{"id":"CVE-2019-11755","aliases":["DEBIAN-CVE-2019-11755","DLA-1997-1","DSA-4571-1","EUVD-2019-3425","GHSA-42rq-cwg9-m583","MGASA-2019-0292","SUSE-SU-2019:2515-1","UBUNTU-CVE-2019-11755","USN-4202-1","USN-4335-1","openSUSE-SU-2019:2248-1","openSUSE-SU-2019:2249-1","openSUSE-SU-2024:10601-1"],"status":"published","title":"A crafted S/MIME message consisting of an inner encryption layer and an outer SignedData layer...","description":"A crafted S/MIME message consisting of an inner encryption layer and an outer SignedData layer was shown as having a valid digital signature, although the signer might have had no access to the contents of the encrypted message, and might have stripped a different signature from the encrypted message. Previous versions had only suppressed showing a digital signature for messages with an outer multipart/signed layer. This vulnerability affects Thunderbird \u003c 68.1.1.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.01288,"percentile":0.70395,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-347"],"published":"2019-09-27T17:10:44Z","modified":"2026-09-21T07:01:28Z","fixes":[{"ecosystem":"Debian:12","package":"thunderbird","fixed_in":["1:68.2.1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"thunderbird","fixed_in":["1:68.2.1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"thunderbird","fixed_in":["1:68.2.1-1"],"sources":["osv"]},{"ecosystem":"Mageia:7","package":"thunderbird","fixed_in":["68.1.1-1.mga7"],"sources":["osv"]},{"ecosystem":"Mageia:7","package":"thunderbird-l10n","fixed_in":["68.1.1-1.mga7"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"thunderbird","fixed_in":["1:68.7.0+build1-0ubuntu0.16.04.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"thunderbird","fixed_in":["1:68.2.1+build1-0ubuntu0.18.04.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:68.2.1-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:68.2.1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:68.2.1-1"}]}]},{"source":"osv","ecosystem":"Debian:8","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:68.2.2-1~deb8u1"}]}],"versions":["1.5-4","1.5.0.2-1","1.5.0.2-2","1.5.0.2-3","1.5.0.4-1","1.5.0.4-2","1.5.0.4-3","1.5.0.5-1","1.5.0.7-1","1.5.0.7-2","1:52.4.0-1","1:52.4.0-1~deb7u1","1:52.4.0-1~deb8u1","1:52.4.0-1~deb9u1","1:52.4.0-2~exp1","1:52.5.0-1","1:52.5.0-1~deb7u1","1:52.5.0-1~deb8u1","1:52.5.0-1~deb9u1","1:52.5.2-1","1:52.5.2-1~deb7u1","1:52.5.2-2","1:52.5.2-2~deb8u1","1:52.5.2-2~deb9u1","1:52.6.0-1","1:52.6.0-1+alpha.1","1:52.6.0-1+alpha.2","1:52.6.0-1~deb7u1","1:52.6.0-1~deb8u1","1:52.6.0-1~deb9u1","1:52.7.0-1","1:52.7.0-1~deb7u1","1:52.7.0-1~deb8u1","1:52.7.0-1~deb9u1","1:52.8.0-1","1:52.8.0-1~deb7u1","1:52.8.0-1~deb8u1","1:52.8.0-1~deb9u1","1:52.9.0-1","1:52.9.1-1","1:52.9.1-1~deb8u1","1:52.9.1-1~deb9u1","1:58.0~b3-1","1:60.0-1","1:60.0-2","1:60.0-2~deb9u1","1:60.0-3","1:60.0-3~deb9u1","1:60.0~b10-1","1:60.0~b2-1","1:60.0~b3-1","1:60.0~b4-1","1:60.0~b5-1","1:60.0~b6-1","1:60.0~b9-1","1:60.0~b9-2","1:60.2.1-1","1:60.2.1-2~deb9u1","1:60.3.0-1","1:60.3.0-1~deb8u1","1:60.3.0-1~deb9u1","1:60.3.1-1","1:60.4.0-1","1:60.4.0-1~deb8u1","1:60.4.0-1~deb9u1","1:60.5.0-1","1:60.5.0-2","1:60.5.0-3","1:60.5.1-1","1:60.5.1-1~deb8u1","1:60.5.1-1~deb9u1","1:60.6.1-1","1:60.6.1-1~deb8u1","1:60.6.1-1~deb9u1","1:60.7.0-1","1:60.7.0-1~deb8u1","1:60.7.0-1~deb9u1","1:60.7.1-1","1:60.7.1-1~deb8u1","1:60.7.1-1~deb9u1","1:60.7.2-1","1:60.7.2-1~deb8u1","1:60.7.2-1~deb9u1","1:60.8.0-1","1:60.8.0-1~deb10u1","1:60.8.0-1~deb8u1","1:60.8.0-1~deb9u1","1:60.8.0-2","1:60.9.0-1","1:60.9.0-1~deb10u1","1:60.9.0-1~deb8u1","1:60.9.0-1~deb9u1","1:65.0~b1-1","1:66.0~b1-1","1:67.0~b3-1","1:68.0~b1-1","1:68.1.1-1~exp1","1:68.1.2-1~exp1","1:68.2.1-1"],"bundled":9},{"source":"osv","ecosystem":"Debian:9","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:68.2.2-1~deb9u1"}]}],"versions":["1.5-4","1.5.0.2-1","1.5.0.2-2","1.5.0.2-3","1.5.0.4-1","1.5.0.4-2","1.5.0.4-3","1.5.0.5-1","1.5.0.7-1","1.5.0.7-2","1:52.4.0-1","1:52.4.0-1~deb7u1","1:52.4.0-1~deb8u1","1:52.4.0-1~deb9u1","1:52.4.0-2~exp1","1:52.5.0-1","1:52.5.0-1~deb7u1","1:52.5.0-1~deb8u1","1:52.5.0-1~deb9u1","1:52.5.2-1","1:52.5.2-1~deb7u1","1:52.5.2-2","1:52.5.2-2~deb8u1","1:52.5.2-2~deb9u1","1:52.6.0-1","1:52.6.0-1+alpha.1","1:52.6.0-1+alpha.2","1:52.6.0-1~deb7u1","1:52.6.0-1~deb8u1","1:52.6.0-1~deb9u1","1:52.7.0-1","1:52.7.0-1~deb7u1","1:52.7.0-1~deb8u1","1:52.7.0-1~deb9u1","1:52.8.0-1","1:52.8.0-1~deb7u1","1:52.8.0-1~deb8u1","1:52.8.0-1~deb9u1","1:52.9.0-1","1:52.9.1-1","1:52.9.1-1~deb8u1","1:52.9.1-1~deb9u1","1:58.0~b3-1","1:60.0-1","1:60.0-2","1:60.0-2~deb9u1","1:60.0-3","1:60.0-3~deb9u1","1:60.0~b10-1","1:60.0~b2-1","1:60.0~b3-1","1:60.0~b4-1","1:60.0~b5-1","1:60.0~b6-1","1:60.0~b9-1","1:60.0~b9-2","1:60.2.1-1","1:60.2.1-2~deb9u1","1:60.3.0-1","1:60.3.0-1~deb8u1","1:60.3.0-1~deb9u1","1:60.3.1-1","1:60.4.0-1","1:60.4.0-1~deb8u1","1:60.4.0-1~deb9u1","1:60.5.0-1","1:60.5.0-2","1:60.5.0-3","1:60.5.1-1","1:60.5.1-1~deb8u1","1:60.5.1-1~deb9u1","1:60.6.1-1","1:60.6.1-1~deb8u1","1:60.6.1-1~deb9u1","1:60.7.0-1","1:60.7.0-1~deb8u1","1:60.7.0-1~deb9u1","1:60.7.1-1","1:60.7.1-1~deb8u1","1:60.7.1-1~deb9u1","1:60.7.2-1","1:60.7.2-1~deb8u1","1:60.7.2-1~deb9u1","1:60.8.0-1","1:60.8.0-1~deb10u1","1:60.8.0-1~deb8u1","1:60.8.0-1~deb9u1","1:60.8.0-2","1:60.9.0-1","1:60.9.0-1~deb10u1","1:60.9.0-1~deb8u1","1:60.9.0-1~deb9u1","1:65.0~b1-1","1:66.0~b1-1","1:67.0~b3-1","1:68.0~b1-1","1:68.1.1-1~exp1","1:68.1.2-1~exp1","1:68.2.1-1","1:68.2.2-1~deb8u1"],"bundled":9},{"source":"osv","ecosystem":"Debian:10","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:68.2.2-1~deb10u1"}]}],"versions":["1:60.7.2-1","1:60.8.0-1","1:60.8.0-1~deb10u1","1:60.8.0-1~deb8u1","1:60.8.0-1~deb9u1","1:60.8.0-2","1:60.9.0-1","1:60.9.0-1~deb10u1","1:60.9.0-1~deb8u1","1:60.9.0-1~deb9u1","1:65.0~b1-1","1:66.0~b1-1","1:67.0~b3-1","1:68.0~b1-1","1:68.1.1-1~exp1","1:68.1.2-1~exp1","1:68.2.1-1","1:68.2.2-1~deb8u1","1:68.2.2-1~deb9u1"],"bundled":9},{"source":"osv","ecosystem":"Mageia:7","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"68.1.1-1.mga7"}]}]},{"source":"osv","ecosystem":"Mageia:7","package":"thunderbird-l10n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"68.1.1-1.mga7"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15","package":"MozillaThunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"68.1.1-3.51.1"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP1","package":"MozillaThunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"68.1.1-3.51.1"}]}],"bundled":27},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:68.7.0+build1-0ubuntu0.16.04.2"}]}],"versions":["1:38.3.0+build1-0ubuntu2","1:38.5.1+build2-0ubuntu1","1:38.6.0+build1-0ubuntu1","1:38.7.2+build1-0ubuntu0.16.04.1","1:38.8.0+build1-0ubuntu0.16.04.1","1:45.2.0+build1-0ubuntu0.16.04.1","1:45.3.0+build1-0ubuntu0.16.04.2","1:45.4.0+build1-0ubuntu0.16.04.1","1:45.5.1+build1-0ubuntu0.16.04.1","1:45.7.0+build1-0ubuntu0.16.04.1","1:45.8.0+build1-0ubuntu0.16.04.1","1:52.1.1+build1-0ubuntu0.16.04.1","1:52.2.1+build1-0ubuntu0.16.04.1","1:52.3.0+build1-0ubuntu0.16.04.1","1:52.4.0+build1-0ubuntu0.16.04.2","1:52.5.0+build1-0ubuntu0.16.04.1","1:52.6.0+build1-0ubuntu0.16.04.1","1:52.7.0+build1-0ubuntu0.16.04.1","1:52.8.0+build1-0ubuntu0.16.04.1","1:52.9.1+build3-0ubuntu0.16.04.1","1:60.2.1+build1-0ubuntu0.16.04.4","1:60.4.0+build2-0ubuntu0.16.04.1","1:60.5.1+build2-0ubuntu0.16.04.1","1:60.6.1+build2-0ubuntu0.16.04.1","1:60.7.0+build1-0ubuntu0.16.04.1","1:60.7.1+build1-0ubuntu0.16.04.1","1:60.7.2+build2-0ubuntu0.16.04.1","1:60.8.0+build1-0ubuntu0.16.04.2","1:60.9.0+build1-0ubuntu0.16.04.2","1:60.9.1+build1-0ubuntu0.16.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:68.2.1+build1-0ubuntu0.18.04.1"}]}],"versions":["1:52.4.0+build1-0ubuntu2","1:52.6.0+build1-0ubuntu1","1:52.7.0+build1-0ubuntu1","1:52.8.0+build1-0ubuntu0.18.04.1","1:52.9.1+build3-0ubuntu0.18.04.1","1:60.2.1+build1-0ubuntu0.18.04.2","1:60.4.0+build2-0ubuntu0.18.04.1","1:60.5.1+build2-0ubuntu0.18.04.1","1:60.6.1+build2-0ubuntu0.18.04.1","1:60.7.0+build1-0ubuntu0.18.04.1","1:60.7.1+build1-0ubuntu0.18.04.1","1:60.7.2+build2-0ubuntu0.18.04.1","1:60.8.0+build1-0ubuntu0.18.04.1","1:60.9.0+build1-0ubuntu0.18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:68.2.1+build1-0ubuntu0.18.04.1"}]}],"versions":["1:52.4.0+build1-0ubuntu2","1:52.6.0+build1-0ubuntu1","1:52.7.0+build1-0ubuntu1","1:52.8.0+build1-0ubuntu0.18.04.1","1:52.9.1+build3-0ubuntu0.18.04.1","1:60.2.1+build1-0ubuntu0.18.04.2","1:60.4.0+build2-0ubuntu0.18.04.1","1:60.5.1+build2-0ubuntu0.18.04.1","1:60.6.1+build2-0ubuntu0.18.04.1","1:60.7.0+build1-0ubuntu0.18.04.1","1:60.7.1+build1-0ubuntu0.18.04.1","1:60.7.2+build2-0ubuntu0.18.04.1","1:60.8.0+build1-0ubuntu0.18.04.1","1:60.9.0+build1-0ubuntu0.18.04.1"],"bundled":9},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:68.7.0+build1-0ubuntu0.16.04.2"}]}],"versions":["1:38.3.0+build1-0ubuntu2","1:38.5.1+build2-0ubuntu1","1:38.6.0+build1-0ubuntu1","1:38.7.2+build1-0ubuntu0.16.04.1","1:38.8.0+build1-0ubuntu0.16.04.1","1:45.2.0+build1-0ubuntu0.16.04.1","1:45.3.0+build1-0ubuntu0.16.04.2","1:45.4.0+build1-0ubuntu0.16.04.1","1:45.5.1+build1-0ubuntu0.16.04.1","1:45.7.0+build1-0ubuntu0.16.04.1","1:45.8.0+build1-0ubuntu0.16.04.1","1:52.1.1+build1-0ubuntu0.16.04.1","1:52.2.1+build1-0ubuntu0.16.04.1","1:52.3.0+build1-0ubuntu0.16.04.1","1:52.4.0+build1-0ubuntu0.16.04.2","1:52.5.0+build1-0ubuntu0.16.04.1","1:52.6.0+build1-0ubuntu0.16.04.1","1:52.7.0+build1-0ubuntu0.16.04.1","1:52.8.0+build1-0ubuntu0.16.04.1","1:52.9.1+build3-0ubuntu0.16.04.1","1:60.2.1+build1-0ubuntu0.16.04.4","1:60.4.0+build2-0ubuntu0.16.04.1","1:60.5.1+build2-0ubuntu0.16.04.1","1:60.6.1+build2-0ubuntu0.16.04.1","1:60.7.0+build1-0ubuntu0.16.04.1","1:60.7.1+build1-0ubuntu0.16.04.1","1:60.7.2+build2-0ubuntu0.16.04.1","1:60.8.0+build1-0ubuntu0.16.04.2","1:60.9.0+build1-0ubuntu0.16.04.2","1:60.9.1+build1-0ubuntu0.16.04.1"],"bundled":38},{"source":"osv","ecosystem":"openSUSE:Leap 15.0","package":"MozillaThunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"68.1.1-lp150.3.51.1"}]}],"bundled":27},{"source":"osv","ecosystem":"openSUSE:Leap 15.0","package":"enigmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.2-lp150.34.1"}]}],"bundled":27},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"MozillaThunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"68.1.1-lp151.2.13.1"}]}],"bundled":27},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"enigmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.2-lp151.2.6.1"}]}],"bundled":27},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"MozillaThunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"91.1.1-1.1"}]}],"bundled":394}],"products":[{"vendor":"mozilla","product":"thunderbird"}],"references":[{"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=1240290","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Permissions Required","Vendor Advisory","report"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2019-32/","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","report"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00010.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00009.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"https://seclists.org/bugtraq/2019/Nov/24","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred","web"]},{"url":"https://www.debian.org/security/2019/dsa-4571","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2019/11/msg00017.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://usn.ubuntu.com/4202-1/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","web"]},{"url":"https://usn.ubuntu.com/4335-1/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-11755"},{"url":"https://usn.ubuntu.com/4202-1"},{"url":"https://usn.ubuntu.com/4335-1"},{"url":"https://www.mozilla.org/security/advisories/mfsa2019-32"},{"url":"https://github.com/advisories/GHSA-42rq-cwg9-m583"},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-11755","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2019-0292.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=25474","tags":["report"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2019-32/","tags":["advisory"]},{"url":"https://www.thunderbird.net/en-US/thunderbird/68.1.1/releasenotes/","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20192515-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1140868","tags":["report"]},{"url":"https://bugzilla.suse.com/1141322","tags":["report"]},{"url":"https://bugzilla.suse.com/1149296","tags":["report"]},{"url":"https://bugzilla.suse.com/1149297","tags":["report"]},{"url":"https://bugzilla.suse.com/1149298","tags":["report"]},{"url":"https://bugzilla.suse.com/1149299","tags":["report"]},{"url":"https://bugzilla.suse.com/1149303","tags":["report"]},{"url":"https://bugzilla.suse.com/1149304","tags":["report"]},{"url":"https://bugzilla.suse.com/1150939","tags":["report"]},{"url":"https://bugzilla.suse.com/1152375","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11709","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11710","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11711","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11712","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11713","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11714","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11715","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11716","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11717","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11719","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11720","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11721","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11723","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11724","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11725","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11727","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11728","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11729","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11730","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11739","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