Thunderbird is the one of the best free email client for MAC, Windows and Linux OS with IMAP and POP support. You can extend the features of.

Security vulnerabilities fixed in Thunderbird 68

Announced
August 27, 2019
Impact
critical
Products
Thunderbird
Fixed in
  • Thunderbird 68
In general, these flaws cannot be exploited through email in the Thunderbird product because scripting is disabled when reading mail, but are potentially risks in browser or browser-like contexts.

#CVE-2019-11711: Script injection within domain through inner window reuse

Reporter
Boris Zbarsky
Impact
high
Description
When an inner window is reused, it does not consider the use of document.domain for cross-origin protections. If pages on different subdomains ever cooperatively use document.domain, then either page can abuse this to inject script into arbitrary pages on the other subdomain, even those that did not use document.domain to relax their origin security.
References

#CVE-2019-11712: Cross-origin POST requests can be made with NPAPI plugins by following 308 redirects

Reporter
Gregory Smiley of Security Compass
Impact
high
Description
POST requests made by NPAPI plugins, such as Flash, that receive a status 308 redirect response can bypass CORS requirements. This can allow an attacker to perform Cross-Site Request Forgery (CSRF) attacks.
References

#CVE-2019-11713: Use-after-free with HTTP/2 cached stream

Reporter
Hanno Böck
Impact
high
Description
A use-after-free vulnerability can occur in HTTP/2 when a cached HTTP/2 stream is closed while still in use, resulting in a potentially exploitable crash.
References

#CVE-2019-11714: NeckoChild can trigger crash when accessed off of main thread

Reporter
Hanno Böck
Impact
moderate
Description
Necko can access a child on the wrong thread during UDP connections, resulting in a potentially exploitable crash in some instances.
References

#CVE-2019-11729: Empty or malformed p256-ECDH public keys may trigger a segmentation fault

Reporter
Jonas Allmann
Impact
moderate
Description
Empty or malformed p256-ECDH public keys may trigger a segmentation fault due values being improperly sanitized before being copied into memory and used.
References

#CVE-2019-11715: HTML parsing error can contribute to content XSS

Reporter
Linus Särud
Impact
moderate
Description
Due to an error while parsing page content, it is possible for properly sanitized user input to be misinterpreted and lead to XSS hazards on web sites in certain circumstances.
References

#CVE-2019-11716: globalThis not enumerable until accessed

Reporter
Chris Hacking
Impact
moderate
Description
Until explicitly accessed by script, window.globalThis is not enumerable and, as a result, is not visible to code such as Object.getOwnPropertyNames(window). Sites that deploy a sandboxing that depends on enumerating and freezing access to the window object may miss this, allowing their sandboxes to be bypassed.
References

#CVE-2019-11717: Caret character improperly escaped in origins

Reporter
Tyson Smith
Impact
moderate
Description
A vulnerability exists where the caret ('^') character is improperly escaped constructing some URIs due to it being used as a separator, allowing for possible spoofing of origin attributes.
References

#CVE-2019-11719: Out-of-bounds read when importing curve25519 private key

Reporter
Henry Corrigan-Gibbs
Impact
moderate
Description
When importing a curve25519 private key in PKCS#8format with leading 0x00 bytes, it is possible to trigger an out-of-bounds read in the Network Security Services (NSS) library. This could lead to information disclosure.
References

#CVE-2019-11720: Character encoding XSS vulnerability

Reporter
Rakesh Mane
Impact
moderate
Description
Some unicode characters are incorrectly treated as whitespace during the parsing of web content instead of triggering parsing errors. This allows malicious code to then be processed, evading cross-site scripting (XSS) filtering.
References

#CVE-2019-11721: Domain spoofing through unicode latin 'kra' character

Reporter
Anonymous
Impact
moderate
Description
The unicode latin 'kra' character can be used to spoof a standard 'k' character in the addressbar. This allows for domain spoofing attacks as do not display as punycode text, allowing for user confusion.
References

#CVE-2019-11730: Same-origin policy treats all files in a directory as having the same-origin

Reporter
Luigi Gubello
Impact
moderate
Description
A vulnerability exists where if a user opens a locally saved HTML file, this file can use file: URIs to access other files in the same directory or sub-directories if the names are known or guessed. The Fetch API can then be used to read the contents of any files stored in these directories and they may uploaded to a server. Luigi Gubello demonstrated that in combination with a popular Android messaging app, if a malicious HTML attachment is sent to a user and they opened that attachment in Firefox, due to that app's predictable pattern for locally-saved file names, it is possible to read attachments the victim received from other correspondents.
References

#CVE-2019-11723: Cookie leakage during add-on fetching across private browsing boundaries

Reporter
Andreas Wagner
Impact
low
Description
A vulnerability exists during the installation of add-ons where the initial fetch ignored the origin attributes of the browsing context. This could leak cookies in private browsing mode or across different 'containers' for people who use the Firefox Multi-Account Containers Web Extension.
References

#CVE-2019-11724: Retired site input.mozilla.org has remote troubleshooting permissions

Reporter
Frederik Braun
Impact
low
Description
Application permissions give additional remote troubleshooting permission to the site input.mozilla.org, which has been retired and now redirects to another site. This additional permission is unnecessary and is a potential vector for malicious attacks.
References

#CVE-2019-11725: Websocket resources bypass safebrowsing protections

Reporter
Andrey
Impact
low
Description
When a user navigates to site marked as unsafe by the Safebrowsing API, warning messages are displayed and navigation is interrupted but resources from the same site loaded through websockets are not blocked, leading to the loading of unsafe resources and bypassing safebrowsing protections.
References

#CVE-2019-11727: PKCS#1 v1.5 signatures can be used for TLS 1.3

Reporter
Hubert Kario
Impact
low
Description
A vulnerability exists where it possible to force Network Security Services (NSS) to sign CertificateVerify with PKCS#1 v1.5 signatures when those are the only ones advertised by server in CertificateRequest in TLS 1.3. PKCS#1 v1.5 signatures should not be used for TLS 1.3 messages.
References

#CVE-2019-11728: Port scanning through Alt-Svc header

Reporter
Trishita Tiwari, Ari Trachtenberg
Impact
low
Description
The HTTP Alternative Services header, Alt-Svc, can be used by a malicious site to scan all TCP ports of any host that the accessible to a user when web content is loaded.
References

#CVE-2019-11710: Memory safety bugs fixed in Firefox 68 and Thunderbird 68

Reporter
Mozilla developers and community
Impact
critical
Description
Mozilla developers and community members André Bargull, Christian Holler, Natalia Csoregi, Raul Gurzau, Daniel Varga, Jon Coppeard, Marcia Knous, Gary Kwong, Randell Jesup, David Bolter, Jeff Gilbert, and Deian Stefan reported memory safety bugs fixed in Firefox 68 and Thunderbird 68. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code.
References

#CVE-2019-11709: Memory safety bugs fixed in Firefox 68, Firefox ESR 60.8, and Thunderbird 68

Reporter
Mozilla developers and community
Impact
critical
Description
Mozilla developers and community members Andreea Pavel, Christian Holler, Honza Bambas, Jason Kratzer, and Jeff Gilbert reported memory safety bugs fixed in Firefox 68, Firefox ESR 60.8, and Thunderbird 68. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code.
References
You're already a Firefox God, so perhaps now is a good time to get acquainted with Mozilla's equally slick mail client: Thunderbird.
In July, Mozilla said it might spin off Thunderbird as a community project and focus instead on Firefox, but for now the excellent email software remains in the Mozilla family. Here we've assembled 110+ resources for both new users and Thunderbird regulars.

Thunderbird Themes

Modern Modoki – Nice looking theme based on the Fusion theme Netscape 8.

Crossover X – A smooth, simple theme with large toolbar buttons for better visibility.

Crossover – The original version of Crossover X, very similar in appearance but slight change in toolbar appearance.

Outlook 2003 SilverTB - A Outlook 2003 Theme in Silver to give the feeling of the Office look and a better integration in the Silver Windows XP Theme.

