PT-2019-3410 · Mozilla+5 · Thunderbird+5

Luis Merino · Published 2019-06-12 · Updated 2024-06-15 · CVE-2019-11703

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Thunderbird versions prior to 60.7.1

Description A flaw in the implementation of iCal in Thunderbird causes a heap buffer overflow in parser get next char when processing certain email messages, resulting in a potentially exploitable crash. This issue may allow a remote attacker to access confidential data, compromise its integrity, and cause a denial of service.

Recommendations For Thunderbird versions prior to 60.7.1, update to version 60.7.1 or later to resolve the issue. As a temporary workaround, consider restricting the processing of certain email messages that may trigger the heap buffer overflow in parser get next char until a patch is available.

Exploit

Fix

Memory Corruption

Buffer Overflow

Weakness Enumeration

CWE-787

CWE-119

Related Identifiers

ALT-PU-2019-2075

ALT-PU-2019-2078

BDU:2019-03564

CESA-2019_1623

CESA-2019_1624

CESA-2019_1626

CVE-2019-11703

DLA-1820-1

DSA-4464-1

MGASA-2019-0193

OPENSUSE-SU-2019:1583-1

OPENSUSE-SU-2019:1606-1

OPENSUSE-SU-2019:1664-1

OPENSUSE-SU-2019_1577-1

OPENSUSE-SU-2019_1583-1

OPENSUSE-SU-2019_1606-1

OPENSUSE-SU-2024:10601-1

RHSA-2019:1623

RHSA-2019:1624

RHSA-2019:1626

RHSA-2019_1623

RHSA-2019_1624

RHSA-2019_1626

SUSE-SU-2019:1495-1

SUSE-SU-2019:1683-1

USN-4028-1

Affected Products

Alt Linux

Centos

Red Hat

Suse

Thunderbird

Ubuntu

References · 446

• 🔥 https://github.com/0vercl0k/CVE-2019-11708 · Exploit
• 🔥 https://github.com/vigneshsrao/CVE-2019-11707 · Exploit
• 🔥 https://github.com/tunnelshade/cve-2019-11707 · Exploit
• 🔥 https://bugzilla.mozilla.org/show_bug.cgi?id=1553820 · Exploit
• 🔥 https://exploit-db.com/exploits/47003 · Exploit
• https://ubuntu.com/security/CVE-2019-11706 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2019:1664-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2019:1583-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-11703 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-4464-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2019-11703 · Security Note
• https://mozilla.org/security/advisories/mfsa2019-17 · Vendor Advisory
• https://wiki.astralinux.ru/pages/viewpage.action?pageId=57444186 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-11703 · Vendor Advisory
• https://mozilla.org/en-US/security/advisories/mfsa2019-17/#CVE-2019-11703 · Vendor Advisory