# thunderbird 1:78.8.1+build1-0ubuntu0.18.04.1: thunderbird 1:78.8.1+build1-0ubuntu0.18.04.1 for Ubuntu 18.04.6 LTS (bionic)

thunderbird 1:78.8.1+build1-0ubuntu0.18.04.1, released April 22, 2021, fixes 56 CVEs in thunderbird. None of them is reported as exploited. Patch Radar priority: Urgent. The product is no longer supported.

- Web page: https://patchblox.com/security/fix/linux/ubuntu-bionic-thunderbird-1-78.8.1-build1-0ubuntu0.18.04.1
- Platform: Linux
- Released: Apr 22, 2021
- Priority: Urgent (Closes CVE-2020-26950, rated Critical)
- CVEs: 56, exploited: 0, on CISA KEV: 0

## Applies to

| Product | Release | Fixed in |
|---|---|---|
| [thunderbird](https://patchblox.com/security/data/product/linux/thunderbird.md) | Ubuntu 18.04.6 LTS (bionic) | 1:78.8.1+build1-0ubuntu0.18.04.1 |

## CVEs this fix closes

| CVE | Priority | Title | CVSS | EPSS | Exploitation |
|---|---|---|---:|---:|---|
| [CVE-2020-26950](https://patchblox.com/security/data/cve/CVE-2020-26950.md) | Urgent | Firefox ESR and 2 others: In certain circumstances, the MCallGetProperty opcode can be emitted with unmet assumptions resulting… | 8.8 | 0.4233 |  |
| [CVE-2021-23978](https://patchblox.com/security/data/cve/CVE-2021-23978.md) | Urgent | Firefox ESR and 2 others: Mozilla developers reported memory safety bugs present in Firefox 85 and Firefox ESR 78.7. | 8.8 | 0.0153 |  |
| [CVE-2021-23973](https://patchblox.com/security/data/cve/CVE-2021-23973.md) | Urgent | Firefox ESR and 2 others: When trying to load a cross-origin resource in an audio/video context a decoding error may have resulted,… | 6.5 | 0.0137 |  |
| [CVE-2020-16044](https://patchblox.com/security/data/cve/CVE-2020-16044.md) | Urgent | Chromium CVE-2020-16044: Use after free in WebRTC | 8.8 | 0.0132 |  |
| [CVE-2021-23968](https://patchblox.com/security/data/cve/CVE-2021-23968.md) | Urgent | Firefox ESR and 2 others: If Content Security Policy blocked frame navigation, the full destination of a redirect served in the… | 4.3 | 0.0131 |  |
| [CVE-2021-23969](https://patchblox.com/security/data/cve/CVE-2021-23969.md) | Urgent | Firefox ESR and 2 others: As specified in the W3C Content Security Policy draft, when creating a violation report, "User agents… | 4.3 | 0.0121 |  |
| [CVE-2020-6463](https://patchblox.com/security/data/cve/CVE-2020-6463.md) | High | firefox: ELSA-2020-3241: firefox security update (IMPORTANT) | 8.8 | 0.0327 |  |
| [CVE-2020-15683](https://patchblox.com/security/data/cve/CVE-2020-15683.md) | High | Firefox ESR and 2 others: Mozilla developers and community members reported memory safety bugs present in Firefox 81 and Firefox… | 9.8 | 0.0267 |  |
| [CVE-2020-15659](https://patchblox.com/security/data/cve/CVE-2020-15659.md) | High | Firefox ESR and 2 others: Mozilla developers and community members reported memory safety bugs present in Firefox 78 and Firefox… | 8.8 | 0.0239 |  |
| [CVE-2020-15673](https://patchblox.com/security/data/cve/CVE-2020-15673.md) | High | Firefox ESR and 2 others: Mozilla developers reported memory safety bugs present in Firefox 80 and Firefox ESR 78.2. | 8.8 | 0.0196 |  |
| [CVE-2020-12422](https://patchblox.com/security/data/cve/CVE-2020-12422.md) | High | Firefox ESR: In non-standard configurations, a JPEG image created by JavaScript could have caused an internal variable… | 8.8 | 0.0194 |  |
