CVE-2020-15685: Mozilla Thunderbird

High severity, CVSS 8.8. EPSS: 0.8% chance of exploitation in the next 30 days.

During the plaintext phase of the STARTTLS connection setup, protocol commands could have been injected and evaluated within the encrypted session. This vulnerability affects Thunderbird < 78.7.

Affected products

• Mozilla Thunderbird: before 78.7.0 (fixed in 78.7.0)

Published 2022-12-22. Last modified 2026-06-17.