PT-2018-3163 · Mozilla+5 · Thunderbird+5

Hanno Boeck · Published 2018-07-03 · Updated 2024-06-15 · CVE-2018-12374

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Thunderbird versions prior to 52.9

Description The issue is related to a lack of protection for sensitive data in the Thunderbird email client. It can be exploited by a remote attacker to gain unauthorized access to protected information. This can happen when a user submits an embedded form by pressing the enter key within a text input field, potentially leaking plaintext of decrypted emails.

Recommendations For versions prior to 52.9, update to version 52.9 or later to resolve the issue.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

CWE-356

Related Identifiers

ALT-PU-2018-1978

BDU:2019-04294

CESA-2018_2251

CESA-2018_2252

CVE-2018-12374

DLA-1425-1

DSA-4244-1

MGASA-2018-0316

MGASA-2018-0321

OPENSUSE-SU-2018_1905-1

OPENSUSE-SU-2024:10601-1

RHSA-2018:2251

RHSA-2018:2252

RHSA-2018_2251

RHSA-2018_2252

SUSE-SU-2018:2174-1

USN-3714-1

Affected Products

Alt Linux

Centos

Red Hat

Suse

Thunderbird

Ubuntu

References · 454

• https://ubuntu.com/security/CVE-2018-12363 · Vendor Advisory
• https://usn.ubuntu.com/3714-1 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2018:2252 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-5188 · Vendor Advisory
• https://mozilla.org/en-US/security/advisories/mfsa2018-18 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2018:2251 · Vendor Advisory
• https://osv.dev/vulnerability/USN-3714-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-12374 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-12362 · Vendor Advisory
• https://bugzilla.mozilla.org/show_bug.cgi?id=1462910 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-12374 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-4244-1 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2018-0321.html · Security Note
• https://mozilla.org/en-US/security/advisories/mfsa2018-18/#CVE-2018-12374 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2018-12374 · Vendor Advisory