PT-2018-3162 · Mozilla+5 · Thunderbird+5

Christian Dresen + 7 · Published 2018-07-03 · Updated 2024-06-15 · CVE-2018-12373

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Thunderbird versions prior to 52.9

Description The issue is related to the Secure/Multipurpose Internet Mail Extensions (S/MIME) function in the Thunderbird email client, which lacks protection for certain data. This can allow a remote attacker to gain unauthorized access to protected information when an email is forwarded or replied to. Specifically, decrypted S/MIME parts that are hidden using CSS or the plaintext HTML tag can leak plaintext when included in an HTML reply or forward.

Recommendations For versions prior to 52.9, update to version 52.9 or later to resolve the issue. As a temporary workaround, consider avoiding the use of HTML replies or forwards for emails containing sensitive S/MIME-protected information until the update is applied.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

ALT-PU-2018-1978

BDU:2019-04293

CESA-2018_2251

CESA-2018_2252

CVE-2018-12373

DLA-1425-1

DSA-4244-1

MGASA-2018-0316

MGASA-2018-0321

OPENSUSE-SU-2018_1905-1

OPENSUSE-SU-2024:10601-1

RHSA-2018:2251

RHSA-2018:2252

RHSA-2018_2251

RHSA-2018_2252

SUSE-SU-2018:2174-1

USN-3714-1

Affected Products

Alt Linux

Centos

Red Hat

Suse

Thunderbird

Ubuntu

References · 456

• https://ubuntu.com/security/CVE-2018-12363 · Vendor Advisory
• https://bugzilla.mozilla.org/show_bug.cgi?id=1464667 · Vendor Advisory
• https://bugzilla.mozilla.org/show_bug.cgi?id=1464056 · Vendor Advisory
• https://usn.ubuntu.com/3714-1 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2018:2252 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-5188 · Vendor Advisory
• https://mozilla.org/en-US/security/advisories/mfsa2018-18 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2018:2251 · Vendor Advisory
• https://osv.dev/vulnerability/USN-3714-1 · Vendor Advisory
• https://mozilla.org/en-US/security/advisories/mfsa2018-18/#CVE-2018-12373 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-12374 · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-04293 · Security Note
• https://ubuntu.com/security/CVE-2018-12362 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-12373 · Security Note
• https://osv.dev/vulnerability/DSA-4244-1 · Vendor Advisory