CVE-2024-11159: Medium severity Mozilla Thunderbird vulnerability
Using remote content in OpenPGP encrypted messages can lead to the disclosure of plaintext.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Thunderbirdto a version that resolves this vulnerability.Fixed in 132.0.1 - Upgrade
Upgrade
debian/thunderbirdto a version that resolves this vulnerability.Fixed in 1:128.4.3esr-1~deb12u1 - Upgrade
Upgrade
debian/thunderbirdto a version that resolves this vulnerability.Fixed in 1:128.4.3esr-1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 128.4.3 - Upgrade
Upgrade
debian/thunderbirdto a version that resolves this vulnerability.Fixed in 1:140.12.0esr-1~deb12u1Fixed in 1:153.6.0esr-1~deb12u2Fixed in 1:140.12.0esr-1~deb13u1Fixed in 1:153.6.0esr-1~deb13u1Fixed in 1:153.5.0esr-1Fixed in 1:153.7.0esr-1
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2024-11159?
CVE-2024-11159 has a high severity due to its potential for plaintext disclosure.
How do I fix CVE-2024-11159?
To fix CVE-2024-11159, update Thunderbird to version 128.4.3 or later, or to version 132.0.1 or later.
Which versions of Thunderbird are affected by CVE-2024-11159?
Thunderbird versions prior to 128.4.3 and between 129.0 and 132.0.1 are affected by CVE-2024-11159.
What does CVE-2024-11159 exploit?
CVE-2024-11159 exploits the use of remote content in OpenPGP encrypted messages.
What are the consequences of CVE-2024-11159?
The main consequence of CVE-2024-11159 is the potential disclosure of sensitive plaintext information.