{"id":"CVE-2018-18509","aliases":["DEBIAN-CVE-2018-18509","DLA-1678-1","DSA-4392-1","EUVD-2018-10234","GHSA-pqr9-248w-h9pf","MGASA-2019-0088","RHSA-2019:0680","RHSA-2019:0681","RHSA-2019:1144","SUSE-SU-2019:0469-1","SUSE-SU-2019:0853-1","UBUNTU-CVE-2018-18509","USN-3897-1","openSUSE-SU-2019:0249-1","openSUSE-SU-2019:0251-1","openSUSE-SU-2019:1162-1","openSUSE-SU-2024:10601-1"],"status":"published","title":"A flaw during verification of certain S/MIME signatures causes emails to be shown in Thunderbird...","description":"A flaw during verification of certain S/MIME signatures causes emails to be shown in Thunderbird as having a valid digital signature, even if the shown message contents aren't covered by the signature. The flaw allows an attacker to reuse a valid S/MIME signature to craft an email message with arbitrary content. This vulnerability affects Thunderbird \u003c 60.5.1.","severity":{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.01676,"percentile":0.77032,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-347"],"published":"2018-12-31T00:00:00Z","modified":"2026-10-23T18:03:03Z","fixes":[{"ecosystem":"Debian:12","package":"thunderbird","fixed_in":["1:60.5.1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"thunderbird","fixed_in":["1:60.5.1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"thunderbird","fixed_in":["1:60.5.1-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"thunderbird","fixed_in":["1:60.5.1+build2-0ubuntu0.14.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"thunderbird","fixed_in":["1:60.5.1+build2-0ubuntu0.16.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"thunderbird","fixed_in":["1:60.5.1+build2-0ubuntu0.18.04.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:60.5.1-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:60.5.1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:60.5.1-1"}]}]},{"source":"osv","ecosystem":"Debian:8","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:60.5.1-1~deb8u1"}]}],"versions":["1.5-4","1.5.0.2-1","1.5.0.2-2","1.5.0.2-3","1.5.0.4-1","1.5.0.4-2","1.5.0.4-3","1.5.0.5-1","1.5.0.7-1","1.5.0.7-2","1:52.4.0-1","1:52.4.0-1~deb7u1","1:52.4.0-1~deb8u1","1:52.4.0-1~deb9u1","1:52.4.0-2~exp1","1:52.5.0-1","1:52.5.0-1~deb7u1","1:52.5.0-1~deb8u1","1:52.5.0-1~deb9u1","1:52.5.2-1","1:52.5.2-1~deb7u1","1:52.5.2-2","1:52.5.2-2~deb8u1","1:52.5.2-2~deb9u1","1:52.6.0-1","1:52.6.0-1+alpha.1","1:52.6.0-1+alpha.2","1:52.6.0-1~deb7u1","1:52.6.0-1~deb8u1","1:52.6.0-1~deb9u1","1:52.7.0-1","1:52.7.0-1~deb7u1","1:52.7.0-1~deb8u1","1:52.7.0-1~deb9u1","1:52.8.0-1","1:52.8.0-1~deb7u1","1:52.8.0-1~deb8u1","1:52.8.0-1~deb9u1","1:52.9.0-1","1:52.9.1-1","1:52.9.1-1~deb8u1","1:52.9.1-1~deb9u1","1:58.0~b3-1","1:60.0-1","1:60.0-2","1:60.0-2~deb9u1","1:60.0-3","1:60.0-3~deb9u1","1:60.0~b10-1","1:60.0~b2-1","1:60.0~b3-1","1:60.0~b4-1","1:60.0~b5-1","1:60.0~b6-1","1:60.0~b9-1","1:60.0~b9-2","1:60.2.1-1","1:60.2.1-2~deb9u1","1:60.3.0-1","1:60.3.0-1~deb8u1","1:60.3.0-1~deb9u1","1:60.3.1-1","1:60.4.0-1","1:60.4.0-1~deb8u1","1:60.4.0-1~deb9u1","1:60.5.0-1","1:60.5.0-2","1:60.5.0-3"],"bundled":8},{"source":"osv","ecosystem":"Debian:9","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:60.5.1-1~deb9u1"}]}],"versions":["1.5-4","1.5.0.2-1","1.5.0.2-2","1.5.0.2-3","1.5.0.4-1","1.5.0.4-2","1.5.0.4-3","1.5.0.5-1","1.5.0.7-1","1.5.0.7-2","1:52.4.0-1","1:52.4.0-1~deb7u1","1:52.4.0-1~deb8u1","1:52.4.0-1~deb9u1","1:52.4.0-2~exp1","1:52.5.0-1","1:52.5.0-1~deb7u1","1:52.5.0-1~deb8u1","1:52.5.0-1~deb9u1","1:52.5.2-1","1:52.5.2-1~deb7u1","1:52.5.2-2","1:52.5.2-2~deb8u1","1:52.5.2-2~deb9u1","1:52.6.0-1","1:52.6.0-1+alpha.1","1:52.6.0-1+alpha.2","1:52.6.0-1~deb7u1","1:52.6.0-1~deb8u1","1:52.6.0-1~deb9u1","1:52.7.0-1","1:52.7.0-1~deb7u1","1:52.7.0-1~deb8u1","1:52.7.0-1~deb9u1","1:52.8.0-1","1:52.8.0-1~deb7u1","1:52.8.0-1~deb8u1","1:52.8.0-1~deb9u1","1:52.9.0-1","1:52.9.1-1","1:52.9.1-1~deb8u1","1:52.9.1-1~deb9u1","1:58.0~b3-1","1:60.0-1","1:60.0-2","1:60.0-2~deb9u1","1:60.0-3","1:60.0-3~deb9u1","1:60.0~b10-1","1:60.0~b2-1","1:60.0~b3-1","1:60.0~b4-1","1:60.0~b5-1","1:60.0~b6-1","1:60.0~b9-1","1:60.0~b9-2","1:60.2.1-1","1:60.2.1-2~deb9u1","1:60.3.0-1","1:60.3.0-1~deb8u1","1:60.3.0-1~deb9u1","1:60.3.1-1","1:60.4.0-1","1:60.4.0-1~deb8u1","1:60.4.0-1~deb9u1","1:60.5.0-1","1:60.5.0-2","1:60.5.0-3","1:60.5.1-1~deb8u1"],"bundled":8},{"source":"osv","ecosystem":"Mageia:6","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"60.5.1-1.mga6"}]}],"bundled":4},{"source":"osv","ecosystem":"Mageia:6","package":"thunderbird-l10n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"60.5.1-1.mga6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:60.6.1-1.el6_10"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"thunderbird-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:60.6.1-1.el6_10"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:60.6.1-1.el6_10"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"thunderbird-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:60.6.1-1.el6_10"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:60.6.1-1.el6_10"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"thunderbird-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:60.6.1-1.el6_10"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:60.6.1-1.el7_6"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"thunderbird-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:60.6.1-1.el7_6"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:60.6.1-1.el7_6"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"thunderbird-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:60.6.1-1.el7_6"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:60.6.1-1.el7_6"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"thunderbird-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:60.6.1-1.el7_6"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:60.6.1-1.el8"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"thunderbird-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:60.6.1-1.el8"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"thunderbird-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:60.6.1-1.el8"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15","package":"MozillaThunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"60.5.1-3.24.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15","package":"MozillaThunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"60.6.1-3.28.1"}]}],"bundled":16},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:60.5.1+build2-0ubuntu0.14.04.1"}]}],"versions":["1:24.0+build1-0ubuntu1","1:24.0+build1-0ubuntu2","1:24.1.1+build1-0ubuntu0.13.10.1","1:24.1.1+build1-0ubuntu1","1:24.2.0+build1-0ubuntu1","1:24.4.0+build1-0ubuntu1","1:24.5.0+build1-0ubuntu0.14.04.1","1:24.6.0+build1-0ubuntu0.14.04.1","1:31.0+build1-0ubuntu0.14.04.1","1:31.1.1+build1-0ubuntu0.14.04.1","1:31.1.2+build1-0ubuntu0.14.04.1","1:31.2.0+build2-0ubuntu0.14.04.1","1:31.3.0+build1-0ubuntu0.14.04.1","1:31.4.0+build1-0ubuntu0.14.04.1","1:31.5.0+build1-0ubuntu0.14.04.1","1:31.6.0+build1-0ubuntu0.14.04.1","1:31.7.0+build1-0ubuntu0.14.04.1","1:31.8.0+build1-0ubuntu0.14.04.1","1:38.2.0+build1-0ubuntu0.14.04.1","1:38.3.0+build1-0ubuntu0.14.04.1","1:38.4.0+build3-0ubuntu0.14.04.1","1:38.5.1+build2-0ubuntu0.14.04.1","1:38.6.0+build1-0ubuntu0.14.04.1","1:38.7.2+build1-0ubuntu0.14.04.1","1:38.8.0+build1-0ubuntu0.14.04.1","1:45.2.0+build1-0ubuntu0.14.04.3","1:45.3.0+build1-0ubuntu0.14.04.4","1:45.4.0+build1-0ubuntu0.14.04.1","1:45.5.1+build1-0ubuntu0.14.04.1","1:45.7.0+build1-0ubuntu0.14.04.1","1:45.8.0+build1-0ubuntu0.14.04.1","1:52.1.1+build1-0ubuntu0.14.04.1","1:52.2.1+build1-0ubuntu0.14.04.1","1:52.3.0+build1-0ubuntu0.14.04.1","1:52.4.0+build1-0ubuntu0.14.04.2","1:52.5.0+build1-0ubuntu0.14.04.1","1:52.6.0+build1-0ubuntu0.14.04.1","1:52.7.0+build1-0ubuntu0.14.04.1","1:52.8.0+build1-0ubuntu0.14.04.1","1:52.9.1+build3-0ubuntu0.14.04.1","1:60.2.1+build1-0ubuntu0.14.04.2","1:60.4.0+build2-0ubuntu0.14.04.1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:60.5.1+build2-0ubuntu0.16.04.1"}]}],"versions":["1:38.3.0+build1-0ubuntu2","1:38.5.1+build2-0ubuntu1","1:38.6.0+build1-0ubuntu1","1:38.7.2+build1-0ubuntu0.16.04.1","1:38.8.0+build1-0ubuntu0.16.04.1","1:45.2.0+build1-0ubuntu0.16.04.1","1:45.3.0+build1-0ubuntu0.16.04.2","1:45.4.0+build1-0ubuntu0.16.04.1","1:45.5.1+build1-0ubuntu0.16.04.1","1:45.7.0+build1-0ubuntu0.16.04.1","1:45.8.0+build1-0ubuntu0.16.04.1","1:52.1.1+build1-0ubuntu0.16.04.1","1:52.2.1+build1-0ubuntu0.16.04.1","1:52.3.0+build1-0ubuntu0.16.04.1","1:52.4.0+build1-0ubuntu0.16.04.2","1:52.5.0+build1-0ubuntu0.16.04.1","1:52.6.0+build1-0ubuntu0.16.04.1","1:52.7.0+build1-0ubuntu0.16.04.1","1:52.8.0+build1-0ubuntu0.16.04.1","1:52.9.1+build3-0ubuntu0.16.04.1","1:60.2.1+build1-0ubuntu0.16.04.4","1:60.4.0+build2-0ubuntu0.16.