PT-2019-3411 · Mozilla+5 · Thunderbird+5

Luis Merino · Published 2019-06-12 · Updated 2024-06-15 · CVE-2019-11704

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Thunderbird versions prior to 60.7.1

Description The issue is related to a heap buffer overflow in the icalmemory strdup and dequote function when processing certain email messages, potentially leading to a crash. This could allow a remote attacker to access confidential data, compromise its integrity, and cause a denial of service.

Recommendations For versions prior to 60.7.1, update to version 60.7.1 or later to resolve the issue. As a temporary workaround, consider restricting the processing of email messages that could trigger the icalmemory strdup and dequote function until a patch is available.

Exploit

Fix

Memory Corruption

Buffer Overflow

Weakness Enumeration

CWE-787

CWE-119

Related Identifiers

ALT-PU-2019-2075

ALT-PU-2019-2078

BDU:2019-03565

CESA-2019_1623

CESA-2019_1624

CESA-2019_1626

CVE-2019-11704

DLA-1820-1

DSA-4464-1

MGASA-2019-0193

OPENSUSE-SU-2019:1583-1

OPENSUSE-SU-2019:1606-1

OPENSUSE-SU-2019:1664-1

OPENSUSE-SU-2019_1577-1

OPENSUSE-SU-2019_1583-1

OPENSUSE-SU-2019_1606-1

OPENSUSE-SU-2024:10601-1

RHSA-2019:1623

RHSA-2019:1624

RHSA-2019:1626

RHSA-2019_1623

RHSA-2019_1624

RHSA-2019_1626

SUSE-SU-2019:1495-1

SUSE-SU-2019:1683-1

USN-4028-1

Affected Products

Alt Linux

Centos

Red Hat

Suse

Thunderbird

Ubuntu

References · 447

• 🔥 https://github.com/0vercl0k/CVE-2019-11708 · Exploit
• 🔥 https://github.com/vigneshsrao/CVE-2019-11707 · Exploit
• 🔥 https://github.com/tunnelshade/cve-2019-11707 · Exploit
• 🔥 https://bugzilla.mozilla.org/show_bug.cgi?id=1553814 · Exploit
• 🔥 https://exploit-db.com/exploits/47002 · Exploit
• https://ubuntu.com/security/CVE-2019-11706 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2019:1664-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2019:1583-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-11704 · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-03565 · Security Note
• https://osv.dev/vulnerability/DSA-4464-1 · Vendor Advisory
• https://mozilla.org/en-US/security/advisories/mfsa2019-17/#CVE-2019-11704 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2019-11704 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2019-11704 · Security Note
• https://mozilla.org/security/advisories/mfsa2019-17 · Vendor Advisory