CVE-2024-1936: High severity Mozilla Thunderbird vulnerability
Last updated 24 July 2024
Other sources
The encrypted subject of an email message could be incorrectly and permanently assigned to an arbitrary other email message in Thunderbird's local cache. Consequently, when replying to the contaminated email message, the user might accidentally leak the confidential subject to a third party. While this update fixes the bug and avoids future message contamination, it does not automatically repair existing contaminations. Users are advised to use the repair folder functionality, which is available from the context menu of email folders, which will erase incorrect subject assignments.
External Reference: https://www.mozilla.org/en-US/security/advisories/mfsa2024-11/#CVE-2024-1936
— Red Hat
The encrypted subject of an email message could be incorrectly and permanently assigned to an arbitrary other email message in Thunderbird's local cache. Consequently, when replying to the contaminated email message, the user might accidentally leak the confidential subject to a third party. While this update fixes the bug and avoids future message contamination, it does not automatically repair existing contaminations. Users are advised to use the repair folder functionality, which is available from the context menu of email folders, which will erase incorrect subject assignments. This vulnerability affects Thunderbird < 115.8.1.
— Launchpad
The encrypted subject of an email message could be incorrectly and permanently assigned to an arbitrary other email message in Thunderbird's local cache. Consequently, when replying to the contaminated email message, the user might accidentally leak the confidential subject to a third-party. While this update fixes the bug and avoids future message contamination, it does not automatically repair existing contaminations. Users are advised to use the repair folder functionality, which is available from the context menu of email folders, which will erase incorrect subject assignments.
— Mozilla
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Thunderbirdto a version that resolves this vulnerability.Fixed in 115.8.1 - Upgrade
Upgrade
redhat/thunderbirdto a version that resolves this vulnerability.Fixed in 115.8.1 - Upgrade
Upgrade
debian/thunderbirdto a version that resolves this vulnerability.Fixed in 1:115.9.0-1~deb12u1 - Upgrade
Upgrade
debian/thunderbirdto a version that resolves this vulnerability.Fixed in 1:115.8.1-1 - Upgrade
Upgrade
debian/thunderbirdto a version that resolves this vulnerability.Fixed in 1:140.12.0esr-1~deb12u1Fixed in 1:153.7.0esr-1~deb12u1Fixed in 1:140.12.0esr-1~deb13u1Fixed in 1:153.7.0esr-1~deb13u1Fixed in 1:153.5.0esr-1Fixed in 1:153.7.0esr-1 - Operational
Use Thunderbird's Repair Folder functionality from the context menu of email folders to erase incorrect subject assignments in existing contaminated messages.
Event History
Frequently Asked Questions
What is the severity of CVE-2024-1936?
The severity of CVE-2024-1936 is classified as high due to the potential for confidential information leakage.
How do I fix CVE-2024-1936?
To fix CVE-2024-1936, upgrade Thunderbird to versions 115.12.0 or later or 128.6.0esr or later.
Which versions of Thunderbird are affected by CVE-2024-1936?
Versions of Thunderbird up to and including 115.8.1 are affected by CVE-2024-1936.
What is the nature of the vulnerability in CVE-2024-1936?
CVE-2024-1936 involves the incorrect permanent assignment of an email's encrypted subject to another email, risking confidential subject leakage.
Is CVE-2024-1936 a remote exploit?
CVE-2024-1936 is not a remote exploit and requires user interaction to trigger the vulnerability.