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:60.5.1+build2-0ubuntu0.18.04.1"}]}],"versions":["1:52.4.0+build1-0ubuntu2","1:52.6.0+build1-0ubuntu1","1:52.7.0+build1-0ubuntu1","1:52.8.0+build1-0ubuntu0.18.04.1","1:52.9.1+build3-0ubuntu0.18.04.1","1:60.2.1+build1-0ubuntu0.18.04.2","1:60.4.0+build2-0ubuntu0.18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:60.5.1+build2-0ubuntu0.14.04.1"}]}],"versions":["1:24.0+build1-0ubuntu1","1:24.0+build1-0ubuntu2","1:24.1.1+build1-0ubuntu0.13.10.1","1:24.1.1+build1-0ubuntu1","1:24.2.0+build1-0ubuntu1","1:24.4.0+build1-0ubuntu1","1:24.5.0+build1-0ubuntu0.14.04.1","1:24.6.0+build1-0ubuntu0.14.04.1","1:31.0+build1-0ubuntu0.14.04.1","1:31.1.1+build1-0ubuntu0.14.04.1","1:31.1.2+build1-0ubuntu0.14.04.1","1:31.2.0+build2-0ubuntu0.14.04.1","1:31.3.0+build1-0ubuntu0.14.04.1","1:31.4.0+build1-0ubuntu0.14.04.1","1:31.5.0+build1-0ubuntu0.14.04.1","1:31.6.0+build1-0ubuntu0.14.04.1","1:31.7.0+build1-0ubuntu0.14.04.1","1:31.8.0+build1-0ubuntu0.14.04.1","1:38.2.0+build1-0ubuntu0.14.04.1","1:38.3.0+build1-0ubuntu0.14.04.1","1:38.4.0+build3-0ubuntu0.14.04.1","1:38.5.1+build2-0ubuntu0.14.04.1","1:38.6.0+build1-0ubuntu0.14.04.1","1:38.7.2+build1-0ubuntu0.14.04.1","1:38.8.0+build1-0ubuntu0.14.04.1","1:45.2.0+build1-0ubuntu0.14.04.3","1:45.3.0+build1-0ubuntu0.14.04.4","1:45.4.0+build1-0ubuntu0.14.04.1","1:45.5.1+build1-0ubuntu0.14.04.1","1:45.7.0+build1-0ubuntu0.14.04.1","1:45.8.0+build1-0ubuntu0.14.04.1","1:52.1.1+build1-0ubuntu0.14.04.1","1:52.2.1+build1-0ubuntu0.14.04.1","1:52.3.0+build1-0ubuntu0.14.04.1","1:52.4.0+build1-0ubuntu0.14.04.2","1:52.5.0+build1-0ubuntu0.14.04.1","1:52.6.0+build1-0ubuntu0.14.04.1","1:52.7.0+build1-0ubuntu0.14.04.1","1:52.8.0+build1-0ubuntu0.14.04.1","1:52.9.1+build3-0ubuntu0.14.04.1","1:60.2.1+build1-0ubuntu0.14.04.2","1:60.4.0+build2-0ubuntu0.14.04.1"],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:60.5.1+build2-0ubuntu0.16.04.1"}]}],"versions":["1:38.3.0+build1-0ubuntu2","1:38.5.1+build2-0ubuntu1","1:38.6.0+build1-0ubuntu1","1:38.7.2+build1-0ubuntu0.16.04.1","1:38.8.0+build1-0ubuntu0.16.04.1","1:45.2.0+build1-0ubuntu0.16.04.1","1:45.3.0+build1-0ubuntu0.16.04.2","1:45.4.0+build1-0ubuntu0.16.04.1","1:45.5.1+build1-0ubuntu0.16.04.1","1:45.7.0+build1-0ubuntu0.16.04.1","1:45.8.0+build1-0ubuntu0.16.04.1","1:52.1.1+build1-0ubuntu0.16.04.1","1:52.2.1+build1-0ubuntu0.16.04.1","1:52.3.0+build1-0ubuntu0.16.04.1","1:52.4.0+build1-0ubuntu0.16.04.2","1:52.5.0+build1-0ubuntu0.16.04.1","1:52.6.0+build1-0ubuntu0.16.04.1","1:52.7.0+build1-0ubuntu0.16.04.1","1:52.8.0+build1-0ubuntu0.16.04.1","1:52.9.1+build3-0ubuntu0.16.04.1","1:60.2.1+build1-0ubuntu0.16.04.4","1:60.4.0+build2-0ubuntu0.16.04.1"],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:60.5.1+build2-0ubuntu0.18.04.1"}]}],"versions":["1:52.4.0+build1-0ubuntu2","1:52.6.0+build1-0ubuntu1","1:52.7.0+build1-0ubuntu1","1:52.8.0+build1-0ubuntu0.18.04.1","1:52.9.1+build3-0ubuntu0.18.04.1","1:60.2.1+build1-0ubuntu0.18.04.2","1:60.4.0+build2-0ubuntu0.18.04.1"],"bundled":7},{"source":"osv","ecosystem":"SUSE:Package Hub 12","package":"MozillaThunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"60.5.1-79.1"}]}],"bundled":14},{"source":"osv","ecosystem":"openSUSE:Leap 15.0","package":"MozillaThunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"60.6.1-lp150.3.37.1"}]}],"bundled":16},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"MozillaThunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"91.1.1-1.1"}]}],"bundled":394}],"products":[{"vendor":"mozilla","product":"thunderbird"}],"references":[{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00043.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2019-06/","tags":["x_refsource_MISC","x_transferred","Vendor Advisory","advisory"]},{"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=1507218","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Permissions Required","Vendor Advisory","report"]},{"url":"http://www.openwall.com/lists/oss-security/2019/04/30/4","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"http://seclists.org/fulldisclosure/2019/Apr/38","tags":["mailing-list","x_refsource_FULLDISC","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"http://packetstormsecurity.com/files/152703/Johnny-You-Are-Fired.html","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2019:1144","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory"]},{"url":"https://github.com/RUB-NDS/Johnny-You-Are-Fired","tags":["x_refsource_MISC","x_transferred","package"]},{"url":"https://github.com/RUB-NDS/Johnny-You-Are-Fired/blob/master/paper/johnny-fired.pdf","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-18509","tags":["advisory"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2019-06"},{"url":"https://github.com/advisories/GHSA-pqr9-248w-h9pf"},{"url":"https://security-tracker.debian.org/tracker/CVE-2018-18509","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2019-0088.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=24360","tags":["report"]},{"url":"https://www.thunderbird.net/en-US/thunderbird/60.5.1/releasenotes/","tags":["web"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2019-06/","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2019:0680","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2019-11/","tags":["article"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2019-12/","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1690673","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1690674","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1690675","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1690676","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1690677","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1690678","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1690680","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1690681","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1692181","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1692182","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_0680.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-18356","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1656570","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-18356","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-18356","tags":["advisory"]},{"url":"https://chromereleases.googleblog.com/2018/12/stable-channel-update-for-desktop.html","tags":["article"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2019-04/#CVE-2018-18356","tags":["article"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2019-05/#CVE-2018-18356","tags":["article"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2019-06/#CVE-2018-18356","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-18506","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-18506","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-18506","tags":["advisory"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2019-08/#CVE-2018-18506","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-18509","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1677613","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-18509","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-5785","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1676991","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-5785","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-5785","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-9788","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-9788","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-9788","tags":["advisory"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2019-08/#CVE-2019-9788","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-9790","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-9790","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-9790","tags":["advisory"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2019-08/#CVE-2019-9790","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-9791","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-9791","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-9791","tags":["advisory"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