Slashdot Mirror

← Back to Stories (view on slashdot.org)

Mozilla Patches Critical Bug in Thunderbird (threatpost.com)

Posted by msmash on from the fixing-things dept.

Mozilla has issued a critical security update to its popular open-source Thunderbird email client. From a report The patch was part of a December release of five fixes that included two bugs rated high and one rated moderate and another low. Mozilla said Thunderbird, which is also serves as a news, RSS and chat client, the latest Thunderbird 52.5.2 version released last week fixes the vulnerabilities. The most serious of the fixes is a critical buffer overflow bug (CVE-2017-7845) impacting Thunderbird running on Windows operating system. The bug is present when "drawing and validating elements with angle library using Direct 3D 9," according to the Mozilla Foundation Security Advisory. US-Cert said it encourages users and administrators to review the patch and apply the necessary update.

45 of 76 comments (clear)

  1. Does Thunderbird still matter? by bogaboga · · Score: 1, Interesting

    I ask because in my [limited] professional life, I know of exactly zero entities using this software.

    Am I missing out on anything? Can someone more knowledgeable advise me of why I should use Thunderbird over Outlook or GMail?

    1. Re:Does Thunderbird still matter? by SadOldTechie · · Score: 4, Informative

      Thunderbird is open source if that's of consequence to you. It's freely available and not paid for like Outlook. It will also store your email locally so that if you are offline you can still get your email and not rely on cloud providers to always be available to you.

    2. Re:Does Thunderbird still matter? by nctritech · · Score: 4, Informative

      Thunderbird can two-way sync with Google Calendar and Contacts. Outlook didn't the last time I checked, although I hear it can as of the newest version.

      Outlook stores everything in a huge PST file; Thunderbird uses textual mbox files and a simple directory structure.

      Moving a Thunderbird profile (which includes all settings, contacts, mail, saved passwords, accounts, everything) from one place to another is as simple as copying the ~/.thunderbird or %appdata%\Thunderbird folder to the same place in the other user account; Outlook has to be set up from scratch every single time and have the PST files imported and the placeholder empty PST they forcibly create (again, perhaps not with newer versions) disabled and deleted manually.

      Thunderbird is light-years faster than Outlook.

      Thunderbird is open source.

      Thunderbird works on Linux.

      Thunderbird is free as in both beer and freedom.

      Thunderbird has better view options, a simpler interface, a massively better heuristic junk mail filter, way nicer IMAP integration (none of that strike-through nonsense when you delete mail), and it even handles RSS feeds extremely well.

      Relative to Gmail, it's a local mail app so it's much faster to work with, it's less confusing that Gmail, the icons for everything are clearer than the stupid decisions made by Gmail, and the folder organization is much easier to use than the brain-dead "labels-as-folders" in Gmail.

      The message filter capabilities are way better and more useful than both Outlook and Gmail, the search functionality is more robust than both, and searches can be saved as "search folders" that dynamically build based on a desired search.

      I could go on, but I think you get the idea. Source: used Thunderbird for roughly a decade, converted many businesses to it despite external pressures to use Outlook.

      Oh, one tip: if someone sends an Outlook-specific winmail.dat email to you, get the LookOut extension for Thunderbird and it'll let you view it as a normal email.

    3. Re:Does Thunderbird still matter? by jawtheshark · · Score: 1, Informative
      To me it does. I don't like webmail. I like to have a locally executed email client with locally cached email. Since I don't use Windows, and thus don't run Outlook (which is a joke of an email client any way, if you're not using Exchange), I have not much modern options any more. Thunderbird is basically the email client use when you prefer the open source solutions. Thunderbird seems to be the best choice, and the fact that it was a bit neglected by Mozilla had the added advantage that they didn't fuck it up as badly as Firefox.

