Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2018-18486 State: PUBLISHED Published: 2018-10-18T21:00:00 Last Updated: 2024-08-05T11:08:21.830Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in PHPSHE 1.7. SQL injection exists via the admin.php?mod=user&act=del user_id[] parameter. Additional Analyst Notes: - CVE Program Container: References: - https://gitee.com/koyshe/phpshe/issues/INPIT
CVE ID: CVE-2018-18487 State: PUBLISHED Published: 2018-10-18T21:00:00Z Last Updated: 2024-09-17T03:22:43.930Z Vendors: n/a Products: n/a Problem Types: n/a Description: In \lib\admin\action\dataaction.class.php in Gxlcms v2.0, the database backup filename generation uses mt_rand() unsafely, resulting in predictable database backup file locations. Additional Analyst Notes: - CVE Program Container: References: - http://sunu11.com/2018/10/18/glxcms/
CVE ID: CVE-2018-18488 State: PUBLISHED Published: 2018-10-18T21:00:00Z Last Updated: 2024-09-16T17:22:49.135Z Vendors: n/a Products: n/a Problem Types: n/a Description: In \lib\admin\action\dataaction.class.php in Gxlcms v2.0, SQL Injection exists via the ids[] parameter. Additional Analyst Notes: - CVE Program Container: References: - http://sunu11.com/2018/10/18/glxcms/
CVE ID: CVE-2018-18489 State: PUBLISHED Published: 2019-04-16T18:26:08 Last Updated: 2024-08-05T11:08:21.834Z Vendors: n/a Products: n/a Problem Types: n/a Description: The ping feature in the Diagnostic functionality on TP-LINK WR840N v2 Firmware 3.16.9 Build 150701 Rel.51516n devices allows remote attackers to cause a denial of service (HTTP service termination) by modifying the packet size to be higher than the UI limit of 1472. Additional Analyst Notes: - CVE Program Container: References: - https://youtu.be/VGNEYWR9MgY
CVE ID: CVE-2018-18492 State: PUBLISHED Published: 2019-02-28T18:00:00 Last Updated: 2024-08-05T11:08:21.899Z Vendors: Mozilla Products: Thunderbird, Firefox ESR, Firefox Problem Types: Use-after-free with select element Description: A use-after-free vulnerability can occur after deleting a selection element due to a weak reference to the select element in the options collection. This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 60.4, Firefox ESR < 60.4, and Firefox < 64. Additional Analyst Notes: - CVE Program Container: References: - https://www.mozilla.org/security/advisories/mfsa2018-29/ - https://bugzilla.mozilla.org/show_bug.cgi?id=1499861 - http
- https://www.mozilla.org/security/advisories/mfsa2018-29/ - https://bugzilla.mozilla.org/show_bug.cgi?id=1499861 - https://lists.debian.org/debian-lts-announce/2018/12/msg00002.html - https://access.redhat.com/errata/RHSA-2018:3833 - https://access.redhat.com/errata/RHSA-2018:3831 - https://www.debian.org/security/2019/dsa-4362 - https://security.gentoo.org/glsa/201903-04 - https://usn.ubuntu.com/3844-1/ - http://www.securityfocus.com/bid/106168 - https://access.redhat.com/errata/RHSA-2019:0159 - https://www.mozilla.org/security/advisories/mfsa2018-31/ - https://www.mozilla.org/security/advisories/mfsa2018-30/ - https://www.debian.org/security/2018/dsa-4354 - https://usn.ubuntu.com/3868-1/
a.org/security/advisories/mfsa2018-30/ - https://www.debian.org/security/2018/dsa-4354 - https://usn.ubuntu.com/3868-1/ - https://access.redhat.com/errata/RHSA-2019:0160