2019-08/#CVE-2019-9791","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-9792","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-9792","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-9792","tags":["advisory"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2019-08/#CVE-2019-9792","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-9793","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-9793","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-9793","tags":["advisory"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2019-08/#CVE-2019-9793","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-9795","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-9795","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-9795","tags":["advisory"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2019-08/#CVE-2019-9795","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-9796","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-9796","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-9796","tags":["advisory"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2019-08/#CVE-2019-9796","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-9810","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-9810","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-9810","tags":["advisory"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2019-10/#CVE-2019-9810","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-9813","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-9813","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-9813","tags":["advisory"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2019-10/#CVE-2019-9813","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2019:0681","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_0681.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1692449","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_1144.json","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20190469-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1125330","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2018-18335","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-18356","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-18509","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-5785","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20190853-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1129821","tags":["report"]},{"url":"https://bugzilla.suse.com/1130262","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2018-18506","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9788","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9790","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9791","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9792","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9793","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9794","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9795","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9796","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9801","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9810","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9813","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2018-18509","tags":["report"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2019-06/#CVE-2018-18511","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-3897-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2016-5824","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-18356","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-18500","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-18501","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-18505","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-5785","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/NSXP45BAXW5ILKJSQRXHTBUOBZUKLD2F/#NSXP45BAXW5ILKJSQRXHTBUOBZUKLD2F","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1122983","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5824","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12405","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-17466","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-18492","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-18493","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-18494","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-18498","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-18500","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-18501","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-18505","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/YTL5HAWTQVZCKKAVSVP4LCGEQTWZR73J/#YTL5HAWTQVZCKKAVSVP4LCGEQTWZR73J","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1119105","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/AL5AUD2CY37ZNSQZPBX6C3K32ZVWBIIH/#AL5AUD2CY37ZNSQZPBX6C3K32ZVWBIIH","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2007-3089","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2007-3285","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2007-3656","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2007-3670","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2007-3734","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2007-3735","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2007-3736","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2007-3737","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2007-3738","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2008-0016","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2008-1233","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2008-1236","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2008-3835","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2008-4058","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2008-4061","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2008-4064","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2008-4065","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2008-4067","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2008-4070","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2008-5012","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2008-5014","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2008-5016","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2008-5021","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2008-5022","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2008-5024","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2008-5500","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2008-5503","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2008-5506","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2008-5507","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2008-5508","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2008-5510","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2008-5511","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9893","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9895","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9897","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9898","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9899","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9900","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9904","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9905","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-16541","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5373","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5375","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5376","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5378","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5380","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5383","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5390","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5396","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5398","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5399","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5400","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5401","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5402","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5403","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5404","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5405","