      Well, they still did... I still wonder what was wrong with simple menus. The hamburger menu is just so dumb on desktop applications. (Hell, even on mobile it's just a cop-out)

      --
      Ahhh...the great dumpster continuum. Many a free computer will be found there. -- sowth (748135)
    4. Re:Does Thunderbird still matter? by thegreatbob · · Score: 1

      Anecdotal: Outlook crashes/hangs/just stops communicating with the internet on a somewhat regular basis, though I can't say it's a daily occurrence where I work. In a company of 30-50, it seems I need to fiddle with something on someone's computer once every few days. Also very aggressive about trying to use IPv6, even on a network that does not have it enabled, and takes ages to launch with large (multi-GB) PST files (though it is not as bad as it was many years ago). We had one fellow whose instance would reliably crash the first time it was launched, every single day, even after uninstall/purge/reinstall; no cause for that was ever found. Several of my coworkers, as well as myself, run Thunderbird, and nobody has reported any issues whatsoever. Regarding gmail (as a web service), it's very nice to be able to access all of your e-mail while completely disconnected from the Internet... webmail is nice, but completely useless when your Internet sucks. Gmail does support IMAP/SMTP, which I use at home (though via SeaMonkey, mostly for the heck of it).

      --
      There is no XUL, only WebExtensions...
    5. Re:Does Thunderbird still matter? by Futurepower(R) · · Score: 1

      Thanks!!!

      You said, "I could go on..." Please do.

      Outlook changes the font and font size. Outlook puts non-HTML codes in HTML.

    6. Re:Does Thunderbird still matter? by thegreatbob · · Score: 1

      Will LookOut survive the WebExtensions shift? Only time will tell... though I feel it has a better chance of pulling through than the EWS plugin I use for dealing with Exchange calendars...

      --
      There is no XUL, only WebExtensions...
    7. Re:Does Thunderbird still matter? by Lunix+Nutcase · · Score: 1

      Yeah, I love when a program has years-old security bugs because Mozilla had all but abandoned it for years. That inspires lots of confidence.

    8. Re:Does Thunderbird still matter? by nctritech · · Score: 1

      I don't think Thunderbird is receiving the WebExtensions architecture. At least, I have heard nothing of that sort. Mozilla has basically stated that they're leaving Thunderbird alone and I think that's a good thing. While WebExtensions may be appropriate for a browser long-term, Thunderbird is not a browser and the added capabilities of "legacy" extensions to latch into deeper parts of the Thunderbird framework are arguably far more important than on Firefox.

    9. Re:Does Thunderbird still matter? by nctritech · · Score: 1

      Keyboard shortcuts for handy things, even obscure ones. CTRL+U for "view message source" for example. This makes certain techie tasks way easier. To send a full message source to Spamcop's web interface, I just hold CTRL and go U, A, C, W, release CTRL, then ALT+TAB to Firefox and CTRL+V in the text box.

      Since Thunderbird is based on Firefox's runtime, things like CTRL+[scroll wheel] zoom the contents of the message body as expected. If some asshole thinks it's funny to send 7-point light grey text (every unsubscribe line in every marketing email ever) you've got an easy way around that. You can also View - Message Body As - Plain Text, or ALT+V, B, P.

      Thunderbird contacts can do mailing lists. Using the Mail Merge extension as described here you can send letters to those mailing lists using auto-filled variables; no need for third-party programs to send emails to a small mailing list.

      I'd say more things but I have work to do. Needless to say, there's a lot of goodies in Thunderbird once you start digging. I hate Outlook so very much because I'm spoiled by Thunderbird.

    10. Re:Does Thunderbird still matter? by jofas · · Score: 1

      WTF? What is this, 2006? Evolution does all this and actually works with Exchange and O365 accounts.

    11. Re:Does Thunderbird still matter? by thegreatbob · · Score: 3, Informative

      I made mention of this because this story came out yesterday: https://tech.slashdot.org/stor...

      --
      There is no XUL, only WebExtensions...
    12. Re:Does Thunderbird still matter? by jofas · · Score: 1

      Again, Evolution does everything Thunderbird did 10 years ago (better) and can handle Office 365 and Exchange accounts, including calendar sync. Thunderbird is dead dead dead. Trust me, I've tried very hard to make it work using linux in my mac/windows work, but it cannot pull its weight anymore.