CVE ID: CVE-2018-18493 State: PUBLISHED Published: 2019-02-28T18:00:00 Last Updated: 2024-08-05T11:08:21.887Z Vendors: Mozilla Products: Thunderbird, Firefox ESR, Firefox Problem Types: Buffer overflow in accelerated 2D canvas with Skia Description: A buffer overflow can occur in the Skia library during buffer offset calculations with hardware accelerated canvas 2D actions due to the use of 32-bit calculations instead of 64-bit. This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 60.4, Firefox ESR < 60.4, and Firefox < 64. Additional Analyst Notes: - CVE Program Container: References: - https://www.mozilla.org/security/advisories/mfsa2018-29/ - https://l
alyst Notes: - CVE Program Container: References: - https://www.mozilla.org/security/advisories/mfsa2018-29/ - https://lists.debian.org/debian-lts-announce/2018/12/msg00002.html - https://access.redhat.com/errata/RHSA-2018:3833 - https://access.redhat.com/errata/RHSA-2018:3831 - https://www.debian.org/security/2019/dsa-4362 - https://security.gentoo.org/glsa/201903-04 - https://usn.ubuntu.com/3844-1/ - http://www.securityfocus.com/bid/106168 - https://access.redhat.com/errata/RHSA-2019:0159 - https://www.mozilla.org/security/advisories/mfsa2018-31/ - https://www.mozilla.org/security/advisories/mfsa2018-30/ - https://www.debian.org/security/2018/dsa-4354 - https://usn.ubuntu.com/3868-1/ - htt
/security/advisories/mfsa2018-30/ - https://www.debian.org/security/2018/dsa-4354 - https://usn.ubuntu.com/3868-1/ - https://bugzilla.mozilla.org/show_bug.cgi?id=1504452 - https://access.redhat.com/errata/RHSA-2019:0160
CVE ID: CVE-2018-18494 State: PUBLISHED Published: 2019-02-28T18:00:00 Last Updated: 2024-08-05T11:08:21.990Z Vendors: Mozilla Products: Thunderbird, Firefox ESR, Firefox Problem Types: Same-origin policy violation using location attribute and performance.getEntries to steal cross-origin URLs Description: A same-origin policy violation allowing the theft of cross-origin URL entries when using the Javascript location property to cause a redirection to another site using performance.getEntries(). This is a same-origin policy violation and could allow for data theft. This vulnerability affects Thunderbird < 60.4, Firefox ESR < 60.4, and Firefox < 64. Additional Analyst Notes: - CVE Program Cont
erability affects Thunderbird < 60.4, Firefox ESR < 60.4, and Firefox < 64. Additional Analyst Notes: - CVE Program Container: References: - https://www.mozilla.org/security/advisories/mfsa2018-29/ - https://lists.debian.org/debian-lts-announce/2018/12/msg00002.html - https://access.redhat.com/errata/RHSA-2018:3833 - https://access.redhat.com/errata/RHSA-2018:3831 - https://www.debian.org/security/2019/dsa-4362 - https://security.gentoo.org/glsa/201903-04 - https://usn.ubuntu.com/3844-1/ - http://www.securityfocus.com/bid/106168 - https://access.redhat.com/errata/RHSA-2019:0159 - https://www.mozilla.org/security/advisories/mfsa2018-31/ - https://www.mozilla.org/security/advisories/mfsa2018-3
0159 - https://www.mozilla.org/security/advisories/mfsa2018-31/ - https://www.mozilla.org/security/advisories/mfsa2018-30/ - https://bugzilla.mozilla.org/show_bug.cgi?id=1487964 - https://www.debian.org/security/2018/dsa-4354 - https://usn.ubuntu.com/3868-1/ - https://access.redhat.com/errata/RHSA-2019:0160
CVE ID: CVE-2018-18495 State: PUBLISHED Published: 2019-02-28T18:00:00 Last Updated: 2024-08-05T11:08:21.948Z Vendors: Mozilla Products: Firefox Problem Types: WebExtension content scripts can be loaded in about: pages Description: WebExtension content scripts can be loaded into about: pages in some circumstances, in violation of the permissions granted to extensions. This could allow an extension to interfere with the loading and usage of these pages and use capabilities that were intended to be restricted from extensions. This vulnerability affects Firefox < 64. Additional Analyst Notes: - CVE Program Container: References: - https://www.mozilla.org/security/advisories/mfsa2018-29/ - https