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5406","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5407","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5408","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5410","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5412","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5413","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5414","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5416","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5418","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5419","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5421","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5422","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5426","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5429","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5430","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5432","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5433","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5434","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5435","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5436","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5437","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5438","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5439","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5440","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5441","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5442","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5443","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5444","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5445","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5446","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5447","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5449","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5451","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5454","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5459","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5460","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5461","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5462","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5464","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5465","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5466","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5467","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5469","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5470","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5472","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7749","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7750","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7751","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7752","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7753","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7754","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7756","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7757","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7758","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7763","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7764","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7765","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7773","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7777","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7778","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7779","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7782","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7784","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7785","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7786","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7787","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7791","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7792","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7793","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7798","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7800","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7801","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7802","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7803","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7804","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7805","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7807","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7810","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7814","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7818","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7819","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7823","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7824","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7825","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7826","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7828","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7829","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7830","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7845","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7846","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7847","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7848","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12359","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12360","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12361","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12362","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12363","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12364","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12365","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12366","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12367","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12371","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12372","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12373","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12374","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12376","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12377","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12378","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12383","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12385","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12389","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12390","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12391","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12392","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12393","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-18511","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-5089","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-5095","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-5096","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-5097","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-5098","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-5099","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-5102","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-5103","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-5104","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-5117","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-5125","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-5127","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-5129","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-5144","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-5145","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-5146","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-5150","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-5154","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-5155","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-5156","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-5159","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-5161","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-5162","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-5168","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-5170","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