    13. Re:Does Thunderbird still matter? by nctritech · · Score: 1

      ...crap.

    14. Re:Does Thunderbird still matter? by nctritech · · Score: 1

      Evolution is not available for Windows, the OS that the majority of people use. Feel free to prove otherwise; all I find is "defunct ports."

    15. Re:Does Thunderbird still matter? by Fuzi719 · · Score: 1

      I use Thunderbird, and have done so for years. It is fast, thorough, and just works without fiddling. I use it with the Lightning plugin and Google Provider extension so it operates with my Google calendar seamlessly. It connects using IMAP to my gmail, old Comcast, Yahoo, and Outlook email accounts and makes using them simple and easy. And I can use a freeware tool like MozBackup to move it to a new machine with no hassles, even a different operating system (like Linux).

    16. Re:Does Thunderbird still matter? by MrMr · · Score: 1

      I actually use it to read gmail. I prefer the user interface, but apparently they are going to fix that for me next year.

    17. Re:Does Thunderbird still matter? by jawtheshark · · Score: 1

      I don’t need Exchange and Office 365 compatibly. Evolution, being part of Gnome is even worse than Mozilla. Those people remove useful functionality because they got up the wrong side of bed...

      --
      Ahhh...the great dumpster continuum. Many a free computer will be found there. -- sowth (748135)
    18. Re:Does Thunderbird still matter? by tepples · · Score: 1

      Then run Evolution in GNU/Linux in Oracle VirtualBox in Windows.

    19. Re:Does Thunderbird still matter? by nctritech · · Score: 1

      That's a really ridiculous suggestion. Thunderbird is superior if no other reason than it works natively on every major desktop platform. I'm not running a VM to get my mail. I looked at Evolution, the interface is mostly a clone of Thunderbird so I see absolutely no point.

    20. Re:Does Thunderbird still matter? by Desler · · Score: 1

      Complaints but no suggestion.

      Yeah, and? You gonna cry more?

      So typical these days. So, did you see the new Star Wars product yet? It's great, made so much money...

      Good for it. And?

    21. Re:Does Thunderbird still matter? by TechyImmigrant · · Score: 1

      > I know of exactly zero entities using this software.

      I've used it for many years.

      > Am I missing out on anything? Can someone more knowledgeable advise me of why I should use Thunderbird over Outlook or GMail?

      It should not matter. If you are serving your mail from a functioning imap service, you should be able to have multiple views onto that service from different programs on multiple machines. You don't need the gmail web mail client to view email hosted by Google. You can use either or both of a client program and the web interface.

      --
      I should use this sig to advertise my book ISBN-13 : 978-1501515132.
    22. Re:Does Thunderbird still matter? by TechyImmigrant · · Score: 1

      Which one? The javascript/RSS bug was only recently discovered during a security audit, and the Direct3D one was fixed in Firefox with the most recent patch on December 7.

      Why is Thunderbird using Direct3D? It's an email client.

      --
      I should use this sig to advertise my book ISBN-13 : 978-1501515132.
    23. Re:Does Thunderbird still matter? by gnunick · · Score: 1

      I ask because in my [limited] professional life, I know of exactly zero entities using this software.

      Am I missing out on anything? Can someone more knowledgeable advise me of why I should use Thunderbird over Outlook or GMail?

      In addition to using it to access my principal email ISP via IMAP/SMTP, I use Thunderbird to manage my gmail accounts (likewise, via IMAP/SMTP). I use the Lightning add-on to manage the Google calendars people add me to. Just because other people choose to use gmail doesn't mean I should be forced to. At least, that's how I feel about it.

      In the past I've used Thunderbird (again with the help of Lightning, plus another add-on) to manage email and calendars on corporate Exchange servers. Don't even get me started on Outlook. From my experience it was always an awful beast since the very beginning, not that I keep a close on eye on it anymore.