11740","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11742","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11743","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11744","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11746","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11752","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11755","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2019-11755","tags":["report"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2019-32/#CVE-2019-11755","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4202-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-4335-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-11755","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-11757","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-11758","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-11759","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-11760","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-11761","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-11762","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-11763","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-11764","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-15903","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-11745","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-17005","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-17008","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-17010","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-17011","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-17012","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-17016","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-17017","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-17022","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-17024","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-17026","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-20503","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-6792","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-6793","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-6794","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-6795","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-6798","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-6800","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-6805","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-6806","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-6807","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-6811","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-6812","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-6814","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-6819","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-6820","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-6821","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-6822","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-6825","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/QT7HMZ3VUEMJ463IILXJ7LOGN6RQAID5/#QT7HMZ3VUEMJ463IILXJ7LOGN6RQAID5","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/MZU237GIBE77LH7VPAJS5W64IMRQ7NSM/#MZU237GIBE77LH7VPAJS5W64IMRQ7NSM","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2007-3089","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2007-3285","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2007-3656","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2007-3670","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2007-3734","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2007-3735","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2007-3736","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2007-3737","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2007-3738","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2008-0016","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2008-1233","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2008-1236","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2008-3835","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2008-4058","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2008-4061","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2008-4064","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2008-4065","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2008-4067","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2008-4070","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2008-5012","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2008-5014","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2008-5016","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2008-5021","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2008-5022","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2008-5024","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2008-5500","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2008-5503","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2008-5506","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2008-5507","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2008-5508","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2008-5510","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2008-5511","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5824","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9893","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9895","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9897","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9898","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9899","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9900","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9904","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9905","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-16541","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5373","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5375","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5376","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5378","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5380","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5383","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5390","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5396","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5398","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5399","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5400","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5401","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5402","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5403","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5404","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5405","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5406","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5407","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5408","