CVE-2019-11739

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Encrypted S/MIME parts in a crafted multipart/alternative message can leak plaintext when included in a a HTML reply/forward. This vulnerability affects Thunderbird < 68.1 and Thunderbird < 60.9.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-319

Affected software

Vendor	Product	Versions
Mozilla	Thunderbird	>= unspecified, < 68.1; >= unspecified, < 60.9

References

http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00009.html
http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00010.html
https://bugzilla.mozilla.org/show_bug.cgi?id=1571481Issue Tracking, Permissions Required, Vendor Advisory
https://usn.ubuntu.com/4150-1/
https://www.mozilla.org/security/advisories/mfsa2019-29/Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2019-30/Vendor Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00009.html
http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00010.html
https://bugzilla.mozilla.org/show_bug.cgi?id=1571481Issue Tracking, Permissions Required, Vendor Advisory
https://usn.ubuntu.com/4150-1/
https://www.mozilla.org/security/advisories/mfsa2019-29/Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2019-30/Vendor Advisory

Timeline

Published: Sep 27, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-11747.0An elevation of privilege vulnerability exists in the way that the PsmServiceExtHost.dll handles objects in memory. An attacker who successf CVE-2019-117408.8Mozilla developers and community members reported memory safety bugs present in Firefox 68, Firefox ESR 68, and Firefox 60.8. Some of these CVE-2019-117416.1A compromised sandboxed content process can perform a Universal Cross-site Scripting (UXSS) attack on content from any site it can cause to CVE-2019-117426.5A same-origin policy violation occurs allowing the theft of cross-origin images through a combination of SVG filters and a <canvas> el CVE-2019-117433.7Navigation events were not fully adhering to the W3C's "Navigation-Timing Level 2" draft specification in some instances for the unload even CVE-2019-117446.1Some HTML elements, such as <title> and <textarea>, can contain literal angle brackets without treating them as markup. It is po CVE-2019-117458.8When encrypting with a block cipher, if a call to NSC_EncryptUpdate was made with data smaller than the block size, a small out of bounds wr CVE-2019-117468.8A use-after-free vulnerability can occur while manipulating video elements if the body is freed while still in use. This results in a potent CVE-2019-117476.5The "Forget about this site" feature in the History pane is intended to remove all saved user data that indicates a user has visited a site.CVE-2019-117486.5WebRTC in Firefox will honor persisted permissions given to sites for access to microphone and camera resources even when in a third-party c CVE-2019-117494.3A vulnerability exists in WebRTC where malicious web content can use probing techniques on the getUserMedia API using constraints to reveal CVE-2019-11757.0An elevation of privilege vulnerability exists in the way that the psmsrv.dll handles objects in memory. An attacker who successfully exploi