| [CVE-2020-26971](https://patchblox.com/security/data/cve/CVE-2020-26971.md) | High | Firefox ESR and 2 others: Certain blit values provided by the user were not properly constrained leading to a heap buffer overflow… | 8.8 | 0.0190 |  |
| [CVE-2020-15678](https://patchblox.com/security/data/cve/CVE-2020-15678.md) | High | Firefox ESR and 2 others: When recursing through graphical layers while scrolling, an iterator may have become invalid, resulting… | 8.8 | 0.0188 |  |
| [CVE-2020-15969](https://patchblox.com/security/data/cve/CVE-2020-15969.md) | High | firefox: ELSA-2020-4317: firefox security update (IMPORTANT) | 8.8 | 0.0174 |  |
| [CVE-2020-26973](https://patchblox.com/security/data/cve/CVE-2020-26973.md) | High | Firefox ESR and 2 others: Certain input to the CSS Sanitizer confused it, resulting in incorrect components being removed. | 8.8 | 0.0162 |  |
| [CVE-2020-12426](https://patchblox.com/security/data/cve/CVE-2020-12426.md) | High | Firefox ESR: Mozilla developers and community members reported memory safety bugs present in Firefox 77. | 8.8 | 0.0161 |  |
| [CVE-2020-35113](https://patchblox.com/security/data/cve/CVE-2020-35113.md) | High | Firefox ESR and 2 others: Mozilla developers reported memory safety bugs present in Firefox 83 and Firefox ESR 78.5. | 8.8 | 0.0157 |  |
| [CVE-2020-26960](https://patchblox.com/security/data/cve/CVE-2020-26960.md) | High | Firefox ESR and 2 others: If the Compact() method was called on an nsTArray, the array could have been reallocated without updating… | 8.8 | 0.0156 |  |
| [CVE-2020-26974](https://patchblox.com/security/data/cve/CVE-2020-26974.md) | High | Firefox ESR and 2 others: When flex-basis was used on a table wrapper, a StyleGenericFlexBasis object could have been incorrectly… | 8.8 | 0.0153 |  |
| [CVE-2020-15656](https://patchblox.com/security/data/cve/CVE-2020-15656.md) | High | Firefox ESR and 2 others: JIT optimizations involving the Javascript arguments object could confuse later optimizations. | 8.8 | 0.0152 |  |
| [CVE-2020-26968](https://patchblox.com/security/data/cve/CVE-2020-26968.md) | High | Firefox ESR and 2 others: Mozilla developers reported memory safety bugs present in Firefox 82 and Firefox ESR 78.4. | 8.8 | 0.0151 |  |
| [CVE-2021-23964](https://patchblox.com/security/data/cve/CVE-2021-23964.md) | High | Firefox ESR and 2 others: Mozilla developers reported memory safety bugs present in Firefox 84 and Firefox ESR 78.6. | 8.8 | 0.0136 |  |
| [CVE-2020-12416](https://patchblox.com/security/data/cve/CVE-2020-12416.md) | High | Firefox ESR: A VideoStreamEncoder may have been freed in a race condition with VideoBroadcaster::AddOrUpdateSink,… | 8.8 | 0.0135 |  |
| [CVE-2020-26959](https://patchblox.com/security/data/cve/CVE-2020-26959.md) | High | Firefox ESR and 2 others: During browser shutdown, reference decrementing could have occured on a previously freed object, resulting… | 8.8 | 0.0130 |  |
| [CVE-2021-23960](https://patchblox.com/security/data/cve/CVE-2021-23960.md) | High | Firefox ESR and 2 others: Performing garbage collection on re-declared JavaScript variables resulted in a user-after-poison, and… | 8.8 | 0.0129 |  |
| [CVE-2020-26970](https://patchblox.com/security/data/cve/CVE-2020-26970.md) | High | Thunderbird: When reading SMTP server status codes, Thunderbird writes an integer value to a position on the stack… | 8.8 | 0.0125 |  |
| [CVE-2021-23954](https://patchblox.com/security/data/cve/CVE-2021-23954.md) | High | Firefox ESR and 2 others: Using the new logical assignment operators in a JavaScript switch statement could have caused a type… | 8.8 | 0.0119 |  |
