medium 6.5

CVE-2023-0616 json

If a MIME email combines OpenPGP and OpenPGP MIME data in a certain way Thunderbird repeatedly attempts to process and display the message,…

published 2023-06-02 3 y ago modified 2026-10-24 15 d ago also EUVD-2023-12651

cvss: 6.5; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.5%; EPSS 0.5% chance of exploitation in 30 days, percentile 42%
public exploits: 0; none known

If a MIME email combines OpenPGP and OpenPGP MIME data in a certain way Thunderbird repeatedly attempts to process and display the message, which could cause Thunderbird's user interface to lock up and no longer respond to the user's actions. An attacker could send a crafted message with this structure to attempt a DoS attack. This vulnerability affects Thunderbird < 102.8.

Patch / fix

fixed in 1 distros 7

Mozilla Thunderbird 102.8

debian ubuntu red hat suse opensuse almalinux rocky linux

thunderbird Debian 14, Debian 13, Debian 12 1:102.8.0-1

debian advisories DEBIAN-CVE-2023-0616

thunderbird Ubuntu 18.04 LTS 1:102.8.0+build2-0ubuntu0.18.04.1
thunderbird Ubuntu 20.04 LTS 1:102.8.0+build2-0ubuntu0.20.04.1
thunderbird Ubuntu 22.04 LTS 1:102.8.0+build2-0ubuntu0.22.04.1

ubuntu advisories UBUNTU-CVE-2023-0616

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

thunderbird RHEL 9 102.8.0-2.el9_1
thunderbird RHEL 8 102.8.0-2.el8_7
thunderbird RHEL 7 102.8.0-2.el7_9
thunderbird RHEL 8.2 TUS, RHEL 8.2 E4S, RHEL 8.2 AUS 102.8.0-2.el8_2
thunderbird RHEL 9.0 EUS 102.8.0-2.el9_0
thunderbird RHEL 8.1 E4S 102.8.0-2.el8_1
thunderbird RHEL 8.6 EUS 102.8.0-2.el8_6
thunderbird RHEL 8.4 EUS 102.8.0-2.el8_4

red hat advisories RHSA-2023:0824 RHSA-2023:0821 RHSA-2023:0819 RHSA-2023:0823 RHSA-2023:0817 RHSA-2023:0818

MozillaThunderbird SLE Workstation Extension 15 SP4, SLE Module for Package Hub 15 SP4, openSUSE Leap 15.4 102.8.0-150200.8.105.2

suse advisories SUSE-SU-2023:0599-1

MozillaThunderbird openSUSE Tumbleweed 102.8.0-1.1

opensuse advisories openSUSE-SU-2024:12713-1

thunderbird AlmaLinux 8 102.8.0-2.el8_7.alma
thunderbird AlmaLinux 9 102.8.0-2.el9_1.alma

almalinux advisories ALSA-2023:0821 ALSA-2023:0824

thunderbird Rocky Linux 9 102.8.0-2.el9_1
thunderbird Rocky Linux 8 102.8.0-2.el8_7

rocky linux advisories RLSA-2023:0824 RLSA-2023:0821

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2023-0616 updated 2026-11-07 cvss 4.3

Mozilla: User Interface lockup with messages combining S/MIME and OpenPGP

Red Hat Enterprise Linux 6 thunderbird
affected: no fix planned “Out of support scope”
Red Hat Enterprise Linux AppStream (v. 8) thunderbird 102.8.0-2.el8_7
fixed: vendor fix RHSA-2023:0821
Red Hat Enterprise Linux AppStream (v. 9) thunderbird 102.8.0-2.el9_1
fixed: vendor fix RHSA-2023:0824
Red Hat Enterprise Linux AppStream AUS (v. 8.2) thunderbird 102.8.0-2.el8_2
fixed: vendor fix RHSA-2023:0819
Red Hat Enterprise Linux AppStream E4S (v. 8.1) thunderbird 102.8.0-2.el8_1
fixed: vendor fix RHSA-2023:0818
Red Hat Enterprise Linux AppStream E4S (v. 8.2) thunderbird 102.8.0-2.el8_2
fixed: vendor fix RHSA-2023:0819
Red Hat Enterprise Linux AppStream EUS (v.8.4) thunderbird 102.8.0-2.el8_4
fixed: vendor fix RHSA-2023:0820
Red Hat Enterprise Linux AppStream EUS (v.8.6) thunderbird 102.8.0-2.el8_6
fixed: vendor fix RHSA-2023:0822

show 3 more

Red Hat Enterprise Linux AppStream EUS (v.9.0) thunderbird 102.8.0-2.el9_0
fixed: vendor fix RHSA-2023:0823
Red Hat Enterprise Linux AppStream TUS (v. 8.2) thunderbird 102.8.0-2.el8_2
fixed: vendor fix RHSA-2023:0819
Red Hat Enterprise Linux Client (v. 7) thunderbird 102.8.0-2.el7_9 Red Hat Enterprise Linux Server Optional (v. 7) thunderbird 102.8.0-2.el7_9 Red Hat Enterprise Linux Workstation (v. 7) thunderbird 102.8.0-2.el7_9
fixed: vendor fix RHSA-2023:0817

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 21 mo ago (2025-01-10)

Exploit prediction

0.49% chance of exploitation in the next 30 days, higher than 42% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CISA ADP	3.1	6.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
NVD	3.1	6.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CNA	3.1	6.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Affected products

Mozilla Thunderbird

Classification

Weakness

CWE-770 Allocation of Resources Without Limits or Throttling
CWE-400 Uncontrolled Resource Consumption

References

mozilla.org /security/advisories/mfsa2023-07/
vendor-advisory
bugzilla.mozilla.org /show_bug.cgi?id=1806507
issue-tracking, permissions-required, vendor-advisory

Sources

CVE List CVE-2023-0616
NVD CVE-2023-0616

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary