CVE-2019-11739

Published: Sep 27, 2019Modified: Nov 21, 2024

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Exploitability: 2.8 / Impact: 3.6

Source: NVD

Description

Encrypted S/MIME parts in a crafted multipart/alternative message can leak plaintext when included in a a HTML reply/forward. This vulnerability affects Thunderbird < 68.1 and Thunderbird < 60.9.

Affected (2)

Products: Mozilla: Thunderbird

Mozilla

1 product

Thunderbird

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Mozilla Thunderbird	Before 60.9.0
Mozilla Thunderbird	From 68.0 to 68.1.0

Related CWEs

CWE-319

Cleartext Transmission of Sensitive Information

The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.

References (12)

http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00009.html

Source: security@mozilla.org

http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00010.html

Source: security@mozilla.org

https://bugzilla.mozilla.org/show_bug.cgi?id=1571481

Source: security@mozilla.org

Issue TrackingPermissions RequiredVendor Advisory

https://usn.ubuntu.com/4150-1/

Source: security@mozilla.org

https://www.mozilla.org/security/advisories/mfsa2019-29/

Source: security@mozilla.org

Vendor Advisory

https://www.mozilla.org/security/advisories/mfsa2019-30/

Source: security@mozilla.org

Vendor Advisory

http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00009.html