CVE-2018-18509

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

A flaw during verification of certain S/MIME signatures causes emails to be shown in Thunderbird as having a valid digital signature, even if the shown message contents aren't covered by the signature. The flaw allows an attacker to reuse a valid S/MIME signature to craft an email message with arbitrary content. This vulnerability affects Thunderbird < 60.5.1.

Metrics

CVSS 3.0 5.3/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-347

Affected software

Vendor	Product	Versions
Mozilla	Thunderbird	>= unspecified, < 60.5.1

References

http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00043.html
http://packetstormsecurity.com/files/152703/Johnny-You-Are-Fired.htmlThird Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2019/Apr/38Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2019/04/30/4Mailing List, Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:1144
https://bugzilla.mozilla.org/show_bug.cgi?id=1507218Issue Tracking, Permissions Required, Vendor Advisory
https://github.com/RUB-NDS/Johnny-You-Are-Fired
https://github.com/RUB-NDS/Johnny-You-Are-Fired/blob/master/paper/johnny-fired.pdf
https://www.mozilla.org/security/advisories/mfsa2019-06/Vendor Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00043.html
http://packetstormsecurity.com/files/152703/Johnny-You-Are-Fired.htmlThird Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2019/Apr/38Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2019/04/30/4Mailing List, Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:1144
https://bugzilla.mozilla.org/show_bug.cgi?id=1507218Issue Tracking, Permissions Required, Vendor Advisory
https://github.com/RUB-NDS/Johnny-You-Are-Fired
https://github.com/RUB-NDS/Johnny-You-Are-Fired/blob/master/paper/johnny-fired.pdf
https://www.mozilla.org/security/advisories/mfsa2019-06/Vendor Advisory

Timeline

Published: Apr 26, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-18519.8IBM WebSphere Application Server Liberty OpenID Connect could allow a remote attacker to execute arbitrary code on the system, caused by imp CVE-2018-185106.5The about:crashcontent and about:crashparent pages can be triggered by web content. These pages are used to crash the loaded page or the bro CVE-2018-185114.3Cross-origin images can be read from a canvas element in violation of the same-origin policy using the transferFromImageBitmap method. *Note CVE-2018-185129.8A use-after-free vulnerability can occur while playing a sound notification in Thunderbird. The memory storing the sound data is immediately CVE-2018-185137.5A crash can occur when processing a crafted S/MIME message or an XPI package containing a crafted signature. This can be used as a denial-of CVE-2018-185174.8Citrix NetScaler Gateway 10.5.x before 10.5.69.003, 11.1.x before 11.1.59.004, 12.0.x before 12.0.58.7, and 12.1.x before 12.1.49.1 has XSS.CVE-2018-185197.8BestXsoftware Best Free Keylogger before 6.0.0 allows local users to gain privileges via a Trojan horse "%PROGRAMFILES%\BFK 5.2.9\syscrb.exe CVE-2018-185206.5An Invalid Memory Address Dereference exists in the function elf_end in libelf in elfutils through v0.174. Although eu-size is intended to s CVE-2018-185215.5Divide-by-zero vulnerabilities in the function arlib_add_symbols() in arlib.c in elfutils 0.174 allow remote attackers to cause a denial of CVE-2018-185246.1Evernote 6.15 on Windows has an incorrectly repaired stored XSS vulnerability. An attacker can use this XSS issue to inject Node.js code und CVE-2018-185279.8OwnTicket 2018-05-23 allows SQL Injection via the showTicketId or editTicketStatusId parameter.CVE-2018-185299.8ThinkPHP 3.2.4 has SQL Injection via the count parameter because the Library/Think/Db/Driver/Mysql.class.php parseKey function mishandles th