Black Japan – A black Thunderbird theme. Built to accompany the BlackJapan Firefox theme

Noia 2.0 eXtreme – Very nice silver Thunderbird theme. Large icons with nice blue highlights on rollover. Based on the matching Noia Firefox theme.

Own – A silver theme with Windows Vista style icons and the menus are based on Office 2007. Also compatible with Firefox and Sunbird.

Azerty Mail – Nice light Thunderbird theme with large comical, colorful menu icons.

Thunderbird Human - A Thunderbird theme that fits nicely into the default Human theme of Ubuntu's GNOME desktop. Utilizes a bit of the existing Tango for Thunderbird theme's styles for even better integration.

Harley Davidson - Mozilla theme for Harley Davidson enthusiasts.

Thunderstripe - An attempt to reproduce the Firefox Winstripe look for Thunderbird based on the existing Winstripe theme by Scratch and Mark Carson.

Aquabird Black – A black theme with glassy blue icons.

Outlook 2003 Blue TB - A Outlook 2003 Theme in Blue to give the feeling of the Office look and a better integration in the Luna Windows XP Theme.

Lopburi Flat – A thin, light and flat, minimalist theme for Thunderbird.

Futurama – Based on the Nautical Theme and features menu images from the Futurama television show.

Tango Icons for Thunderbird – Nice Icon set, large and colorful.

PitchDark for TB – A very dark, minimalist theme. Small icons and toolbars to maximize the main screens.

Whitehart TB – Based on the Whitehart theme for Firefox, this is a very clean and simple design.

MiniBird – The original Thunderbird theme, minimized for a maximum workspace.

Doodle Classic for Thunderbird – A light, simple, neutral colored theme, with somewhat whimsical menu icons.

Bible Thunderbird - A Christian Theme for Thunderbird 2.0 that goes with the Bible Fox.

Nasa Normal – A Thunderbird theme for all of you astronauts out there. Based on the Nasa Website it is out of this world.

GlowyBlue-tb - Dark blue, green and gold Thunderbird theme.

Walnut – For all of you workshop types, this is a wood grained theme with colorful menu icons that pop against the background.

Plastikthunder Crystal SVG - Plastik style from KDE with Crystal SVG icons for Firefox.

Micro Thunderbird – Based on the Little Fox, Firefox theme this theme has some retro styled menu icons and small interface allowing for a larger workspace.

Redmond Revisited – An Outlook Express inspired Thunderbird theme.

Aquabird – A light theme with glassy blue menu icons. Built to accompany the Aquatint Firefox theme.

Phoenity Thunderbird - A simple and colorful theme for everyone.

Le Breeze - A gray, minimal theme for Thunderbird based on flyson's Breeze originally developed by Kevin Davis.

Cobalt Thunderbird - A glassy blue interface for Thunderbird 2.0 that goes with Cobalt Firefox.

Outlook 2003 Green TB - A Outlook 2003 Theme in Green to give the feeling of the Office look and a better integration in the Green Windows XP Theme.

GlowyWine - Dark burgundy/red theme with ornamental gold menu icons.

Apple Mail - This theme makes your TB look and feel like the native Apple Mail software, that comes along wiht your shiny and flashy new Mac.

Tiger Mail - Thunderbird theme based on Mac OS X Tiger Mail 2.

WinMail - A Windows Mail v7.0 Theme to give the feeling of the Vista look and a better integration in some Vista-Themes for Windows XP.

Thunderbird Extensions and Add-ons

Greek Translator – A Thunderbird extension that translates English to Greek and vice versa.

Unselect Message - Prevents Thunderbird from selecting the next message after you've deleted or moved the previously selected ones. Stay in control of which message you want to have selected and displayed in the preview pane; that piece of spam you're deleting really shouldn't have a say in that.

Quick Note - A note taking extension with advanced features.

Purge - Add toolbar icons to purge (compact folders) and/or delete junk messages to your toolbar and thread context menu. Right-click on the toolbar and select Customise, then drag-n-drop the new icons to the toolbar.

Options Menu - An extension that provides quick access to the options dialogs of installed extensions.

