CVE-2024-11159

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

Using remote content in OpenPGP encrypted messages can lead to the disclosure of plaintext. This vulnerability affects Thunderbird < 128.4.3 and Thunderbird < 132.0.1.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-312

Affected software

Vendor	Product	Versions
Mozilla	Thunderbird	>= unspecified, < 128.4.3
Mozilla	Thunderbird	>= unspecified, < 132.0.1

References

https://bugzilla.mozilla.org/show_bug.cgi?id=1925929Issue Tracking
https://www.mozilla.org/security/advisories/mfsa2024-61/Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2024-62/Vendor Advisory
https://lists.debian.org/debian-lts-announce/2024/11/msg00017.html

Timeline

Published: Nov 13, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-11169.8A vulnerability was found in openBI up to 1.0.8. It has been classified as critical. Affected is the function index of the file /application CVE-2024-111655.7An information disclosure vulnerability exists in the backup configuration process where the SAS token is not masked in the configuration re CVE-2024-111667.1For TCAS II systems using transponders compliant with MOPS earlier than RTCA DO-181F, an attacker can impersonate a ground station and issue CVE-2024-111675.3An improper access control vulnerability in danny-avila/librechat versions prior to 0.7.6 allows authenticated users to delete other users' CVE-2024-111683.7The urllib.parse.urlsplit() and urlparse() functions improperly validated bracketed hosts (`[]`), allowing hosts that weren't IPv6 or IPvFut CVE-2024-111697.5An unhandled exception in danny-avila/librechat version 3c94ff2 can lead to a server crash. The issue occurs when the fs module throws an ex CVE-2024-11179.8A vulnerability was found in openBI up to 1.0.8. It has been declared as critical. Affected by this vulnerability is the function index of t CVE-2024-111708.8A vulnerability in danny-avila/librechat version git 81f2936 allows for path traversal due to improper sanitization of file paths by the mul CVE-2024-111717.5In danny-avila/librechat version git 0c2a583, there is an improper input validation vulnerability. The application uses multer middleware fo CVE-2024-111727.5A vulnerability in danny-avila/librechat version git a1647d7 allows an unauthenticated attacker to cause a denial of service by sending a cr CVE-2024-111736.5An unhandled exception in the danny-avila/librechat repository, version git 600d217, can cause the server to crash, leading to a full denial CVE-2024-111754.8A vulnerability was found in Public CMS 5.202406.d and classified as problematic. This issue affects some unknown processing of the file /ad