l Analyst Notes: - CVE Program Container: References: - https://www.mozilla.org/security/advisories/mfsa2018-29/ - https://bugzilla.mozilla.org/show_bug.cgi?id=1427585 - https://usn.ubuntu.com/3844-1/ - http://www.securityfocus.com/bid/106167
CVE ID: CVE-2018-18496 State: PUBLISHED Published: 2019-02-28T18:00:00 Last Updated: 2024-08-05T11:08:21.999Z Vendors: Mozilla Products: Firefox Problem Types: Embedded feed preview page can be abused for clickjacking Description: When the RSS Feed preview about:feeds page is framed within another page, it can be used in concert with scripted content for a clickjacking attack that confuses users into downloading and executing an executable file from a temporary directory. *Note: This issue only affects Windows operating systems. Other operating systems are not affected.*. This vulnerability affects Firefox < 64. Additional Analyst Notes: - CVE Program Container: References: - https://www.moz
his vulnerability affects Firefox < 64. Additional Analyst Notes: - CVE Program Container: References: - https://www.mozilla.org/security/advisories/mfsa2018-29/ - https://bugzilla.mozilla.org/show_bug.cgi?id=1422231 - http://www.securityfocus.com/bid/106167
CVE ID: CVE-2018-18497 State: PUBLISHED Published: 2019-02-28T18:00:00 Last Updated: 2024-08-05T11:08:21.995Z Vendors: Mozilla Products: Firefox Problem Types: WebExtensions can load arbitrary URLs through pipe separators Description: Limitations on the URIs allowed to WebExtensions by the browser.windows.create API can be bypassed when a pipe in the URL field is used within the extension to load multiple pages as a single argument. This could allow a malicious WebExtension to open privileged about: or file: locations. This vulnerability affects Firefox < 64. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1488180 - https://www.mo
lyst Notes: - CVE Program Container: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1488180 - https://www.mozilla.org/security/advisories/mfsa2018-29/ - https://usn.ubuntu.com/3844-1/ - http://www.securityfocus.com/bid/106167
CVE ID: CVE-2018-18498 State: PUBLISHED Published: 2019-02-28T18:00:00 Last Updated: 2024-08-05T11:08:21.886Z Vendors: Mozilla Products: Thunderbird, Firefox ESR, Firefox Problem Types: Integer overflow when calculating buffer sizes for images Description: A potential vulnerability leading to an integer overflow can occur during buffer size calculations for images when a raw value is used instead of the checked value. This leads to a possible out-of-bounds write. This vulnerability affects Thunderbird < 60.4, Firefox ESR < 60.4, and Firefox < 64. Additional Analyst Notes: - CVE Program Container: References: - https://www.mozilla.org/security/advisories/mfsa2018-29/ - https://lists.debian.or
CVE Program Container: References: - https://www.mozilla.org/security/advisories/mfsa2018-29/ - https://lists.debian.org/debian-lts-announce/2018/12/msg00002.html - https://access.redhat.com/errata/RHSA-2018:3833 - https://access.redhat.com/errata/RHSA-2018:3831 - https://www.debian.org/security/2019/dsa-4362 - https://security.gentoo.org/glsa/201903-04 - https://usn.ubuntu.com/3844-1/ - http://www.securityfocus.com/bid/106168 - https://access.redhat.com/errata/RHSA-2019:0159 - https://www.mozilla.org/security/advisories/mfsa2018-31/ - https://www.mozilla.org/security/advisories/mfsa2018-30/ - https://www.debian.org/security/2018/dsa-4354 - https://usn.ubuntu.com/3868-1/ - https://bugzilla.
