The Thunderbird team has released a new version of the open source cross-platform email client. Thunderbird 52.9.0 is a security update first and foremost which makes it a recommended update for all users of the email client.

Img

The new version of Thunderbird fixes the so-called EFAIL security issue completely. EFAIL was discovered earlier this year by security researchers. It allows attackers to gain access to OpenPGP or S/Mime encrypted messages by managing to get hold of encrypted messages, for instance by network snooping, modifying the emails, and sending them to the target.

The Thunderbird development team fixed the issue partially in Thunderbird 52.8.0 which it released in May 2018.

The release of Thunderbird 52.9.0 fixes the issue completely by removing "some HTML crafted to carry out" an EFAIL attack, and optionally "not decrypting subordinate message parts that otherwise might reveal decrypted content to the attacker".

The optional feature is not enabled by default. You can enable it in the following way in the Thunderbird client:

  1. Select Tools > Options from the menu bar. If you don't see the menu bar, tap on the Alt-key to display it.
  2. Go to Advanced > General.
  3. Click on Config Editor.
  4. Search for mailnews.p7m_subparts_external.
  5. Double-click on the preference.
  6. Close the window.

A value of true means that the feature is enabled, a value of false (default) that it is disabled.

Thunderbird 52.9.0 fixes 13 security vulnerabilities; four vulnerabilities have received the highest impact rating of critical.

The new version of Thunderbird includes two non-security changes next to that. It fixes issues "when forwarding messages inline when using "simple" HTML View. Thunderbird supports three view types: original HTML, simple HTML, and plain text.

The difference between Original and Simple HTML is that Thunderbird blocks some elements, e.g. remote content automatically whereas you get an option to enable it with Original HTML view.

The final change of Thunderbird 52.9.0 is a change in how IMAP folders are handled by the client. Starting with this version, Thunderbird will prompt users to compact IMAP folders even if the account is online.

Existing Thunderbird users can run a manual check for updates to use Thunderbird's built-in updating functionality. Just select Help > About Thunderbird to do so.

The new email client version is also available as a direct download on the official Thunderbird project website.