Get Selected Messages - Adds the button on the toolbars 'Get Selected Messages', the analog of button from File->Offline->Get Selected Messages for loading selected messages by OneClick.

Externalize Strings - Extract strings from xml and javascript files to simplify mozilla application localization process. Regenerate XULs/DTDs and JSs/properties pair files with selected localized strings.

Same Place - Extensible instant messaging client based on the XMPP (Jabber) protocol.

Conversation Meta Language - The purpose of this extension is in the context of exchanging emails between two persons. It introduces a new point of view where email messages are composed of one or more ConvML threads which can either start a new topic or reference an older thread.

SyncMab – An extension that can import and export Mozilla address books on startup and exit of Thunderbird.

Orb VideoMail - Toolbar button for creating free Orb VideoMails of any length right from within Thunderbird.

Flat Style - This gives you a style similar to MS Office XP in your Thunderbird menus and toolbars, and Calendar as well if you have that installed. It also changes the category-selector in the options window to use your system colors, instead of always being blue.

World Weather - Display local weather information from around the world.

SearchWith – This extension allows you to search selected text with various search services. It adds a Search With sub menu on the context menu (right-click menu) with a configurable list of search services that can be used to search the highlighted text.

MinimizeToTry - Minimizes Mozilla windows into the system tray. Also includes a right clickable tray icon menu to further load only the windows you want visible.

RSS Editor - Desktop RSS editor for casual editing of RSS 2.0 files.

Newsgroup Links - Displays a link to the Google groups url of a newsgroup post, and an option to copy it.

Keyword Highlight - This extension helps you to catch messages to you or topics you are intrested in by highlighting your favorite keywords.

Message Notes - Add Notes to messages. Notes are stored in a plaintext file, typically in your profile. The plaintext notes file can be stored elsewhere to enable sharing of notes across a network.

Right Encoding - Adds the Character Encoding menu to the context menu.

Cert Viewer Plus - Adds two options to the certificate viewer in Firefox or Thunderbird. Also adds a shortcut to the Tools menu and keyboard for direct viewing of the Certificate Manager.

Mail Redirect – Allows Thunderbird to redirect or bounce, mail messages to other recipients.

BirdFon - A lightweight and elegant phone plugin, makes Thunderbird a speaking friend in your online life. With BirdFon you can call your friends in a way similar to the SkypeOut service.

Quicktext - An extension for Thunderbird that lets you create templates that can be easily inserted into your own emails.

UM Tools - Add new options to TB's Unsent Messages behavior. Like Send unsent every XX minutes
and Delete original unsent message when 'edit as new' is selected.

Dictionary Switcher - Displays the currently selected dictionary in the status bar and allows to change it.

Birthday Reminder - Birthday Reminder shows a list of upcoming birthdays for all contacts in Thunderbird's address book.

Linky – An extension designed to increase your power to handle links. Open, download and validate links and pictures in tabs or windows.

Gmail UI - Add concepts inspired by GMail to Thunderbird, like archiving mail and powerful message searching across all folders.

Smilie Inserter - Insert smilies in your messages. Just select a directory and all images in it will be displayed. A simple click will insert the image at the current location.

Country Lookup - Looks up the origin country and city of an e-mail message, using the IP address.

Scroll Menus on Drag - Scrolls menus when dragging, fixing bugs 194319, 240709, and 349932. Scrolls all autorepeatbuttons and prevents bookmarks menu hiding on all menuseparators.

Quickfile - An extension for Mozilla Thunderbird which initially aimed to speed up filing of messages into your mail folder heirarchy but now includes features for navigation and folder creation.

Open Long Url - Adds an option to your File menu to allow you to open long, multi-line, urls.

Sync on Arrival - Downloads new message headers (and bodies, if configured) immediately when Thunderbird detects new messages in an IMAP folder.

Edit HTML Source - You can now edit the HTML source in the Compose Window.

Del.icio.us Complete - del.icio.us Complete is a social bookmarks manager. It allows you to easily add sites you like to your personal collection of links, to categorize those sites with keywords, and to share your collection not only between your own browsers and machines, but also with others.