-5174","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-5178","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-5183","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-5184","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-5185","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-5187","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-5188","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11691","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11692","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11693","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11694","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11698","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11703","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11704","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11705","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11706","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11707","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11708","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11709","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11711","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11712","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11713","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11715","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11717","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11719","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11729","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11730","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11739","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11740","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11742","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11743","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11744","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11746","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11752","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11755","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11757","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11758","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11759","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11760","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11761","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11762","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11763","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11764","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-13722","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-15903","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-17005","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-17008","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-17010","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-17011","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-17012","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-17015","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-17016","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-17017","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-17021","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-17022","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-17024","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-17026","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-20503","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-5798","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-7317","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9797","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9800","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9811","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9815","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9816","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9817","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9818","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9819","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9820","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-12387","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-12392","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-12393","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-12395","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-12397","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-12398","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-12405","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-12406","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-12410","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-12417","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-12418","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-12419","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-12420","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-12421","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-15652","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-15659","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-15663","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-15664","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-15669","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-15673","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-15676","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-15677","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-15678","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-15683","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-15685","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-15969","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-15999","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-16012","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-16042","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-16044","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-26950","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-26951","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-26953","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-26956","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-26958","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-26959","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-26960","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-26961","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-26965","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-26966","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-26968","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-26970","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-26971","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-26973","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-26974","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-26976","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-26978","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-35111","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-35112","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-35113","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-6463","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-6514","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-6792","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-6793","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-6794","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-6795","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-6797","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-6798","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-6800","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-6805","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-6806","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-6807","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-6811","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-6812","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-6814","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-6819","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-6820","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-6821","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-6822","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-6825","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