Mozilla Thunderbird OpenPGP Message Misrepresentation Vulnerability

A vulnerability exists in certain versions of Mozilla Thunderbird where crafted MIME email messages were incorrectly displayed as encrypted. This issue arises when a message claims to contain an encrypted OpenPGP message but actually includes an OpenPGP signed message instead. The vulnerability affects Thunderbird versions prior to 136 and prior to 128.8.

Impact

This vulnerability could lead to confusion about the encryption status of OpenPGP messages, potentially allowing sensitive information to be mismanaged or improperly disclosed.

Remediation

Users can upgrade to Thunderbird 136 or Thunderbird 128.8 to address this vulnerability.