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5410","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5412","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5413","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5414","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5416","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5418","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5419","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5421","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5422","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5426","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5429","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5430","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5432","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5433","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5434","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5435","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5436","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5437","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5438","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5439","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5440","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5441","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5442","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5443","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5444","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5445","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5446","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5447","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5449","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5451","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5454","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5459","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5460","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5461","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5462","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5464","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5465","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5466","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5467","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5469","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5470","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5472","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7749","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7750","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7751","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7752","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7753","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7754","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7756","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7757","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7758","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7763","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7764","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7765","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7773","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7777","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7778","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7779","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7782","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7784","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7785","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7786","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7787","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7791","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7792","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7793","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7798","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7800","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7801","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7802","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7803","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7804","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7805","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7807","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7810","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7814","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7818","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7819","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7823","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7824","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7825","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7826","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7828","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7829","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7830","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7845","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7846","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7847","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7848","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12359","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12360","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12361","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12362","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12363","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12364","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12365","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12366","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12367","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12371","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12372","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12373","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12374","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12376","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12377","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12378","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12383","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12385","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12389","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12390","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12391","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12392","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12393","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12405","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-17466","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-18335","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-18356","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-18492","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-18493","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-18494","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-18498","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-18500","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-18501","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-18505","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-18509","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-18511","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-5089","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-5095","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-5096","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-5097","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-5098","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-5099","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-5102","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-5103","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-5104","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-5117","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-5125","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-5127","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-5129","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-5144","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-5145","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-5146","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-5150","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-5154","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-5155","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-5156","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-5159","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-5161","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-5162","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-5168","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-5170","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-5174","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-5178","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-5183","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-5184","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-5185","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-5187","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-5188","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11691","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11692","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11693","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11694","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11698","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11703","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11704","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11705","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11706","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11707","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11708","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11757","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11758","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11759","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11760","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11761","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11762","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11763","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11764","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-13722","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-15903","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-17005","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-17008","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-17010","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-17011","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-17012","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-17015","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-17016","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-17017","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-17021","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-17022","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-17024","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-17026","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-20503","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-5785","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-5798","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-7317","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9797","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9800","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9810","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9811","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9813","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9815","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9816","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9817","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9818","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9819","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9820","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-12387","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-12392","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-12393","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-12395","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-12397","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-12398","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-12405","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-12406","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-12410","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-12417","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-12418","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-12419","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-12420","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-12421","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-15652","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-15659","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-15663","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-15664","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-15669","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-15673","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-15676","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-15677","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-15678","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-15683","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-15685","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-15969","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-15999","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-16012","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-16042","