      So what's it going to be? Outlook? Gmail? Huh?! For every new job or new client, am I supposed to switch to a different email and calendaring UI? No thanks! If I already have one tool that's appropriate for the job at hand, why would I want to invest time in another? It's not like I engage in email and the scheduling of meetings as hobbies! They're tiresome parts of my job for which I simply need reliable tool(s). No garage is going to force a mechanic to use the "house" spanners and sockets. I don't think any homebuilder is going to force carpenters to use the corporate framing hammers.

      Thunderbird is a great tool that only ever grows dull in the sense that it's boring--because it works and stays out of the way.

      So thanks, Thunderbird! A faithful and constant part of my toolkit for over a decade. Thanks to you, I've gotten my work done with fewer needless distractions. And thanks to you, I haven't had to use those other "free" sets of tools that aren't truly free in the ways most important to me.

      Well, those are some reasons I use Thunderbird.

      They would be perfectly good reasons to use a different free and open email & calendaring client, if there's another you prefer... or can even find. Anyway, I'm sure some people can think of reasons they don't like Thunderbird. But it's familiar, works almost perfectly, and keeps my email and calendar separate from my web browser, which helps me stay organized.

      Now that they're reviving the bird, I sure hope Lightning gets updated to work with the new add-on system, and some bug fixes as well. Given the miracles they've just performed in reviving Firefox, I'm more excited than worried.

      --
      I have no special gift, I am only passionately curious. --Albert Einstein
    24. Re:Does Thunderbird still matter? by MerlTurkin · · Score: 1

      Thunderbird is fine. FUD much?

    25. Re: Does Thunderbird still matter? by nctritech · · Score: 1

      It's even worse because the same people can't seem to follow the very simple directions on how to switch the compose mode from "rich text" to "HTML."

    26. Re:Does Thunderbird still matter? by jofas · · Score: 1

      I don’t need Exchange and Office 365 compatibly.

      Must be nice.

    27. Re:Does Thunderbird still matter? by jawtheshark · · Score: 1

      Just refuse to work with it. Works for me. Good IT people usually can walk away with something else lined up.

      --
      Ahhh...the great dumpster continuum. Many a free computer will be found there. -- sowth (748135)
  2. Re:New Maths by Desler · · Score: 1, Insightful

    Reading comprehension fail. The sentence is stating it was bundled with those four other bugs.

  3. Re:Firefox 57 by Anonymous Coward · · Score: 3, Informative

    Can’t. Too busy SJWing the product and slapping a Code of Conduct in the EULA.

  4. Me by p51d007 · · Score: 1

    I use it at work, on my laptop. On the home computer, I just use the web browser version of email.

  5. Reasons by sjbe · · Score: 1

    I ask because in my [limited] professional life, I know of exactly zero entities using this software.

    Only ones that would are small companies. Thunderbird is a reasonable client but it pretty much ignored the server side and calendaring features that make Outlook and other applications popular. This was pointed out to them ages ago and they never bothered to put in the resources to make it an Outlook fighter.

    Am I missing out on anything? Can someone more knowledgeable advise me of why I should use Thunderbird over Outlook or GMail?

    Outlook is easy because it isn't of much use if you aren't running Windows. Thunderbird is available for Windows, Mac, and Linux. If you want something consistent between operating systems Outlook won't be your weapon of choice.

    As for Gmail, you can use Thunderbird with Gmail if you need/want a desktop client. That's more a matter of preference than utility.

    1. Re:Reasons by nctritech · · Score: 1

      Lightning for calendaring, included with Thunderbird

      Provider for Google Calendar

      gContactSync

      Pair all that with a Gmail account and you've got IMAP, calendar, and contacts two-way sync. Easy peasy!

  6. Comment removed by account_deleted · · Score: 1

    Comment removed based on user account deletion

  7. They stopped ruining it by fox171171 · · Score: 1

    I still use it. I was initially disappointed that Mozilla wasn't doing anything with Thunderbird. However, at least that meant a stop to ruining it like they did with Firefox. If they had kept going, by now Thunderbird would probably be a webmail app that looks like it is running in Chrome.

