleDouble MIME viewer writes an attacker-controlled attachment name into an HTML status block without escaping it. In lib/Mime/Viewer/Appledouble.php, IMPrender obtains the name of the data part with IMPContents::getPartName, which returns the MIME part's own name parameter as...

KLA91169 Multiple vulnerabilities in Mozilla Thunderbird ESR

Multiple vulnerabilities were found in Mozilla Thunderbird ESR. Malicious users can exploit these vulnerabilities to bypass security restrictions, cause denial of service, execute arbitrary code, obtain sensitive information. Below is a complete list of vulnerabilities: 1. Denial of service...

Microsoft Security Advisory CVE-2026-50659 – .NET Spoofing Vulnerability

Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET SMTP client System.Net.Mail. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. A spoofing vulnerability exis...

ruby: net-imap: Net::IMAP: Denial of Service via crafted IMAP responses

A flaw was found in Net::IMAP, a Ruby library implementing the Internet Message Access Protocol IMAP client functionality. A hostile server can exploit a quadratic time complexity issue in the Net::IMAP::ResponseReader when processing large responses containing numerous string literals. This can...

[SECURITY] Fedora 43 Update: thunderbird-152.0-2.fc43

Mozilla Thunderbird is a standalone mail and newsgroup client...

thunderbird security update

An update is available for thunderbird. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Mozilla Thunderbird is a standalone mail and newsgroup client. Security...

[SECURITY] Fedora 43 Update: thunderbird-149.0.1-3.fc43

Mozilla Thunderbird is a standalone mail and newsgroup client...

[SECURITY] Fedora 43 Update: roundcubemail-1.6.16-1.fc43

RoundCube Webmail is a browser-based multilingual IMAP client with an application-like user interface. It provides full functionality you expect from an e-mail client, including MIME support, address book, folder manipulation, message searching and spell checking. RoundCube Webmail is written in...

Vulnerability of the Networking component: DNS browsers like Mozilla Firefox and the email client Thunderbird, which allow attackers to affect the accessibility of protected information.

The vulnerability of the Networking component: DNS browsers like Mozilla Firefox and the email client Thunderbird are vulnerable due to insufficient validation of input data. Exploiting this vulnerability allows an attacker to compromise the accessibility of protected information...

[SECURITY] Fedora 44 Update: thunderbird-149.0.1-2.fc44

Mozilla Thunderbird is a standalone mail and newsgroup client...

CVE-2026-41319 MailKit has STARTTLS Response Injection via unflushed stream buffer that enables SASL mechanism downgrade

MailKit is a cross-platform mail client library built on top of MimeKit. A STARTTLS Response Injection vulnerability in versions prior to 4.16.0 allows a Man-in-the-Middle attacker to inject arbitrary protocol responses across the plaintext-to-TLS trust boundary, enabling SASL authentication...

EUVD-2026-25388

MailKit is a cross-platform mail client library built on top of MimeKit. A STARTTLS Response Injection vulnerability in versions prior to 4.16.0 allows a Man-in-the-Middle attacker to inject arbitrary protocol responses across the plaintext-to-TLS trust boundary, enabling SASL authentication...

[SECURITY] Fedora 42 Update: thunderbird-149.0.1-2.fc42

Mozilla Thunderbird is a standalone mail and newsgroup client...

[SECURITY] Fedora 43 Update: thunderbird-147.0-2.fc43

Mozilla Thunderbird is a standalone mail and newsgroup client...

[SECURITY] Fedora 42 Update: thunderbird-147.0-6.fc42

Mozilla Thunderbird is a standalone mail and newsgroup client...

Important: Red Hat Security Advisory: thunderbird security update

An update for thunderbird is now available for Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

USN-7838-1: fetchmail vulnerability

It was discovered that the fetchmail SMTP client incorrectly handled certain status code messages. An attacker controlling a malicious server could possibly use this issue to cause fetchmail to crash, resulting in a denial of service...

USN-7838-1 fetchmail vulnerability

It was discovered that the fetchmail SMTP client incorrectly handled certain status code messages. An attacker controlling a malicious server could possibly use this issue to cause fetchmail to crash, resulting in a denial of service...