Re: Thunderbird security
On 26/03/2022 05:50, André Rodier wrote:
I would like to collect, from this thread, your experience and opinion
about Mozilla Thunderbird, in term of security.
I am registered on The Debian security list, and I see a lot of CVE
coming, some of them with a high score, mentioning execution of
arbitrary code or information disclosure.
Most of them seems pretty severe to me, and I am now running
Thunderbird in firejail. However, I wonder if such vulnerability would
allow a remote attacker to send an email, and get, for instance, the
credentials stored in Thunderbird, with or without master password.
This seem habitual to me, compared to other mail clients in Debian,
like evolution / claws, etc...
In term of security, Which email clients, or which practices, you
would recommend to me ?
If you search the CVE numbers[0], you should be able to find information
about the vulnerabilities[1], describing the conditions necessary for it
to be exploited and the possible consequences. You can then judge if
they might affect you (some vulnerabilities can only be exploited in
particular circunstances, which might not apply to your case) and
evaluate the risk.
But, overall, the fact the vulnerabilities are being found and fixed is
a good sign: it means that the code is being looked at and problems are
being solved. The fact that the details have not been released yet
suggests that those were found by someone well-intentioned, and not
because they were being exploited in the wild, but on the other hand
also suggests the risk is high enough that it's better to withhold that
information until people have had a chance to upgrade to a fixed version.
[0] The announcements on debian-security-announce could be improved by
having a link to the CVE database. But for now, you'll have to search
them manually.
[1] Eventually... The last CVEs for Thunderbird are still in the
"reserved" state. I believe this is meant to give some time for
distributions to update the software before the details about how to
exploit the vulnerability are disclosed.
--
Insomnia isn't anything to lose sleep over.
Eduardo M KALINOWSKI
eduardo@kalinowski.com.br
Reply to: