The email client should pick up the update upon its next startup automatically. Thunderbird users can alternatively use the Help > Check For Updates function in the email client or visit the Mozilla Thunderbird website to obtain the update. The vulnerability, which was disclosed on August 1 is not only affecting the email client but also other Mozilla applications included Mozilla Firefox 3.5 or Firefox 3.0.13.

IOActive security researcher Dan Kaminsky reported a mismatch in the treatment of domain names in SSL certificates between SSL clients and the Certificate Authorities (CA) which issue server certificates. In particular, if a malicious person requested a certificate for a host name with an invalid null character in it most CAs would issue the certificate if the requester owned the domain specified after the null, while most SSL clients (browsers) ignored that part of the name and used the unvalidated part in front of the null. This made it possible for attackers to obtain certificates that would function for any site they wished to target. These certificates could be used to intercept and potentially alter encrypted communication between the client and a server such as sensitive bank account transactions.

Related posts

• Thunderbird Security Update To 2.0.0.17 (0)
• Thunderbird 2.0.0.16 Out (0)
• Email Client: Thunderbird 2.0.0.21 (1)
• Thunderbird Quick Folders (2)
• Thunderbird Email Thread Visualizer (2)

Thunderbird users should therefor make sure that they download and install the new version of the desktop email client as soon as possible. The download is available for all supported operating systems (Microsoft Windows, Linux and Apple OS)

The portable version of Thunderbird 2.0.22 has already been created by Caschy. It can be downloaded from his website directly.

Users who want to know about the changes before they update the client should check the release notes page frequently. It won’t be long until the page gets updated as well.

Related posts

• Thunderbird Security Update To 2.0.0.17 (0)
• Thunderbird Delete Confirmations (0)
• Thunderbird 3 Beta 1 (5)
• Mozilla Thunderbird 2.0.0.18 (1)
• Email Client: Thunderbird 2.0.0.21 (1)

Although the Thunderbird 2.0.0.21 release notes page is already up it has not been fully updated with information regarding this release. It mentions security related fixes in this version of Thunderbird but the link points to a page that has not been updated yet. The download link on the release notes page is also pointing to Thunderbird 2.0.0.19 and not the current release.

Many users would probably want to update their email client immediately after reading that it contains patches for security issues. Several users reminded us last time we posted a link to a release of Firefox and Thunderbird that we should not do so. So, no link for now which is kinda stupid as everyone with half a brain will be able to find the Mozilla ftp site with the download link of Thunderbird 2.0.0.21.

Everyone else will have to sit tight with an insecure version of Thunderbird until the official distribution process has been completed and the update is officially announced.

Some add-ons might stop working after installing Thunderbird 2.0.0.21. You could try and change the allowed version number manually or wait for the software developer to update the add-on for the email client.

Related posts

• Two Quick Email Tips To Save The Day (19)
• Thunderbird Security Update To 2.0.0.17 (0)
• Thunderbird Quick Folders (2)
• Thunderbird Email Thread Visualizer (2)
• Thunderbird Email Address Crawler (0)

The update is a security update and it is therefor recommended to update immediately if Thunderbird is installed and in use on a computer system.

Interested users can take a look at the release notes for the new version which contain a link to the security issues that have been fixed.

The update fixes the following two critical and five moderate security vulnerabilities that can be exploited in earlier versions of the mail client:

• MFSA 2008-46 Heap overflow when canceling newsgroup message
• MFSA 2008-44 resource: traversal vulnerabilities
• MFSA 2008-43 BOM characters stripped from JavaScript before execution
• MFSA 2008-42 Crashes with evidence of memory corruption (rv:1.9.0.2/1.8.1.17)
• MFSA 2008-41 Privilege escalation via XPCnativeWrapper pollution
• MFSA 2008-38 nsXMLDocument::OnChannelRedirect() same-origin violation
• MFSA 2008-37 UTF-8 URL stack buffer overflow

The update checks in the email client can be used to download the latest version. Users find that option in the Help > Check for Updates menu in Thunderbird. Everyone else can use the link posted above to download the email client Thunderbird from the official Mozilla website.

Related posts

• Thunderbird 2.0.0.16 Out (0)
• Thunderbird 2.0.0.12 has been released (2)
• Move Thunderbird Email Profiles To Another Location (3)
• Email Client: Thunderbird 2.0.0.21 (1)
• Email Client Thunderbird 2.0.22 (2)

The same security vulnerabilities that have been fixed in Firefox 2.0.0.6 have also been fixed in Thunderbird which means that you should update immediately to the latest version. As far as I can tell there are no new features in this version, at least all my extensions are still working fine.

The Rumbling Edge lists the following three fixes for Thunderbird 2.0.0.6

Fixed: MFSA 2007-27 – Unescaped URIs passed to external programs (Critical)
Fixed: MFSA 2007-26 – Privilege escalation through chrome-loaded about:blank windows (Moderate)
Fixed: 389106 – firefox may not escape quotes everywhere

Related posts

• Thunderbird Security Update To 2.0.0.17 (0)
• Thunderbird 2.0.0.4 released (1)
• Email Client: Thunderbird 2.0.0.21 (1)
• Email Client Thunderbird 2.0.22 (2)
• Email Client Mozilla Thunderbird 2.0.0.23 Update (1)

If you can’t wait to get your hands on the latest version you could download the latest Thunderbird release for Windows, Mac or Linux.

The latest official version at this moment is version 2.0.0.0 and a lot of security patches and bug fixes have been implemented in this new version of Thunderbird.

According to the Rumbling Edge there have been 21 changes in the latest version of Thunderbird. Most notably are fixed security issue and one crash issue.

The official release notes have not been updated yet to reflect the changes of this new release of Thunderbird.

It is most likely that they will be updated once the version will be officially announced on the Thunderbird homepage and become available through the automatic update option from within Thunderbird.

found: neowin forum

Related posts

• Thunderbird Security Update To 2.0.0.17 (0)
• Email Client: Thunderbird 2.0.0.21 (1)
• Email Client Thunderbird 2.0.22 (2)
• Email Client Mozilla Thunderbird 2.0.0.23 Update (1)
• Why I’m Still Using A Software Email Client (17)