sories/mfsa2018-30/ - https://www.debian.org/security/2018/dsa-4354 - https://usn.ubuntu.com/3868-1/ - https://bugzilla.mozilla.org/show_bug.cgi?id=1500011 - https://access.redhat.com/errata/RHSA-2019:0160
CVE ID: CVE-2018-18499 State: PUBLISHED Published: 2019-02-28T18:00:00 Last Updated: 2024-08-05T11:08:21.929Z Vendors: Mozilla Products: Firefox, Firefox ESR, Thunderbird Problem Types: Same-origin policy violation using meta refresh and performance.getEntries to steal cross-origin URLs Description: A same-origin policy violation allowing the theft of cross-origin URL entries when using a meta http-equiv="refresh" on a page to cause a redirection to another site using performance.getEntries(). This is a same-origin policy violation and could allow for data theft. This vulnerability affects Firefox < 62, Firefox ESR < 60.2, and Thunderbird < 60.2.1. Additional Analyst Notes: - CVE Program Con
rability affects Firefox < 62, Firefox ESR < 60.2, and Thunderbird < 60.2.1. Additional Analyst Notes: - CVE Program Container: References: - https://www.mozilla.org/security/advisories/mfsa2018-20/ - https://bugzilla.mozilla.org/show_bug.cgi?id=1468523 - https://www.mozilla.org/security/advisories/mfsa2018-21/ - https://www.mozilla.org/security/advisories/mfsa2018-25/
CVE ID: CVE-2018-18500 State: PUBLISHED Published: 2019-02-05T21:00:00 Last Updated: 2024-08-05T11:08:21.883Z Vendors: n/a Products: n/a Problem Types: n/a Description: A use-after-free vulnerability can occur while parsing an HTML5 stream in concert with custom HTML elements. This results in the stream parser object being freed while still in use, leading to a potentially exploitable crash. This vulnerability affects Thunderbird < 60.5, Firefox ESR < 60.5, and Firefox < 65. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2019:0219 - https://www.mozilla.org/security/advisories/mfsa2019-01/ - https://usn.ubuntu.com/3897-1/ - http://www.se
SA-2019:0219 - https://www.mozilla.org/security/advisories/mfsa2019-01/ - https://usn.ubuntu.com/3897-1/ - http://www.securityfocus.com/bid/106781 - https://security.gentoo.org/glsa/201903-04 - https://usn.ubuntu.com/3874-1/ - https://access.redhat.com/errata/RHSA-2019:0269 - https://access.redhat.com/errata/RHSA-2019:0218 - https://www.mozilla.org/security/advisories/mfsa2019-02/ - https://www.debian.org/security/2019/dsa-4376 - https://lists.debian.org/debian-lts-announce/2019/02/msg00024.html - https://lists.debian.org/debian-lts-announce/2019/01/msg00025.html - https://www.mozilla.org/security/advisories/mfsa2019-03/ - https://www.debian.org/security/2019/dsa-4392 - https://access.redhat
www.mozilla.org/security/advisories/mfsa2019-03/ - https://www.debian.org/security/2019/dsa-4392 - https://access.redhat.com/errata/RHSA-2019:0270 - https://security.gentoo.org/glsa/201904-07 - http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00021.html
CVE ID: CVE-2018-18501 State: PUBLISHED Published: 2019-02-05T21:00:00 Last Updated: 2024-08-05T11:08:22.019Z Vendors: Mozilla Products: Thunderbird, Firefox ESR, Firefox Problem Types: Memory safety bugs fixed in Firefox 65 and Firefox ESR 60.5 Description: Mozilla developers and community members reported memory safety bugs present in Firefox 64 and Firefox ESR 60.4. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Thunderbird < 60.5, Firefox ESR < 60.5, and Firefox < 65. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.
ox ESR < 60.5, and Firefox < 65. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2019:0219 - https://www.mozilla.org/security/advisories/mfsa2019-01/ - https://usn.ubuntu.com/3897-1/ - http://www.securityfocus.com/bid/106781 - https://security.gentoo.org/glsa/201903-04 - https://usn.ubuntu.com/3874-1/ - https://access.redhat.com/errata/RHSA-2019:0269 - https://access.redhat.com/errata/RHSA-2019:0218 - https://www.mozilla.org/security/advisories/mfsa2019-02/ - https://www.debian.org/security/2019/dsa-4376 - https://lists.debian.org/debian-lts-announce/2019/02/msg00024.html - https://lists.debian.org/debian-lts-announce/2019/01/msg00025.ht
.debian.org/debian-lts-announce/2019/02/msg00024.html - https://lists.debian.org/debian-lts-announce/2019/01/msg00025.html - https://www.mozilla.org/security/advisories/mfsa2019-03/ - https://www.debian.org/security/2019/dsa-4392 - https://access.redhat.com/errata/RHSA-2019:0270 - https://security.gentoo.org/glsa/201904-07 - http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00021.html
