PT-2019-5317 · Mozilla+5 · Thunderbird+5

Damian Poddebniak + 4 · Published 2019-09-06 · Updated 2024-06-15 · CVE-2019-11739

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Thunderbird versions prior to 60.9 Thunderbird versions prior to 68.1

Description The issue is related to the Secure/Multipurpose Internet Mail Extensions (S/MIME) functionality in the Thunderbird email client, specifically concerning the lack of protection for certain data. This could allow a remote attacker to gain unauthorized access to protected information. Additionally, it is noted that encrypted S/MIME parts in a crafted multipart/alternative message can leak plaintext when included in an HTML reply or forward.

Recommendations For versions prior to 60.9, update to version 60.9 or later. For versions prior to 68.1, update to version 68.1 or later.

Exploit

Fix

Cleartext Transmission of Sensitive Information

Information Disclosure

Weakness Enumeration

CWE-319

CWE-200

Related Identifiers

ALT-PU-2020-1166

ALT-PU-2020-1515

BDU:2020-02383

CESA-2019_2773

CESA-2019_2774

CVE-2019-11739

DLA-1926-1

DSA-4523-1

MGASA-2019-0275

MGASA-2019-0285

OPENSUSE-SU-2019:2248-1

OPENSUSE-SU-2019:2249-1

OPENSUSE-SU-2019_2248-1

OPENSUSE-SU-2019_2249-1

OPENSUSE-SU-2024:10601-1

RHSA-2019:2773

RHSA-2019:2774

RHSA-2019:2807

RHSA-2019_2773

RHSA-2019_2774

RHSA-2019_2807

SUSE-SU-2019:2515-1

USN-4150-1

Affected Products

Alt Linux

Centos

Red Hat

Suse

Thunderbird

Ubuntu

References · 466

• 🔥 https://github.com/maxpl0it/CVE-2019-17026-Exploit · Exploit
• 🔥 https://github.com/lsw29475/CVE-2019-17026 · Exploit
• 🔥❌ https://github.com/alidnf/CVE-2019-11730 · Exploit, Deleted
• https://mozilla.org/security/advisories/mfsa2019-29 · Vendor Advisory
• https://mozilla.org/security/advisories/mfsa2019-30 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-1926-1 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2019-0285.html · Security Note
• https://usn.ubuntu.com/4150-1 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2019-0285 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-11739 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-11739 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-11746 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-11739 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2019:2249-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-11739 · Vendor Advisory