CVE-2024-11159

Using remote content in OpenPGP encrypted messages can lead to the disclosure of plaintext. This vulnerability affects Thunderbird < 128.4.3 and Thunderbird < 132.0.1.

CVSS v3 4.3 MEDIUM

4.3^/10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://bugzilla.mozilla.org/show_bug.cgi?id=1925929	Issue Tracking
https://www.mozilla.org/security/advisories/mfsa2024-61/	Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2024-62/	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:mozilla:thunderbird::::::::
	cpe:2.3:a:mozilla:thunderbird::::::::

History

19 Nov 2024, 14:56

Type	Values Removed	Values Added
References	~~() https://bugzilla.mozilla.org/show_bug.cgi?id=1925929 -~~	() https://bugzilla.mozilla.org/show_bug.cgi?id=1925929 - Issue Tracking
References	~~() https://www.mozilla.org/security/advisories/mfsa2024-61/ -~~	() https://www.mozilla.org/security/advisories/mfsa2024-61/ - Vendor Advisory
References	~~() https://www.mozilla.org/security/advisories/mfsa2024-62/ -~~	() https://www.mozilla.org/security/advisories/mfsa2024-62/ - Vendor Advisory
CPE		cpe:2.3:a:mozilla:thunderbird::::::::
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 4.3
First Time		Mozilla thunderbird Mozilla
CWE		NVD-CWE-noinfo
Summary		(es) El uso de contenido remoto en mensajes cifrados con OpenPGP puede provocar la divulgación de texto plano. Esta vulnerabilidad afecta a Thunderbird < 128.4.3 y Thunderbird < 132.0.1.

13 Nov 2024, 14:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-11-13 14:15

Updated : 2024-11-19 14:56

NVD link : CVE-2024-11159

Mitre link : CVE-2024-11159

CVE.ORG link : CVE-2024-11159

JSON object : View

Products Affected

mozilla

thunderbird

CWE

NVD-CWE-noinfo

4.3 /10