PT-2018-3161 · Mozilla+5 · Thunderbird+5

Christian Dresen + 7 · Published 2018-07-03 · Updated 2024-06-15 · CVE-2018-12372

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Thunderbird versions prior to 52.9

Description The issue is related to the decryption of S/MIME parts in HTML messages, which can lead to plaintext leakage when included in a reply or forward. This is due to a lack of protection for certain data in the S/MIME and PGP functions of the Thunderbird email client. An attacker can exploit this issue by manipulating HTML messages to gain unauthorized access to protected information.

Recommendations For versions prior to 52.9, update to version 52.9 or later to resolve the issue. As a temporary workaround, consider avoiding the use of HTML replies or forwards for sensitive messages until the update is applied. Restrict access to sensitive information when using the affected Thunderbird versions to minimize the risk of exploitation.

Fix

Information Disclosure

Weakness Enumeration

CWE-201

CWE-200

Related Identifiers

ALT-PU-2018-1978

BDU:2019-04292

CESA-2018_2251

CESA-2018_2252

CVE-2018-12372

DLA-1425-1

DSA-4244-1

MGASA-2018-0316

MGASA-2018-0321

OPENSUSE-SU-2018_1905-1

OPENSUSE-SU-2024:10601-1

RHSA-2018:2251

RHSA-2018:2252

RHSA-2018_2251

RHSA-2018_2252

SUSE-SU-2018:2174-1

USN-3714-1

Affected Products

Alt Linux

Centos

Red Hat

Suse

Thunderbird

Ubuntu

References · 456

• https://bugzilla.mozilla.org/show_bug.cgi?id=1419417 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-12363 · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-04292 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2018-12372 · Vendor Advisory
• https://usn.ubuntu.com/3714-1 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2018:2252 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-5188 · Vendor Advisory
• https://mozilla.org/en-US/security/advisories/mfsa2018-18 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2018:2251 · Vendor Advisory
• https://osv.dev/vulnerability/USN-3714-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-12374 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-12362 · Vendor Advisory
• https://mozilla.org/en-US/security/advisories/mfsa2018-18/#CVE-2018-12372 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-4244-1 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2018-0321.html · Security Note