-6831","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-23953","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-23954","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-23960","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-23961","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-23964","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-23968","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-23969","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-23973","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-23978","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-23981","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-23982","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-23984","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-23987","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-23991","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-23993","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-23994","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-23995","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-23998","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-23999","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-24002","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-29945","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-29946","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-29948","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-29956","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-29957","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-29964","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-29967","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-29969","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-29970","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-29976","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-29980","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-29984","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-29985","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-29986","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-29988","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-29989","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-29991","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-30547","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-38492","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-38495","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2018-18509","description":"A flaw during verification of certain S/MIME signatures causes emails to be shown in Thunderbird as having a valid digital signature, even if the shown message contents aren't covered by the signature. The flaw allows an attacker to reuse a valid S/MIME signature to craft an email message with arbitrary content. This vulnerability affects Thunderbird \u003c 60.5.1.","status":"published","published":"2019-04-26T16:13:22Z","modified":"2024-08-05T11:08:21.996Z","updated_at":"2026-11-02T14:35:11.426178Z"}],"euvd":[{"id":"EUVD-2018-10234","description":"A flaw during verification of certain S/MIME signatures causes emails to be shown in Thunderbird as having a valid digital signature, even if the shown message contents aren't covered by the signature. The flaw allows an attacker to reuse a valid S/MIME signature to craft an email message with arbitrary content. This vulnerability affects Thunderbird \u003c 60.5.1.","status":"published","published":"2019-04-26T16:13:22Z","modified":"2024-08-05T11:08:21Z","updated_at":"2026-11-03T02:39:36.317092Z"}],"ghsa":[{"id":"GHSA-pqr9-248w-h9pf","title":"A flaw during verification of certain S/MIME signatures causes emails to be shown in Thunderbird...","description":"A flaw during verification of certain S/MIME signatures causes emails to be shown in Thunderbird as having a valid digital signature, even if the shown message contents aren't covered by the signature. The flaw allows an attacker to reuse a valid S/MIME signature to craft an email message with arbitrary content. This vulnerability affects Thunderbird \u003c 60.5.1.","status":"published","published":"2022-05-24T16:44:43Z","modified":"2024-04-11T21:08:51Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-347"],"updated_at":"2026-11-02T14:57:07.421443Z"}],"nvd":[{"id":"CVE-2018-18509","description":"A flaw during verification of certain S/MIME signatures causes emails to be shown in Thunderbird as having a valid digital signature, even if the shown message contents aren't covered by the signature. The flaw allows an attacker to reuse a valid S/MIME signature to craft an email message with arbitrary content. This vulnerability affects Thunderbird \u003c 60.5.1.","status":"published","published":"2019-04-26T17:29:00.243Z","modified":"2026-06-17T01:47:25.993Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-347"],"updated_at":"2026-11-02T14:04:57.307075Z"}],"osv":[{"id":"CVE-2018-18509","description":"A flaw during verification of certain S/MIME signatures causes emails to be shown in Thunderbird as having a valid digital signature, even if the shown message contents aren't covered by the signature. The flaw allows an attacker to reuse a valid S/MIME signature to craft an email message with arbitrary content. This vulnerability affects Thunderbird \u003c 60.5.1.","status":"published","published":"2019-04-26T17:29:00.243Z","modified":"2026-04-16T04:31:23.03678839Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:08.834469Z"},{"id":"DEBIAN-CVE-2018-18509","description":"A flaw during verification of certain S/MIME signatures causes emails to be shown in Thunderbird as having a valid digital signature, even if the shown message contents aren't covered by the signature. The flaw allows an attacker to reuse a valid S/MIME signature to craft an email message with arbitrary content. This vulnerability affects Thunderbird \u003c 60.5.1.","status":"published","published":"2019-04-26T17:29:00.243Z","modified":"2026-10-23T18:03:03.103194639Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:30.57382Z"},{"id":"RHSA-2019:0680","title":"Red Hat Security Advisory: thunderbird security update","status":"published","published":"2024-09-16T02:16:10Z","modified":"2026-06-28T10:28:50Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:05.383061Z"},{"id":"RHSA-2019:0681","title":"Red Hat Security Advisory: thunderbird security update","status":"published","published":"2024-09-16T02:16:23Z","modified":"2026-06-28T10:28:50Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:05.383061Z"},{"id":"RHSA-2019:1144","title":"Red Hat Security Advisory: thunderbird security update","status":"published","published":"2024-09-16T02:16:40Z","modified":"2026-06-28T10:29:17Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:05.383061Z"},{"id":"UBUNTU-CVE-2018-18509","description":"A flaw during verification of certain S/MIME signatures causes emails to be shown in Thunderbird as having a valid digital signature, even if the shown message contents aren't covered by the signature. The flaw allows an attacker to reuse a valid S/MIME signature to craft an email message with arbitrary content. This vulnerability affects Thunderbird \u003c 60.5.1.","status":"published","published":"2018-12-31T00:00:00Z","modified":"2026-04-22T11:49:17.778702Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:17.496046Z"},{"id":"DLA-1678-1","title":"thunderbird - security update","status":"published","published":"2019-02-16T00:00:00Z","modified":"2026-03-09T01:23:35.449662Z","updated_at":"2026-11-02T15:46:09.777694Z"},{"id":"DSA-4392-1","title":"thunderbird - security update","status":"published","published":"2019-02-16T00:00:00Z","modified":"2026-03-09T02:10:52.254789Z","updated_at":"2026-11-02T15:46:16.862196Z"},{"id":"MGASA-2019-0088","title":"Updated thunderbird packages fix security vulnerability","description":"A use-after-free vulnerability in the Skia library can occur when creating\na path, leading to a potentially exploitable crash. (CVE-2018-18356)\n\nAn integer overflow vulnerability in the Skia library can occur after\nspecific transform operations, leading to a potentially exploitable crash.