PT-2019-3440 · Mozilla+5 · Thunderbird+5

Luis Merino · Published 2019-06-13 · Updated 2024-06-15 · CVE-2019-11705

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Thunderbird versions prior to 60.7.1

Description A flaw in Thunderbird's implementation of iCal causes a stack buffer overflow in icalrecur add bydayrules when processing certain email messages, resulting in a potentially exploitable crash. The vulnerability can be exploited by a remote attacker to cause a denial of service.

Recommendations For Thunderbird versions prior to 60.7.1, update to version 60.7.1 or later to resolve the issue. As a temporary workaround, consider restricting the processing of email messages that may trigger the icalrecur add bydayrules function until a patch is available.

Exploit

Fix

Buffer Overflow

Memory Corruption

Weakness Enumeration

CWE-119

CWE-787

Related Identifiers

ALT-PU-2019-2075

ALT-PU-2019-2078

BDU:2019-03611

CESA-2019_1623

CESA-2019_1624

CESA-2019_1626

CVE-2019-11705

DLA-1820-1

DSA-4464-1

MGASA-2019-0193

OPENSUSE-SU-2019:1583-1

OPENSUSE-SU-2019:1606-1

OPENSUSE-SU-2019:1664-1

OPENSUSE-SU-2019_1577-1

OPENSUSE-SU-2019_1583-1

OPENSUSE-SU-2019_1606-1

OPENSUSE-SU-2024:10601-1

RHSA-2019:1623

RHSA-2019:1624

RHSA-2019:1626

RHSA-2019_1623

RHSA-2019_1624

RHSA-2019_1626

SUSE-SU-2019:1495-1

SUSE-SU-2019:1683-1

USN-4028-1

Affected Products

Alt Linux

Centos

Red Hat

Suse

Thunderbird

Ubuntu

References · 446

• 🔥 https://github.com/0vercl0k/CVE-2019-11708 · Exploit
• 🔥 https://github.com/vigneshsrao/CVE-2019-11707 · Exploit
• 🔥 https://github.com/tunnelshade/cve-2019-11707 · Exploit
• 🔥 https://exploit-db.com/exploits/47004 · Exploit
• https://ubuntu.com/security/CVE-2019-11706 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2019:1664-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-11705 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2019:1583-1 · Vendor Advisory
• https://mozilla.org/en-US/security/advisories/mfsa2019-17/#CVE-2019-11705 · Vendor Advisory
• https://bugzilla.mozilla.org/show_bug.cgi?id=1553808 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2019-11705 · Security Note
• https://osv.dev/vulnerability/DSA-4464-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-1170 · Security Note
• https://mozilla.org/security/advisories/mfsa2019-17 · Vendor Advisory
• https://wiki.astralinux.ru/pages/viewpage.action?pageId=57444186 · Vendor Advisory