| [CVE-2020-15669](https://patchblox.com/security/data/cve/CVE-2020-15669.md) | High | firefox: ELSA-2020-3557: firefox security update (IMPORTANT) | 8.8 | 0.0112 |  |
| [CVE-2020-15670](https://patchblox.com/security/data/cve/CVE-2020-15670.md) | High | Firefox ESR and 2 others: Mozilla developers reported memory safety bugs present in Firefox for Android 79. | 8.8 | 0.0107 |  |
| [CVE-2020-15685](https://patchblox.com/security/data/cve/CVE-2020-15685.md) | High | Thunderbird: Improper Neutralization of Special Elements used in a Command ('Command Injection') | 8.8 | 0.0088 |  |
| [CVE-2021-29950](https://patchblox.com/security/data/cve/CVE-2021-29950.md) | High | Thunderbird: Thunderbird unprotects a secret OpenPGP key prior to using it for a decryption, signing or key import… | 7.5 | 0.0085 |  |
| [CVE-2020-6514](https://patchblox.com/security/data/cve/CVE-2020-6514.md) | Routine | chromium-browser-l10n: Inappropriate implementation in WebRTC in Google Chrome prior to 84.0.4147.89 allowed an attacker in a privileged net... | 6.5 | 0.0779 |  |
| [CVE-2020-16012](https://patchblox.com/security/data/cve/CVE-2020-16012.md) | Routine | Firefox ESR and 1 other: Side-channel information leakage in graphics in Google Chrome prior to 87.0.4280.66 allowed a remote… | 4.3 | 0.0257 |  |
| [CVE-2020-15677](https://patchblox.com/security/data/cve/CVE-2020-15677.md) | Routine | Firefox ESR and 2 others: By exploiting an Open Redirect vulnerability on a website, an attacker could have spoofed the site displayed… | 6.1 | 0.0166 |  |
| [CVE-2020-26976](https://patchblox.com/security/data/cve/CVE-2020-26976.md) | Routine | Firefox ESR and 1 other: When a HTTPS pages was embedded in a HTTP page, and there was a service worker registered for the former,… | 6.5 | 0.0164 |  |
| [CVE-2020-12424](https://patchblox.com/security/data/cve/CVE-2020-12424.md) | Routine | Firefox ESR: When constructing a permission prompt for WebRTC, a URI was supplied from the content process. | 6.5 | 0.0161 |  |
| [CVE-2020-15676](https://patchblox.com/security/data/cve/CVE-2020-15676.md) | Routine | Firefox ESR and 2 others: Firefox sometimes ran the onload handler for SVG elements that the DOM sanitizer decided to remove, resulting… | 6.1 | 0.0159 |  |
| [CVE-2020-12425](https://patchblox.com/security/data/cve/CVE-2020-12425.md) | Routine | Firefox ESR: Due to confusion processing a hyphen character in Date.parse(), a one-byte out of bounds read could have… | 6.5 | 0.0157 |  |
| [CVE-2020-15655](https://patchblox.com/security/data/cve/CVE-2020-15655.md) | Routine | Firefox ESR and 2 others: A redirected HTTP request which is observed or modified through a web extension could bypass existing… | 6.5 | 0.0152 |  |
| [CVE-2020-35111](https://patchblox.com/security/data/cve/CVE-2020-35111.md) | Routine | Firefox ESR and 2 others: When an extension with the proxy permission registered to receive <all_urls>, the proxy.onRequest callback… | 4.3 | 0.0143 |  |
| [CVE-2020-15654](https://patchblox.com/security/data/cve/CVE-2020-15654.md) | Routine | Firefox ESR and 2 others: When in an endless loop, a website specifying a custom cursor using CSS could make it look like the user… | 6.5 | 0.0142 |  |
| [CVE-2020-15653](https://patchblox.com/security/data/cve/CVE-2020-15653.md) | Routine | Firefox ESR and 2 others: An iframe sandbox element with the allow-popups flag could be bypassed when using noopener links. | 6.5 | 0.0140 |  |