CVE ID: CVE-2018-18502 State: PUBLISHED Published: 2019-02-05T21:00:00 Last Updated: 2024-08-05T11:08:21.958Z Vendors: Mozilla Products: Firefox Problem Types: Memory safety bugs fixed in Firefox 65 Description: Mozilla developers and community members reported memory safety bugs present in Firefox 64. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox < 65. Additional Analyst Notes: - CVE Program Container: References: - https://www.mozilla.org/security/advisories/mfsa2019-01/ - http://www.securityfocus.com/bid/106773 - https://usn.ubuntu.com/3874-1/
CVE ID: CVE-2018-18503 State: PUBLISHED Published: 2019-02-05T21:00:00 Last Updated: 2024-08-05T11:08:21.877Z Vendors: Mozilla Products: Firefox Problem Types: Memory corruption with Audio Buffer Description: When JavaScript is used to create and manipulate an audio buffer, a potentially exploitable crash may occur because of a compartment mismatch in some situations. This vulnerability affects Firefox < 65. Additional Analyst Notes: - CVE Program Container: References: - https://www.mozilla.org/security/advisories/mfsa2019-01/ - http://www.securityfocus.com/bid/106773 - https://usn.ubuntu.com/3874-1/
CVE ID: CVE-2018-18504 State: PUBLISHED Published: 2019-02-05T21:00:00 Last Updated: 2024-08-05T11:08:21.954Z Vendors: n/a Products: n/a Problem Types: n/a Description: A crash and out-of-bounds read can occur when the buffer of a texture client is freed while it is still in use during graphic operations. This results is a potentially exploitable crash and the possibility of reading from the memory of the freed buffers. This vulnerability affects Firefox < 65. Additional Analyst Notes: - CVE Program Container: References: - https://www.mozilla.org/security/advisories/mfsa2019-01/ - http://www.securityfocus.com/bid/106773 - https://usn.ubuntu.com/3874-1/
CVE ID: CVE-2018-18505 State: PUBLISHED Published: 2019-02-05T21:00:00 Last Updated: 2024-08-05T11:08:21.951Z Vendors: Mozilla Products: Thunderbird, Firefox ESR, Firefox Problem Types: Privilege escalation through IPC channel messages Description: An earlier fix for an Inter-process Communication (IPC) vulnerability, CVE-2011-3079, added authentication to communication between IPC endpoints and server parents during IPC process creation. This authentication is insufficient for channels created after the IPC process is started, leading to the authentication not being correctly applied to later channels. This could allow for a sandbox escape through IPC channels due to lack of message validat
tly applied to later channels. This could allow for a sandbox escape through IPC channels due to lack of message validation in the listener process. This vulnerability affects Thunderbird < 60.5, Firefox ESR < 60.5, and Firefox < 65. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2019:0219 - https://www.mozilla.org/security/advisories/mfsa2019-01/ - https://usn.ubuntu.com/3897-1/ - https://bugzilla.mozilla.org/show_bug.cgi?id=1087565 - http://www.securityfocus.com/bid/106781 - https://security.gentoo.org/glsa/201903-04 - https://usn.ubuntu.com/3874-1/ - https://access.redhat.com/errata/RHSA-2019:0269 - https://access.redhat.com/errata/R
- https://usn.ubuntu.com/3874-1/ - https://access.redhat.com/errata/RHSA-2019:0269 - https://access.redhat.com/errata/RHSA-2019:0218 - https://www.mozilla.org/security/advisories/mfsa2019-02/ - https://www.debian.org/security/2019/dsa-4376 - https://lists.debian.org/debian-lts-announce/2019/02/msg00024.html - https://lists.debian.org/debian-lts-announce/2019/01/msg00025.html - https://www.mozilla.org/security/advisories/mfsa2019-03/ - https://www.debian.org/security/2019/dsa-4392 - https://access.redhat.com/errata/RHSA-2019:0270 - https://security.gentoo.org/glsa/201904-07 - http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00021.html
