CVE-2019-11755

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

A crafted S/MIME message consisting of an inner encryption layer and an outer SignedData layer was shown as having a valid digital signature, although the signer might have had no access to the contents of the encrypted message, and might have stripped a different signature from the encrypted message. Previous versions had only suppressed showing a digital signature for messages with an outer multipart/signed layer. This vulnerability affects Thunderbird < 68.1.1.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-347

Affected software

Vendor	Product	Versions
Mozilla	Thunderbird	>= unspecified, < 68.1.1

References

Timeline

Published: Sep 27, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-117568.8Improper refcounting of soft token session objects could cause a use-after-free and crash (likely limited to a denial of service). This vuln CVE-2019-117578.8When following the value's prototype chain, it was possible to retain a reference to a locale, delete it, and subsequently reference it. Thi CVE-2019-117588.8Mozilla community member Philipp reported a memory safety bug present in Firefox 68 when 360 Total Security was installed. This bug showed e CVE-2019-117598.8An attacker could have caused 4 bytes of HMAC output to be written past the end of a buffer stored on the stack. This could be used by an at CVE-2019-11767.0An elevation of privilege vulnerability exists when DirectX improperly handles objects in memory. An attacker who successfully exploited thi CVE-2019-117608.8A fixed-size stack buffer could overflow in nrappkit when doing WebRTC signaling. This resulted in a potentially exploitable crash in some i CVE-2019-117615.4By using a form with a data URI it was possible to gain access to the privileged JSONView object that had been cloned into content. Impact f CVE-2019-117626.1If two same-origin documents set document.domain differently to become cross-origin, it was possible for them to call arbitrary DOM methods/CVE-2019-117636.1Failure to correctly handle null bytes when processing HTML entities resulted in Firefox incorrectly parsing these entities. This could have CVE-2019-117648.8Mozilla developers and community members reported memory safety bugs present in Firefox 69 and Firefox ESR 68.1. Some of these bugs showed e CVE-2019-117656.5A compromised content process could send a message to the parent process that would cause the 'Click to Play' permission prompt to be shown.CVE-2019-117669.8dhcp6.c in dhcpcd before 6.11.7 and 7.x before 7.2.2 has a buffer over-read in the D6_OPTION_PD_EXCLUDE feature.