2039794 - ESR versions not identified as ESR in macOS metadata, causing false-positive vulnerability alerts in security tools

Status: UNCONFIRMED

(Thunderbird :: Build Config, enhancement, P2)

Description

[Alexander Heckel]

User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36

Steps to reproduce:

Thunderbird ESR releases on macOS do not expose their ESR status in the standard version metadata fields (e.g. CFBundleShortVersionString in Info.plist, kMDItemVersion via Spotlight, or compatibility.ini).

Actual results:

Version string reads 140.10.2, indistinguishable from a non-ESR release, causing false-positive alerts in tools like Wazuh.

~ > defaults read /Applications/Thunderbird.app/Contents/Info.plist CFBundleShortVersionString                                                                                                                                        140.10.2

~ > system_profiler SPApplicationsDataType -json | \                                                                                                                                                                                   jq '.SPApplicationsDataType[] | select(.path | contains("Thunderbird"))'
{
  "_name": "Thunderbird",
  "arch_kind": "arch_arm_i64",
  "info": "Thunderbird 140.10.2esr",
  "lastModified": "2026-05-07T13:41:58Z",
  "obtained_from": "identified_developer",
  "path": "/Applications/Thunderbird.app",
  "signed_by": [
    "Developer ID Application: Mozilla Corporation (43AQ936H96)",
    "Developer ID Certification Authority",
    "Apple Root CA"
  ],
  "version": "140.10.2"
}

Expected results:

The version string should include the ESR suffix so that security tools can correctly identify and handle ESR installations. This issue may also affect Firefox ESR on macOS.

Comment 1

[Alexander Heckel]

Additional note: On Windows, the ESR status is correctly reflected in the registry.

Additional note: On Windows, the ESR status is correctly reflected in the registry.

Get-ItemProperty "HKLM:\SOFTWARE\Mozilla\Mozilla Thunderbird" | Select-Object CurrentVersion

returns:

CurrentVersion
--------------
140.10.2 ESR (x64 de)

The version string here includes the ESR suffix.