PT-2024-9993 · Mozilla+7 · Thunderbird+7
Magnus Melin
+2
·
Published
2024-11-12
·
Updated
2025-07-18
·
CVE-2024-11159
CVSS v3.1
5.3
Medium
| Vector | AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions:
Thunderbird versions prior to 128.4.3
Thunderbird versions prior to 132.0.1
Description:
The issue is related to the use of remote content in OpenPGP encrypted messages, which can lead to the disclosure of plaintext. This is due to insufficient protection of service data in the implementation of the OpenPGP email encryption standard in the Mozilla Thunderbird email client. An attacker can exploit this vulnerability to reveal protected information.
Recommendations:
For Thunderbird versions prior to 128.4.3, update to version 128.4.3 or later.
For Thunderbird versions prior to 132.0.1, update to version 132.0.1 or later.
As a temporary workaround, consider avoiding the use of remote content in OpenPGP encrypted messages until a patch is available.
Fix
Missing Encryption of Sensitive Data
Side Channel Attack
Cleartext Storage of Sensitive Information
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Almalinux
Astra Linux
Centos
Red Hat
Rocky Linux
Suse
Thunderbird