CVE-2018-12372

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Decrypted S/MIME parts, when included in HTML crafted for an attack, can leak plaintext when included in a a HTML reply/forward. This vulnerability affects Thunderbird < 52.9.

Metrics

CVSS 3.0 6.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
Mozilla	Thunderbird	>= unspecified, < 52.9

References

http://www.securityfocus.com/bid/104613Third Party Advisory, VDB Entry
https://access.redhat.com/errata/RHSA-2018:2251Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:2252Third Party Advisory
https://bugzilla.mozilla.org/show_bug.cgi?id=1419417Issue Tracking, Permissions Required, Vendor Advisory
https://lists.debian.org/debian-lts-announce/2018/07/msg00013.htmlMailing List, Third Party Advisory
https://security.gentoo.org/glsa/201811-13Third Party Advisory
https://usn.ubuntu.com/3714-1/Third Party Advisory
https://www.debian.org/security/2018/dsa-4244Third Party Advisory
https://www.mozilla.org/security/advisories/mfsa2018-18/Vendor Advisory
http://www.securityfocus.com/bid/104613Third Party Advisory, VDB Entry
https://access.redhat.com/errata/RHSA-2018:2251Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:2252Third Party Advisory
https://bugzilla.mozilla.org/show_bug.cgi?id=1419417Issue Tracking, Permissions Required, Vendor Advisory
https://lists.debian.org/debian-lts-announce/2018/07/msg00013.htmlMailing List, Third Party Advisory
https://security.gentoo.org/glsa/201811-13Third Party Advisory
https://usn.ubuntu.com/3714-1/Third Party Advisory
https://www.debian.org/security/2018/dsa-4244Third Party Advisory
https://www.mozilla.org/security/advisories/mfsa2018-18/Vendor Advisory

Timeline

Published: Oct 18, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-123736.5dDecrypted S/MIME parts hidden with CSS or the plaintext HTML tag can leak plaintext when included in a HTML reply/forward. This vulnerabili CVE-2018-123744.3Plaintext of decrypted emails can leak through by user submitting an embedded form by pressing enter key within a text input field. This vul CVE-2018-123758.8Memory safety bugs present in Firefox 61. Some of these bugs showed evidence of memory corruption and we presume that with enough effort tha CVE-2018-123769.8Memory safety bugs present in Firefox 61 and Firefox ESR 60.1. Some of these bugs showed evidence of memory corruption and we presume that w CVE-2018-123779.8A use-after-free vulnerability can occur when refresh driver timers are refreshed in some circumstances during shutdown when the timer is de CVE-2018-123789.8A use-after-free vulnerability can occur when an IndexedDB index is deleted while still in use by JavaScript code that is providing payload CVE-2018-123797.8When the Mozilla Updater opens a MAR format file which contains a very long item filename, an out-of-bounds write can be triggered, leading CVE-2018-12387.5Dell EMC ScaleIO versions prior to 2.5, contain a command injection vulnerability in the Light Installation Agent (LIA). This component is u CVE-2018-123815.3Manually dragging and dropping an Outlook email message into the browser will trigger a page navigation when the message's mail columns are CVE-2018-123825.3The displayed addressbar URL can be spoofed on Firefox for Android using a javascript: URI in concert with JavaScript to insert text before CVE-2018-123835.5If a user saved passwords before Firefox 58 and then later set a master password, an unencrypted copy of these passwords is still accessible CVE-2018-123845.9When handling a SSLv2-compatible ClientHello request, the server doesn't generate a new random value but sends an all-zero value instead. Th