  8. Some editing, please by wonkey_monkey · · Score: 1

    Mozilla said Thunderbird, which is also serves as a news, RSS and chat client, the latest Thunderbird 52.5.2 version released last week fixes the vulnerabilities.

    Editors, please at least read what you allow to be posted.

    --
    systemd is Roko's Basilisk.
  9. Don't like modern BS? try this.... by gosand · · Score: 1

    Alpine

    I've been using this since it was pine. I can fetch several accounts to my local inbox, and if I need to check it remotely it's an SSH away.
    Simple and fast will never go out of style for me. You can keep your webmail and bulky email clients.

    --

    My beliefs do not require that you agree with them.

  10. I Ignored it and it Went Away! by TechyImmigrant · · Score: 1

    XUL and related stuff came along and I completely ignored it and hoped that it would go away. I pined for a simpler time when you wrote your programs, plugins, extensions and add-ons in a normal programming language.

    XUL has gone away.

    So I saved a whole bunch of effort. Yay.

    --
    I should use this sig to advertise my book ISBN-13 : 978-1501515132.
  11. Re:Don't like modern BS? try this.... by jawtheshark · · Score: 1

    I used it when it still was Pine. I do need an email client for people like my mom...

    --
    Ahhh...the great dumpster continuum. Many a free computer will be found there. -- sowth (748135)
  12. Suggestion by Futurepower(R) · · Score: 1

    Jody, thanks for the information.

    Only the 5th sentence is not completely serious:

    You think logically. You gather details. You see the big picture. You communicate clearly. I suggest that, in 2020, you run for President of the United States.

    1. Re:Suggestion by nctritech · · Score: 1

      Sadly, I'm not stupid enough to be a politician. ;-) Thanks for the kind words.

  13. Re:Don't like modern BS? try this.... by gosand · · Score: 1

    If your mom is anything like my mom.... good luck! Unfortunately, I have no solution for you there.
    My brother convinced my parents to get a Mac, because you know...it just works and is easy to use. :|
    problem1: he has very little understanding of computers, but thinks he's a genius
    problem2: my parents have less understanding, and do all of about 3 things on their computer. Yet they still have all kinds of issues because they don't understand the basics... "Firefox, foxfire - whatever... I just need to check my Facebook and email." They use Thunderbird, but call it Firefox email.

    I was there a month ago, and I noticed that there were LOTS of pending updates. I asked mom about them, and she said "yeah, that always pops up... I don't know what it is, I just close it"

    To be fair, they are in their 70s and just can't keep up with the advances of technology.

    --

    My beliefs do not require that you agree with them.

  14. Re:Don't like modern BS? try this.... by jawtheshark · · Score: 1

    Thunderbird works fine for my mom.

    --
    Ahhh...the great dumpster continuum. Many a free computer will be found there. -- sowth (748135)
  15. Re:Don't like modern BS? try this.... by jawtheshark · · Score: 1

    To be fair,they use Linux.. So, the updates are managed by the package manager. I told them to click to install them every time it asks. Should I see they cease to do that, I’m configure totally automatic updates. I can always get on their machines using ssh, any way.

    --
    Ahhh...the great dumpster continuum. Many a free computer will be found there. -- sowth (748135)
  16. That's what is needed: Intelligent leaders. by Futurepower(R) · · Score: 1

    It's okay if you don't want to be a leader in government. We need smart people like you to be leaders in every area of life.

    Now there are many situations in which someone who doesn't think carefully gets a lot of money to be elected from an organization that wants favors that are bad for most citizens and destructive to the organization of the country in general.

    It takes years for someone to teach herself how the government works, on any level. So, maybe 3 years until you teach yourself enough to be a candidate for the House of Representatives? -- (Smiles)

    (This comment is motivated by your unusually insightful comment about email software.)