Switch Proxy Tool – Allows you to manage and switch between multiple proxy configurations quickly and easily.

Allow Local Addresses - Allows Thunderbird to send to addresses without a domain, for corporate / intranet use. Gets rid of that pesky 'not of the form user@host' message.

Stock Ticker - Shows your favorite stocks in a customizable ticker.

Javascript Debugger - Venkman is the code name for Mozilla's JavaScript Debugger. Venkman aims to provide a powerful JavaScript debugging environment for Mozilla based browsers.

Mouse Zoom - Zoom in with a click of the mouse.

Skype Toolbar for Thunderbird - Skype toolbar for Tunderbird. Combines the strenghts of Thunderbird and Skype to make it possible to call all of your Thunderbird contacts via Skype, see online presence information about an email sender and initiate any Skype communication via Skype directly from within Thunderbird including calls, chats, multichats, conferences, file transfers etc.

Signature – Add a signature or just insert custom text into posts and emails.

Addressbooks Synchronize - Synchronizes selected addressbooks including 'Personal Addressbook' and 'Collected Addresses' with local files (resp. files on network shares), files via FTP or WebDAV (http or https) and with files in IMAP folders.

TB Reset Quote Header – This extension will modify the look of the quote header on replies. Header templates are included.

Enigmail - Enigmail adds OpenPGP message encryption and authentication to your email client. It features automatic encryption, decryption and integrated key management functionality.

Notary - Adds a notes pane to the message view. Any text typed is stored against the message for later review. Very simple interface.

InfoRSS - Displays RSS, Atom, parsed HTML and NNTP feed in a scrolling area the status bar. Compatible with podcasting RSS which can be downloaded directly.

Edit as New - Adds an Edit As New button to the toolbar in the main window.

Empty Trash Toolbar Button - Adds a toolbar button to empty Thunderbird's Trash folder. You must add the button to your toolbar by right clicking the toolbar selecting 'customize' and dragging this new button to the toolbar.

Text Size Toolbar - Adds text size buttons to the toolbar.

Toggle Word Wrap - With Thunderbird, it comes in handy when inserting long text lines which should not get wrapped in the final message (such as log file entries). It only has an effect when using plain text mode for composition.

Tb AutoSave Extension - You can now autosave messages from Thunderbird upon receipt.

LookOut - LookOut is a plugin which allows Thunderbird to interface with Microsoft's mail tools by decoding metadata and attachments encapsulated/embedded in a TNEF encoded attachment (aka winmail.dat).

Display Quota - This extension will display the current status of your IMAP quota in thunderbird's statusbar and will warn you when you reach a configurable limit.

Identity Select - This extension allows you to choose the identity of your new email from a popup menu directly from the Write button. This feature behaves in a similar manner as the Get Mail pulldown menu. In addition, the default behavior of the Write button is now context sensitive.

Nokia Synchronization - Synchronize Thunderbird with your Nokia phone.

CallingID Advisor - Verifies the links you see in Firefox and Thunderbird are safe before you follow them. When the mouse is placed over any link a risk assessment and the full details of the site owner are displayed, helping you evaluate the site before visiting it.

ThunderBrowse - This extension adds a URL Bar and browsing functions to Thunderbird, thus allowing you to be able to view websites without having to open up new browsers.

Lightning Nightly Updater - Lightning Nightly Updater is an extension for Mozilla Thunderbird 2.0 and up. It adds a menu item to the Help toolbar menu, from which you can install the latest nightly build relevant to your OS and Tb version.

Stationery - Extension to mimic Outlook Express Stationery. Allows you to use HTML files as templates for mail and also will allow custom templates in replies or forwarded mail.

Add-ons

Inspector Widget - InspectorWidget (IW) adds a toolbar button and context menus for invoking the DOM Inspector (DOMi) for either chrome or content elements.

Forumzilla - Forumzilla lets you read news and blog feeds in your email application. It is similar to the feed reader built into Thunderbird, but it lets you download stories into any folder in any POP, IMAP, or local account (configurable per feed).