CVE-2018-12373: Infoleak
A flaw was found in Mozilla Thunderbird before version 52.9. Decrypted S/MIME parts hidden with CSS or <plaintext> can leak plaintext when included in a HTML reply/forward.
References: https://www.mozilla.org/en-US/security/advisories/mfsa2018-18/#CVE-2018-12373 https://bugzilla.mozilla.org/showbug.cgi?id=1464667
Other sources
dDecrypted S/MIME parts hidden with CSS or <plaintext> can leak plaintext when included in a HTML reply/forward.
dDecrypted S/MIME parts hidden with CSS or the plaintext HTML tag can leak plaintext when included in a HTML reply/forward. This vulnerability affects Thunderbird < 52.9.
— Launchpad
Affected Software
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2018-12373?
CVE-2018-12373 has been classified as a moderate severity vulnerability.
How do I fix CVE-2018-12373?
To fix CVE-2018-12373, update Mozilla Thunderbird to version 52.9 or later.
What types of data are affected by CVE-2018-12373?
CVE-2018-12373 can leak plaintext data from decrypted S/MIME parts that are hidden with CSS or <plaintext>.
Which versions of Thunderbird are vulnerable to CVE-2018-12373?
Mozilla Thunderbird versions prior to 52.9 are vulnerable to CVE-2018-12373.
Is CVE-2018-12373 specific to a particular operating system?
CVE-2018-12373 affects the Thunderbird application regardless of the operating system it is installed on.