\n(CVE-2019-5785)\n\nA buffer overflow vulnerability in the Skia library can occur with Canvas\n2D acceleration on macOS. This issue was addressed by disabling Canvas 2D\nacceleration in Firefox ESR. (CVE-2018-18335)\n\nA flaw during verification of certain S/MIME signatures causes emails to\nbe shown in Thunderbird as having a valid digital signature, even if the\nshown message contents aren't covered by the signature. The flaw allows an\nattacker to reuse a valid S/MIME signature to craft an email message with\narbitrary content. (CVE-2018-18509)\n","status":"published","published":"2019-02-17T17:17:45Z","modified":"2026-04-16T04:40:36.71768646Z","updated_at":"2026-11-02T15:49:40.793816Z"},{"id":"openSUSE-SU-2019:0249-1","title":"Security update for MozillaThunderbird","description":"This update for MozillaThunderbird to version 60.5.1 fixes the following issues:\n\nSecurity vulnerabilities addressed (MFSA 2019-03 MFSA 2018-31 bsc#1122983 and MFSA 2019-06 bsc#1125330):\n\n- CVE-2018-18356: Fixed a Use-after-free in Skia.\n- CVE-2019-5785: Fixed an Integer overflow in Skia.\n- CVE-2018-18335: Fixed a Buffer overflow in Skia by default deactivating Canvas 2D.\n  This issue does not affect Linuc distributions.\n- CVE-2018-18509: Fixed a flaw which during verification of certain S/MIME signatures\n  showing mistekenly that emails bring a valid sugnature. \n- CVE-2018-18500: Use-after-free parsing HTML5 stream\n- CVE-2018-18505: Privilege escalation through IPC channel messages\n- CVE-2016-5824: DoS (use-after-free) via a crafted ics file\n- CVE-2018-18501: Memory safety bugs fixed in Firefox 65 and Firefox ESR 60.5\n- CVE-2018-17466: Buffer overflow and out-of-bounds read in ANGLE library with\n  TextureStorage11\n- CVE-2018-18492: Use-after-free with select element\n- CVE-2018-18493: Buffer overflow in accelerated 2D canvas with Skia\n- CVE-2018-18494: Same-origin policy violation using location attribute and\n  performance.getEntries to steal cross-origin URLs\n- CVE-2018-18498: Integer overflow when calculating buffer sizes for images\n- CVE-2018-12405: Memory safety bugs\n\nOther bug fixes and changes:\n\n* FileLink provider WeTransfer to upload large attachments\n* Thunderbird now allows the addition of OpenSearch search engines\n  from a local XML file using a minimal user inferface: [+] button\n  to select a file an add, [-] to remove.\n* More search engines: Google and DuckDuckGo available by default\n  in some locales\n* During account creation, Thunderbird will now detect servers\n  using the Microsoft Exchange protocol. It will offer the\n  installation of a 3rd party add-on (Owl) which supports that\n  protocol.\n* Thunderbird now compatible with other WebExtension-based\n  FileLink add-ons like the Dropbox add-on\n* New WebExtensions FileLink API to facilitate add-ons\n* Fix decoding problems for messages with less common charsets\n  (cp932, cp936)\n* New messages in the drafts folder (and other special or virtual\n  folders) will no longer be included in the new messages\n  notification\n* Thunderbird 60 will migrate security databases (key3.db, cert8.db\n  to key4.db, cert9.db). Thunderbird 60.3.2 and earlier contained a\n  fault that potentially deleted saved passwords and private certificate\n  keys for users using a master password. Version 60.3.3 will prevent\n  the loss of data; affected users who have already upgraded to version\n  60.3.2 or earlier can restore the deleted key3.db file from backup\n  to complete the migration.\n* Address book search and auto-complete slowness introduced in\n  Thunderbird 60.3.2\n* Plain text markup with * for bold, / for italics, _ for underline\n  and | for code did not work when the enclosed text contained\n  non-ASCII characters\n* While composing a message, a link not removed when link location\n  was removed in the link properties panel\n* Encoding problems when exporting address books or messages using\n  the system charset. Messages are now always exported using the\n  UTF-8 encoding\n* If the 'Date' header of a message was invalid, Jan 1970 or Dec 1969\n  was displayed. Now using date from 'Received' header instead.\n* Body search/filtering didn't reliably ignore content of tags\n* Inappropriate warning 'Thunderbird prevented the site\n  (addons.thunderbird.net) from asking you to install software on\n  your computer' when installing add-ons\n* Incorrect display of correspondents column since own email\n  address was not always detected\n* Spurious \u0026#xA; (encoded newline) inserted into drafts and sent email\n* Double-clicking on a word in the Write window sometimes\n  launched the Advanced Property Editor or Link Properties dialog\n* Fixe Cookie removal\n* 'Download rest of message' was not working if global inbox was\n  used\n* Fix Encoding problems for users (especially in Poland) when a\n  file was sent via a folder using 'Sent to \u003e Mail recipient'\n  due to a problem in the Thunderbird MAPI interface\n* According to RFC 4616 and RFC 5721, passwords containing\n  non-ASCII characters are encoded using UTF-8 which can lead to\n  problems with non-compliant providers, for example\n  office365.com. The SMTP LOGIN and POP3 USER/PASS\n  authentication methods are now using a Latin-1 encoding again\n  to work around this issue\n* Fix shutdown crash/hang after entering an empty IMAP password\n","status":"published","published":"2019-02-26T09:44:25Z","modified":"2025-05-02T04:30:17.021517Z","updated_at":"2026-11-02T16:58:30.39372Z"},{"id":"openSUSE-SU-2019:0251-1","title":"Security update for MozillaThunderbird","description":"This update for MozillaThunderbird to version 60.5.1 fixes the following issues:\n\nSecurity vulnerabilities addressed (MSFA 2019-03 MSFA 2018-31 MFSA 2019-06  bsc#1122983 bsc#1119105 bsc#1125330):\n\n- CVE-2018-18356: Fixed a Use-after-free in Skia.\n- CVE-2019-5785: Fixed an Integer overflow in Skia.\n- CVE-2018-18335: Fixed a Buffer overflow in Skia by default deactivating Canvas 2D.\n  This issue does not affect Linuc distributions.\n- CVE-2018-18509: Fixed a flaw which during verification of certain S/MIME signatures\n  showing mistekenly that emails bring a valid sugnature. \n- CVE-2018-18500: Use-after-free parsing HTML5 stream\n- CVE-2018-18505: Privilege escalation through IPC channel messages\n- CVE-2016-5824 DoS (use-after-free) via a crafted ics file\n- CVE-2018-18501: Memory safety bugs fixed in Firefox 65 and Firefox ESR 60.5\n- CVE-2018-17466: Buffer overflow and out-of-bounds read in ANGLE library with\n  TextureStorage11\n- CVE-2018-18492: Use-after-free with select element\n- CVE-2018-18493: Buffer overflow in accelerated 2D canvas with Skia\n- CVE-2018-18494: Same-origin policy violation using location attribute and\n  performance.getEntries to steal cross-origin URLs\n- CVE-2018-18498: Integer overflow when calculating buffer sizes for images\n- CVE-2018-12405: Memory safety bugs fixed in Firefox 64, 60.4, and\n  Thunderbird 60.4\n\nOther bug fixes and changes:\n\n- FileLink provider WeTransfer to upload large attachments\n- Thunderbird now allows the addition of OpenSearch search engines\n  from a local XML file using a minimal user interface: [+] button\n  to select a file an add, [-] to remove.\n- More search engines: Google and DuckDuckGo available by default\n  in some locales\n- During account creation, Thunderbird will now detect servers using the\n  Microsoft Exchange protocol. It will offer the installation of a 3rd party\n  add-on (Owl) which supports that protocol.\n- Thunderbird now compatible with other WebExtension-based FileLink add-ons\n  like the Dropbox add-on\n- New WebExtensions FileLink API to facilitate add-ons\n- Fix decoding problems for messages with less common charsets (cp932, cp936)\n- New messages in the drafts folder (and other special or virtual folders)\n  will no longer be included in the new messages notification\n- Thunderbird 60 will migrate security databases (key3.db, cert8.db to key4.db,\n  cert9.db).\n- Address book search and auto-complete slowness\n- Plain text markup with * for bold, / for italics, _ for underline and | for\n  code did not work when the enclosed text contained non-ASCII characters\n- While composing a message, a link not removed when link location was removed\n  in the link properties panel\n- Encoding problems when exporting address books or messages using the system\n  charset. Messages are now always exported using the UTF-8 encoding\n- If the 'Date' header of a message was invalid, Jan 1970 or Dec 1969\n  was displayed. Now using date from 'Received' header instead.