| [CVE-2020-15664](https://patchblox.com/security/data/cve/CVE-2020-15664.md) | Routine | Firefox ESR and 2 others: By holding a reference to the eval() function from an about:blank window, a malicious webpage could have… | 6.5 | 0.0139 |  |
| [CVE-2020-15658](https://patchblox.com/security/data/cve/CVE-2020-15658.md) | Routine | Firefox ESR and 2 others: The code for downloading files did not properly take care of special characters, which led to an attacker… | 6.5 | 0.0139 |  |
| [CVE-2020-26958](https://patchblox.com/security/data/cve/CVE-2020-26958.md) | Routine | Firefox ESR and 2 others: Firefox did not block execution of scripts with incorrect MIME types when the response was intercepted… | 6.1 | 0.0136 |  |
| [CVE-2020-26978](https://patchblox.com/security/data/cve/CVE-2020-26978.md) | Routine | Firefox ESR and 2 others: Using techniques that built on the slipstream research, a malicious webpage could have exposed both an… | 6.1 | 0.0133 |  |
| [CVE-2020-26953](https://patchblox.com/security/data/cve/CVE-2020-26953.md) | Routine | Firefox ESR and 2 others: It was possible to cause the browser to enter fullscreen mode without displaying the security UI; thus… | 4.3 | 0.0129 |  |
| [CVE-2020-12415](https://patchblox.com/security/data/cve/CVE-2020-12415.md) | Routine | Firefox ESR: When "%2F" was present in a manifest URL, Firefox's AppCache behavior may have become confused and allowed… | 6.5 | 0.0127 |  |
| [CVE-2020-15652](https://patchblox.com/security/data/cve/CVE-2020-15652.md) | Routine | Firefox ESR and 2 others: By observing the stack trace for JavaScript errors in web workers, it was possible to leak the result… | 6.5 | 0.0126 |  |
| [CVE-2020-26965](https://patchblox.com/security/data/cve/CVE-2020-26965.md) | Routine | Firefox ESR and 2 others: Some websites have a feature "Show Password" where clicking a button will change a password field into… | 6.5 | 0.0126 |  |
| [CVE-2020-26956](https://patchblox.com/security/data/cve/CVE-2020-26956.md) | Routine | Firefox ESR and 2 others: In some cases, removing HTML elements during sanitization would keep existing SVG event handlers and… | 6.1 | 0.0123 |  |
| [CVE-2020-26961](https://patchblox.com/security/data/cve/CVE-2020-26961.md) | Routine | Firefox ESR and 2 others: When DNS over HTTPS is in use, it intentionally filters RFC1918 and related IP ranges from the responses… | 6.5 | 0.0117 |  |
| [CVE-2020-15648](https://patchblox.com/security/data/cve/CVE-2020-15648.md) | Routine | Firefox ESR: Using object or embed tags, it was possible to frame other websites, even if they disallowed framing… | 6.5 | 0.0114 |  |
| [CVE-2020-16042](https://patchblox.com/security/data/cve/CVE-2020-16042.md) | Routine | firefox: ELSA-2020-5562-1: firefox security update (IMPORTANT) | 6.5 | 0.0111 |  |
| [CVE-2021-23953](https://patchblox.com/security/data/cve/CVE-2021-23953.md) | Routine | Firefox ESR and 2 others: If a user clicked into a specifically crafted PDF, the PDF reader could be confused into leaking cross-origin… | 4.3 | 0.0106 |  |
| [CVE-2020-26951](https://patchblox.com/security/data/cve/CVE-2020-26951.md) | Routine | Firefox ESR and 2 others: A parsing and event loading mismatch in Firefox's SVG code could have allowed load events to fire, even… | 6.1 | 0.0105 |  |

---

Data as of 2026-11-13T20:04:13Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.