CVE ID: CVE-2018-18506 State: PUBLISHED Published: 2019-02-05T21:00:00 Last Updated: 2024-08-05T11:08:21.887Z Vendors: Mozilla Products: Firefox Problem Types: Proxy Auto-Configuration file can define localhost access to be proxied Description: When proxy auto-detection is enabled, if a web server serves a Proxy Auto-Configuration (PAC) file or if a PAC file is loaded locally, this PAC file can specify that requests to the localhost are to be sent through the proxy to another server. This behavior is disallowed by default when a proxy is manually configured, but when enabled could allow for attacks on services and tools that bind to the localhost for networked behavior if they are accessed t
d could allow for attacks on services and tools that bind to the localhost for networked behavior if they are accessed through browsing. This vulnerability affects Firefox < 65. Additional Analyst Notes: - CVE Program Container: References: - https://www.mozilla.org/security/advisories/mfsa2019-01/ - http://www.securityfocus.com/bid/106773 - https://usn.ubuntu.com/3874-1/ - https://access.redhat.com/errata/RHSA-2019:0623 - https://access.redhat.com/errata/RHSA-2019:0622 - https://seclists.org/bugtraq/2019/Mar/28 - https://www.debian.org/security/2019/dsa-4411 - https://lists.debian.org/debian-lts-announce/2019/03/msg00024.html - http://lists.opensuse.org/opensuse-security-announce/2019-03/ms
s.debian.org/debian-lts-announce/2019/03/msg00024.html - http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00035.html - https://access.redhat.com/errata/RHSA-2019:0680 - https://access.redhat.com/errata/RHSA-2019:0681 - https://usn.ubuntu.com/3927-1/ - http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00043.html - https://www.debian.org/security/2019/dsa-4420 - https://seclists.org/bugtraq/2019/Apr/0 - https://lists.debian.org/debian-lts-announce/2019/04/msg00000.html - https://security.gentoo.org/glsa/201904-07 - http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00023.html - http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00043.html
se-security-announce/2019-04/msg00023.html - http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00043.html - https://access.redhat.com/errata/RHSA-2019:0966 - https://access.redhat.com/errata/RHSA-2019:1144
CVE ID: CVE-2018-18507 State: REJECTED Published: 2019-04-09T18:50:01 Last Updated: 2019-04-09T18:50:01 Description: No description available.
CVE ID: CVE-2018-18508 State: PUBLISHED Published: 2020-10-22T20:14:42 Last Updated: 2024-08-05T11:08:22.039Z Vendors: Mozilla Products: NSS Problem Types: Denial of Service through malformed signatures Description: In Network Security Services (NSS) before 3.36.7 and before 3.41.1, a malformed signature can cause a crash due to a null dereference, resulting in a Denial of Service. Additional Analyst Notes: - CVE Program Container: References: - https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.36.7_release_notes - https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.41.1_release_notes - https://cert-portal.siemens.com/productcert/pdf/ssa-379803.pdf - https:/
Mozilla/Projects/NSS/NSS_3.41.1_release_notes - https://cert-portal.siemens.com/productcert/pdf/ssa-379803.pdf - https://us-cert.cisa.gov/ics/advisories/icsa-21-040-04
CVE ID: CVE-2018-18509 State: PUBLISHED Published: 2019-04-26T16:13:22 Last Updated: 2024-08-05T11:08:21.996Z Vendors: Mozilla Products: Thunderbird Problem Types: S/MIME signature spoofing Description: A flaw during verification of certain S/MIME signatures causes emails to be shown in Thunderbird as having a valid digital signature, even if the shown message contents aren't covered by the signature. The flaw allows an attacker to reuse a valid S/MIME signature to craft an email message with arbitrary content. This vulnerability affects Thunderbird < 60.5.1. Additional Analyst Notes: - CVE Program Container: References: - http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00043
lyst Notes: - CVE Program Container: References: - http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00043.html - https://www.mozilla.org/security/advisories/mfsa2019-06/ - https://bugzilla.mozilla.org/show_bug.cgi?id=1507218 - http://www.openwall.com/lists/oss-security/2019/04/30/4 - http://seclists.org/fulldisclosure/2019/Apr/38 - http://packetstormsecurity.com/files/152703/Johnny-You-Are-Fired.html - https://access.redhat.com/errata/RHSA-2019:1144 - https://github.com/RUB-NDS/Johnny-You-Are-Fired - https://github.com/RUB-NDS/Johnny-You-Are-Fired/blob/master/paper/johnny-fired.pdf