CVE-2019-11739 Information disclosure in Thunderbird
Attackers can leak plaintext from encrypted S/MIME emails when users reply or forward crafted multipart messages in Thunderbird.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2019-11739?
CVE-2019-11739 is a medium-severity vulnerability in Mozilla Thunderbird, published on 27 Sep 2019. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Encrypted S/MIME parts in a crafted multipart/alternative message can leak plaintext when included in a a HTML reply/forward. This vulnerability affects Thunderbird < 68.1 and Thunderbird < 60.9.
Weakness: CWE-319
Which versions are affected by CVE-2019-11739?
It affects 1 product.
Products include Mozilla Thunderbird.
How do I fix CVE-2019-11739?
Upgrade to a fixed version.
Is CVE-2019-11739 being exploited?
There is no known exploitation of CVE-2019-11739 in the wild and no public exploit code.
Other vulnerabilities in Mozilla Thunderbird
Sources
Also known as DEBIAN-CVE-2019-11739, GHSA-c6f3-q26v-xmx7, UBUNTU-CVE-2019-11739.