\n- Body search/filtering didn't reliably ignore content of tags\n- Inappropriate warning 'Thunderbird prevented the site\n  (addons.thunderbird.net) from asking you to install software on your\n  computer' when installing add-ons\n- Incorrect display of correspondents column since own email address was not\n  always detected\n- Spurious \u0026#xA; (encoded newline) inserted into drafts and sent email\n- Double-clicking on a word in the Write window sometimes launched the\n  Advanced Property Editor or Link Properties dialog\n- Fixed Cookie removal\n- 'Download rest of message' was not working if global inbox was used\n- Fix Encoding problems for users (especially in Poland) when a file was sent\n  via a folder using 'Sent to \u003e Mail recipient'\n  due to a problem in the Thunderbird MAPI interface\n- According to RFC 4616 and RFC 5721, passwords containing non-ASCII characters\n  are encoded using UTF-8 which can lead to problems with non-compliant\n  providers, for example office365.com. The SMTP LOGIN and POP3 USER/PASS\n  authentication methods are now using a Latin-1 encoding again\n  to work around this issue\n- Fix shutdown crash/hang after entering an empty IMAP password\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2019-03-23T11:03:55Z","modified":"2026-02-04T04:26:50.379594Z","updated_at":"2026-11-02T16:58:30.39372Z"},{"id":"openSUSE-SU-2019:1162-1","title":"Security update for MozillaThunderbird","description":"This update for MozillaThunderbird to version 60.5.1 fixes the following issues:\n\nSecurity issues fixed:\n\n- Update to MozillaThunderbird 60.6.1 (bsc#1130262):\n\n- CVE-2019-9813: Fixed Ionmonkey type confusion with __proto__ mutations\n- CVE-2019-9810: Fixed IonMonkey MArraySlice incorrect alias information\n\n- Update to MozillaThunderbird 60.6 (bsc#1129821):\n\n- CVE-2018-18506: Fixed an issue with Proxy Auto-Configuration file \n- CVE-2019-9801: Fixed an issue which could allow Windows programs to be exposed to web content\n- CVE-2019-9788: Fixed multiple memory safety bugs\n- CVE-2019-9790: Fixed a Use-after-free vulnerability when removing in-use DOM elements\n- CVE-2019-9791: Fixed an incorrect Type inference for constructors entered through on-stack replacement \n  with IonMonkey\n- CVE-2019-9792: Fixed an issue where IonMonkey leaks JS_OPTIMIZED_OUT magic value to script\n- CVE-2019-9793: Fixed multiple improper bounds checks when Spectre mitigations are disabled\n- CVE-2019-9794: Fixed an issue where command line arguments not discarded during execution\n- CVE-2019-9795: Fixed a Type-confusion vulnerability in IonMonkey JIT compiler\n- CVE-2019-9796: Fixed a Use-after-free vulnerability in SMIL animation controller\n\n- Update to MozillaThunderbird 60.5.1 (bsc#1125330):\n\n- CVE-2018-18356: Fixed a use-after-free vulnerability in the Skia library which can occur when\n    creating a path, leading to a potentially exploitable crash.\n- CVE-2019-5785: Fixed an integer overflow vulnerability in the Skia library which can occur\n  after specific transform operations, leading to a potentially exploitable crash.\n- CVE-2018-18335: Fixed a buffer overflow vulnerability in the Skia library which can occur with\n  Canvas 2D acceleration on macOS. This issue was addressed by disabling Canvas 2D acceleration \n  in Firefox ESR.  Note: this does not affect other versions and platforms where Canvas 2D\n  acceleration is already disabled by default.\n- CVE-2018-18509: Fixed a flaw which during verification of certain S/MIME signatures\n  showing mistakenly that emails bring a valid sugnature.\nRelease notes:\nhttps://www.mozilla.org/en-US/security/advisories/mfsa2019-12/\nhttps://www.mozilla.org/en-US/security/advisories/mfsa2019-11/\nhttps://www.mozilla.org/en-US/security/advisories/mfsa2019-06/\n","status":"published","published":"2019-04-05T10:09:15Z","modified":"2026-02-04T03:46:51.476386Z","updated_at":"2026-11-02T16:58:30.784344Z"},{"id":"openSUSE-SU-2024:10601-1","title":"MozillaThunderbird-91.1.1-1.1 on GA media","description":"These are all security issues fixed in the MozillaThunderbird-91.1.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2025-05-07T18:08:23.188336Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"SUSE-SU-2019:0469-1","title":"Security update for MozillaThunderbird","description":"This update for MozillaThunderbird to version 60.5.1 fixes the following issues:\n\nSecurity issues fixed (MFSA 2019-06 bsc#1125330):\n\n- CVE-2018-18335: Fixed a Buffer overflow in Skia by default deactivating Canvas 2D.\n  This issue does not affect Linuc distributions.\n- CVE-2018-18509: Fixed a flaw which during verification of certain S/MIME signatures\n  showing mistakenly that emails bring a valid sugnature.\n- CVE-2018-18356: Fixed a Use-after-free in Skia.\n- CVE-2019-5785: Fixed an Integer overflow in Skia.\n","status":"published","published":"2019-02-22T12:47:05Z","modified":"2026-02-04T03:48:42.898204Z","updated_at":"2026-11-02T15:53:45.926331Z"},{"id":"SUSE-SU-2019:0853-1","title":"Security update for MozillaThunderbird","description":"This update for MozillaThunderbird to version 60.5.1 fixes the following issues:\n\nSecurity issues fixed:\n\n- Update to MozillaThunderbird 60.6.1 (bsc#1130262):\n\n- CVE-2019-9813: Fixed Ionmonkey type confusion with __proto__ mutations\n- CVE-2019-9810: Fixed IonMonkey MArraySlice incorrect alias information\n\n- Update to MozillaThunderbird 60.6 (bsc#1129821):\n\n- CVE-2018-18506: Fixed an issue with Proxy Auto-Configuration file \n- CVE-2019-9801: Fixed an issue which could allow Windows programs to be exposed to web content\n- CVE-2019-9788: Fixed multiple memory safety bugs\n- CVE-2019-9790: Fixed a Use-after-free vulnerability when removing in-use DOM elements\n- CVE-2019-9791: Fixed an incorrect Type inference for constructors entered through on-stack replacement \n  with IonMonkey\n- CVE-2019-9792: Fixed an issue where IonMonkey leaks JS_OPTIMIZED_OUT magic value to script\n- CVE-2019-9793: Fixed multiple improper bounds checks when Spectre mitigations are disabled\n- CVE-2019-9794: Fixed an issue where command line arguments not discarded during execution\n- CVE-2019-9795: Fixed a Type-confusion vulnerability in IonMonkey JIT compiler\n- CVE-2019-9796: Fixed a Use-after-free vulnerability in SMIL animation controller\n\n- Update to MozillaThunderbird 60.5.1 (bsc#1125330):\n\n- CVE-2018-18356: Fixed a use-after-free vulnerability in the Skia library which can occur when\n    creating a path, leading to a potentially exploitable crash.\n- CVE-2019-5785: Fixed an integer overflow vulnerability in the Skia library which can occur\n  after specific transform operations, leading to a potentially exploitable crash.\n- CVE-2018-18335: Fixed a buffer overflow vulnerability in the Skia library which can occur with\n  Canvas 2D acceleration on macOS. This issue was addressed by disabling Canvas 2D acceleration \n  in Firefox ESR.  Note: this does not affect other versions and platforms where Canvas 2D\n  acceleration is already disabled by default.\n- CVE-2018-18509: Fixed a flaw which during verification of certain S/MIME signatures\n  showing mistakenly that emails bring a valid sugnature.\nRelease notes:\nhttps://www.mozilla.org/en-US/security/advisories/mfsa2019-12/\nhttps://www.mozilla.org/en-US/security/advisories/mfsa2019-11/\nhttps://www.mozilla.org/en-US/security/advisories/mfsa2019-06/\n","status":"published","published":"2019-04-03T09:05:58Z","modified":"2026-02-04T04:34:33.905049Z","updated_at":"2026-11-02T15:53:45.926331Z"},{"id":"USN-3897-1","title":"thunderbird vulnerabilities","description":"A use-after-free was discovered in libical. If a user were tricked in to\nopening a specially crafted ICS calendar file, an attacker could\npotentially exploit this to cause a denial of service. (CVE-2016-5824)\n\nMultiple security issues were discovered in Thunderbird. If a user were\ntricked in to opening a specially crafted message, an attacker could\npotentially exploit these to cause a denial of service, or execute\narbitrary code. (CVE-2018-18356, CVE-2018-18500, CVE-2019-5785)\n\nMultiple security issues were discovered in Thunderbird. If a user were\ntricked in to opening a specially crafted website in a browsing context,\nan attacker could potentially exploit these to cause a denial of service,\ngain additional privileges by escaping the sandbox, or execute arbitrary\ncode. (CVE-2018-18501, CVE-2018-18505)\n\nAn issue was discovered with S/MIME signature verification in some\ncircumstances. An attacker could potentially exploit this by spoofing\nsignatures for arbitrary content. (CVE-2018-18509)\n","status":"published","published":"2019-02-26T18:59:41Z","modified":"2026-04-27T15:33:02.315546844Z","updated_at":"2026-11-02T16:58:14.019824Z"}]}}