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-16044","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-26950","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-26951","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-26953","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-26956","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-26958","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-26959","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-26960","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-26961","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-26965","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-26966","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-26968","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-26970","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-26971","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-26973","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-26974","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-26976","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-26978","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-35111","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-35112","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-35113","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-6463","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-6514","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-6792","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-6793","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-6794","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-6795","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-6797","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-6798","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-6800","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-6805","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-6806","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-6807","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-6811","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-6812","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-6814","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-6819","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-6820","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-6821","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-6822","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-6825","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-6831","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-23953","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-23954","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-23960","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-23961","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-23964","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-23968","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-23969","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-23973","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-23978","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-23981","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-23982","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-23984","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-23987","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-23991","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-23993","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-23994","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-23995","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-23998","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-23999","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-24002","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-29945","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-29946","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-29948","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-29956","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-29957","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-29964","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-29967","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-29969","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-29970","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-29976","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-29980","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-29984","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-29985","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-29986","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-29988","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-29989","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-29991","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-30547","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-38492","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-38495","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2019-11755","description":"A crafted S/MIME message consisting of an inner encryption layer and an outer SignedData layer was shown as having a valid digital signature, although the signer might have had no access to the contents of the encrypted message, and might have stripped a different signature from the encrypted message. Previous versions had only suppressed showing a digital signature for messages with an outer multipart/signed layer. This vulnerability affects Thunderbird \u003c 68.1.1.","status":"published","published":"2019-09-27T17:10:44Z","modified":"2024-08-04T23:03:32.735Z","updated_at":"2026-11-02T14:20:26.034547Z"}],"euvd":[{"id":"EUVD-2019-3425","description":"A crafted S/MIME message consisting of an inner encryption layer and an outer SignedData layer was shown as having a valid digital signature, although the signer might have had no access to the contents of the encrypted message, and might have stripped a different signature from the encrypted message. Previous versions had only suppressed showing a digital signature for messages with an outer multipart/signed layer. This vulnerability affects Thunderbird \u003c 68.1.1.","status":"published","published":"2019-09-27T17:10:44Z","modified":"2024-08-04T23:03:32Z","updated_at":"2026-11-03T02:40:47.960625Z"}],"ghsa":[{"id":"GHSA-42rq-cwg9-m583","title":"A crafted S/MIME message consisting of an inner encryption layer and an outer SignedData layer...","description":"A crafted S/MIME message consisting of an inner encryption layer and an outer SignedData layer was shown as having a valid digital signature, although the signer might have had no access to the contents of the encrypted message, and might have stripped a different signature from the encrypted message. Previous versions had only suppressed showing a digital signature for messages with an outer multipart/signed layer. This vulnerability affects Thunderbird \u003c 68.1.1.","status":"published","published":"2022-05-24T16:57:05Z","modified":"2024-04-04T02:01:53Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"cwes":["CWE-347"],"updated_at":"2026-11-02T14:56:05.532666Z"}],"nvd":[{"id":"CVE-2019-11755","description":"A crafted S/MIME message consisting of an inner encryption layer and an outer SignedData layer was shown as having a valid digital signature, although the signer might have had no access to the contents of the encrypted message, and might have stripped a different signature from the encrypted message. Previous versions had only suppressed showing a digital signature for messages with an outer multipart/signed layer. This vulnerability affects Thunderbird \u003c 68.1.1.","status":"published","published":"2019-09-27T18:15:14.1Z","modified":"2026-06-17T02:13:34.553Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-347"],"updated_at":"2026-11-02T14:05:30.039477Z"}],"osv":[{"id":"CVE-2019-11755","description":"A crafted S/MIME message consisting of an inner encryption layer and an outer SignedData layer was shown as having a valid digital signature, although the signer might have had no access to the contents of the encrypted message, and might have stripped a different signature from the encrypted message. Previous versions had only suppressed showing a digital signature for messages with an outer multipart/signed layer. This vulnerability affects Thunderbird \u003c 68.1.1.","status":"published","published":"2019-09-27T18:15:14.1Z","modified":"2026-04-16T04:33:17.812147258Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:44:10.718934Z"},{"id":"DEBIAN-CVE-2019-11755","description":"A crafted S/MIME message consisting of an inner encryption layer and an outer SignedData layer was shown as having a valid digital signature, although the signer might have had no access to the contents of the encrypted message, and might have stripped a different signature from the encrypted message. Previous versions had only suppressed showing a digital signature for messages with an outer multipart/signed layer. This vulnerability affects Thunderbird \u003c 68.1.1.","status":"published","published":"2019-09-27T18:15:14.1Z","modified":"2026-09-21T07:01:28.327727218Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:31.467893Z"},{"id":"UBUNTU-CVE-2019-11755","description":"A crafted S/MIME message consisting of an inner encryption layer and an outer SignedData layer was shown as having a valid digital signature, although the signer might have had no access to the contents of the encrypted message, and might have stripped a different signature from the encrypted message. Previous versions had only suppressed showing a digital signature for messages with an outer multipart/signed layer. This vulnerability affects Thunderbird \u003c 68.1.1.","status":"published","published":"2019-09-27T18:15:00Z","modified":"2026-04-22T12:07:58.430536Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:54:19.202697Z"},{"id":"DLA-1997-1","title":"thunderbird - security update","status":"published","published":"2019-11-18T00:00:00Z","modified":"2026-03-09T01:18:05.806656Z","updated_at":"2026-11-02T15:46:10.227108Z"},{"id":"DSA-4571-1","title":"thunderbird - security update","status":"published","published":"2019-11-17T00:00:00Z","modified":"2026-03-09T02:09:19.428796Z","updated_at":"2026-11-02T15:46:17.19998Z"},{"id":"MGASA-2019-0292","title":"Updated thunderbird packages fix security vulnerability","description":"Updated thunderbird packages fix security vulnerability:\n\nSpoofing a message author via a crafted S/MIME message (CVE-2019-11755)\n\nIt also fixes various other bugs, as listed in the releasenotes.\n","status":"published","published":"2019-10-03T20:23:00Z","modified":"2026-04-16T04:42:11.923716444Z","updated_at":"2026-11-02T15:49:41.151324Z"},{"id":"openSUSE-SU-2019:2248-1","title":"Security update for MozillaThunderbird","description":"This update for MozillaThunderbird to version 68.1.1 fixes the following issues:\n  \n- CVE-2019-11709: Fixed several memory safety bugs. (bsc#1140868)\n- CVE-2019-11710: Fixed several memory safety bugs. (bsc#1140868)\n- CVE-2019-11711: Fixed a script injection within domain through inner window reuse. (bsc#1140868)\n- CVE-2019-11712: Fixed an insufficient validation of cross-origin POST requests within NPAPI plugins. (bsc#1140868)\n- CVE-2019-11713: Fixed a use-after-free with HTTP/2 cached stream. (bsc#1140868)\n- CVE-2019-11714: Fixed a crash in NeckoChild. (bsc#1140868)\n- CVE-2019-11715: Fixed an HTML parsing error that can contribute to content XSS. (bsc#1140868)\n- CVE-2019-11716: Fixed an enumeration issue in globalThis. (bsc#1140868)\n- CVE-2019-11717: Fixed an improper escaping of the caret character in origins. (bsc#1140868)\n- CVE-2019-11719: Fixed an out-of-bounds read when importing curve25519 private key. (bsc#1140868)\n- CVE-2019-11720: Fixed a character encoding XSS vulnerability. (bsc#1140868)\n- CVE-2019-11721: Fixed domain spoofing through unicode latin 'kra' character. (bsc#1140868)\n- CVE-2019-11723: Fixed a cookie leakage during add-on fetching across private browsing boundaries. (bsc#1140868)\n- CVE-2019-11724: Fixed a permissions issue with the retired site input.mozilla.org. (bsc#1140868)\n- CVE-2019-11725: Fixed a SafeBrowsing bypass through WebSockets. (bsc#1140868)\n- CVE-2019-11727: Fixed an insufficient validation for PKCS#1 v1.5 signatures being used with TLS 1.3. (bsc#1140868)\n- CVE-2019-11728: Fixed port scanning through Alt-Svc header. (bsc#1140868)\n- CVE-2019-11729: Fixed a segmentation fault due to empty or malformed p256-ECDH public keys. (bsc#1140868)\n- CVE-2019-11730: Fixed an insufficient enforcement of the same-origin policy that treats all files in a directory as having the same-origin. (bsc#1140868)\n- CVE-2019-11739: Fixed a Covert Content Attack on S/MIME encryption using a crafted multipart/alternative message. (bsc#1150939)\n- CVE-2019-11740: Fixed several memory safety bugs. (bsc#1149299)\n- CVE-2019-11742: Fixed a same-origin policy violation with SVG filters and canvas that enabled theft of cross-origin images. (bsc#1149303)\n- CVE-2019-11743: Fixed a cross-origin access issue. (bsc#1149298)\n- CVE-2019-11744: Fixed a XSS involving breaking out of title and textarea elements using innerHTML. (bsc#1149304)\n- CVE-2019-11746: Fixed a use-after-free while manipulating video. (bsc#1149297)\n- CVE-2019-11752: Fixed a use-after-free while extracting a key value in IndexedDB. (bsc#1149296)\n- CVE-2019-11755: Fixed an insufficient validation of S/MIME messages that allowed the author to be spoofed. (bsc#1152375)\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2019-10-04T10:23:43Z","modified":"2026-02-04T04:20:14.802317Z","updated_at":"2026-11-02T16:58:30.784344Z"},{"id":"openSUSE-SU-2019:2249-1","title":"Security update for MozillaThunderbird","description":"This update for MozillaThunderbird to version 68.1.1 fixes the following issues:\n  \n- CVE-2019-11709: Fixed several memory safety bugs. (bsc#1140868)\n- CVE-2019-11710: Fixed several memory safety bugs. (bsc#1140868)\n- CVE-2019-11711: Fixed a script injection within domain through inner window reuse. (bsc#1140868)\n- CVE-2019-11712: Fixed an insufficient validation of cross-origin POST requests within NPAPI plugins. (bsc#1140868)\n- CVE-2019-11713: Fixed a use-after-free with HTTP/2 cached stream. (bsc#1140868)\n- CVE-2019-11714: Fixed a crash in NeckoChild. (bsc#1140868)\n- CVE-2019-11715: Fixed an HTML parsing error that can contribute to content XSS. (bsc#1140868)\n- CVE-2019-11716: Fixed an enumeration issue in globalThis. (bsc#1140868)\n- CVE-2019-11717: Fixed an improper escaping of the caret character in origins. (bsc#1140868)\n- CVE-2019-11719: Fixed an out-of-bounds read when importing curve25519 private key. (bsc#1140868)\n- CVE-2019-11720: Fixed a character encoding XSS vulnerability. (bsc#1140868)\n- CVE-2019-11721: Fixed domain spoofing through unicode latin 'kra' character. (bsc#1140868)\n- CVE-2019-11723: Fixed a cookie leakage during add-on fetching across private browsing boundaries. (bsc#1140868)\n- CVE-2019-11724: Fixed a permissions issue with the retired site input.mozilla.org. (bsc#1140868)\n- CVE-2019-11725: Fixed a SafeBrowsing bypass through WebSockets. (bsc#1140868)\n- CVE-2019-11727: Fixed an insufficient validation for PKCS#1 v1.5 signatures being used with TLS 1.3. (bsc#1140868)\n- CVE-2019-11728: Fixed port scanning through Alt-Svc header. (bsc#1140868)\n- CVE-2019-11729: Fixed a segmentation fault due to empty or malformed p256-ECDH public keys. (bsc#1140868)\n- CVE-2019-11730: Fixed an insufficient enforcement of the same-origin policy that treats all files in a directory as having the same-origin. (bsc#1140868)\n- CVE-2019-11739: Fixed a Covert Content Attack on S/MIME encryption using a crafted multipart/alternative message. (bsc#1150939)\n- CVE-2019-11740: Fixed several memory safety bugs. (bsc#1149299)\n- CVE-2019-11742: Fixed a same-origin policy violation with SVG filters and canvas that enabled theft of cross-origin images. (bsc#1149303)\n- CVE-2019-11743: Fixed a cross-origin access issue. (bsc#1149298)\n- CVE-2019-11744: Fixed a XSS involving breaking out of title and textarea elements using innerHTML. (bsc#1149304)\n- CVE-2019-11746: Fixed a use-after-free while manipulating video. (bsc#1149297)\n- CVE-2019-11752: Fixed a use-after-free while extracting a key value in IndexedDB. (bsc#1149296)\n- CVE-2019-11755: Fixed an insufficient validation of S/MIME messages that allowed the author to be spoofed. (bsc#1152375)\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2019-10-04T10:24:16Z","modified":"2026-02-04T04:40:12.011418Z","updated_at":"2026-11-02T16:58:30.784344Z"},{"id":"openSUSE-SU-2024:10601-1","title":"MozillaThunderbird-91.1.1-1.1 on GA media","description":"These are all security issues fixed in the MozillaThunderbird-91.1.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2025-05-07T18:08:23.188336Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"SUSE-SU-2019:2515-1","title":"Security update for MozillaThunderbird","description":"This update for MozillaThunderbird to version 68.1.1 fixes the following issues:\n  \n- CVE-2019-11709: Fixed several memory safety bugs. (bsc#1140868)\n- CVE-2019-11710: Fixed several memory safety bugs. (bsc#1140868)\n- CVE-2019-11711: Fixed a script injection within domain through inner window reuse. (bsc#1140868)\n- CVE-2019-11712: Fixed an insufficient validation of cross-origin POST requests within NPAPI plugins. (bsc#1140868)\n- CVE-2019-11713: Fixed a use-after-free with HTTP/2 cached stream. (bsc#1140868)\n- CVE-2019-11714: Fixed a crash in NeckoChild. (bsc#1140868)\n- CVE-2019-11715: Fixed an HTML parsing error that can contribute to content XSS. (bsc#1140868)\n- CVE-2019-11716: Fixed an enumeration issue in globalThis. (bsc#1140868)\n- CVE-2019-11717: Fixed an improper escaping of the caret character in origins. (bsc#1140868)\n- CVE-2019-11719: Fixed an out-of-bounds read when importing curve25519 private key. (bsc#1140868)\n- CVE-2019-11720: Fixed a character encoding XSS vulnerability. (bsc#1140868)\n- CVE-2019-11721: Fixed domain spoofing through unicode latin 'kra' character. (bsc#1140868)\n- CVE-2019-11723: Fixed a cookie leakage during add-on fetching across private browsing boundaries. (bsc#1140868)\n- CVE-2019-11724: Fixed a permissions issue with the retired site input.mozilla.org. (bsc#1140868)\n- CVE-2019-11725: Fixed a SafeBrowsing bypass through WebSockets. (bsc#1140868)\n- CVE-2019-11727: Fixed an insufficient validation for PKCS#1 v1.5 signatures being used with TLS 1.3. (bsc#1140868)\n- CVE-2019-11728: Fixed port scanning through Alt-Svc header. (bsc#1140868)\n- CVE-2019-11729: Fixed a segmentation fault due to empty or malformed p256-ECDH public keys. (bsc#1140868)\n- CVE-2019-11730: Fixed an insufficient enforcement of the same-origin policy that treats all files in a directory as having the same-origin. (bsc#1140868)\n- CVE-2019-11739: Fixed a Covert Content Attack on S/MIME encryption using a crafted multipart/alternative message. (bsc#1150939)\n- CVE-2019-11740: Fixed several memory safety bugs. (bsc#1149299)\n- CVE-2019-11742: Fixed a same-origin policy violation with SVG filters and canvas that enabled theft of cross-origin images. (bsc#1149303)\n- CVE-2019-11743: Fixed a cross-origin access issue. (bsc#1149298)\n- CVE-2019-11744: Fixed a XSS involving breaking out of title and textarea elements using innerHTML. (bsc#1149304)\n- CVE-2019-11746: Fixed a use-after-free while manipulating video. (bsc#1149297)\n- CVE-2019-11752: Fixed a use-after-free while extracting a key value in IndexedDB. (bsc#1149296)\n- CVE-2019-11755: Fixed an insufficient validation of S/MIME messages that allowed the author to be spoofed. (bsc#1152375)\n","status":"published","published":"2019-10-02T08:48:54Z","modified":"2026-02-04T02:16:06.273767Z","updated_at":"2026-11-02T15:53:47.06185Z"},{"id":"USN-4202-1","title":"thunderbird vulnerabilities","description":"It was discovered that a specially crafted S/MIME message with an inner\nencryption layer could be displayed as having a valid signature in some\ncircumstances, even if the signer had no access to the encrypted message.\nAn attacker could potentially exploit this to spoof the message author.\n(CVE-2019-11755)\n\nMultiple security issues were discovered in Thunderbird. If a user were\ntricked in to opening a specially crafted website in a browsing context,\nan attacker could potentially exploit these to cause a denial of service,\nbypass security restrictions, bypass same-origin restrictions, conduct\ncross-site scripting (XSS) attacks, or execute arbitrary code.\n(CVE-2019-11757, CVE-2019-11758, CVE-2019-11759, CVE-2019-11760,\nCVE-2019-11761, CVE-2019-11762, CVE-2019-11763, CVE-2019-11764)\n\nA heap overflow was discovered in the expat library in Thunderbird. If a\nuser were tricked in to opening a specially crafted message, an attacker\ncould potentially exploit this to cause a denial of service, or execute\narbitrary code. (CVE-2019-15903)\n","status":"published","published":"2019-11-26T23:47:36Z","modified":"2026-04-27T15:48:46.099025923Z","updated_at":"2026-11-02T16:58:14.547547Z"},{"id":"USN-4335-1","title":"thunderbird vulnerabilities","description":"Multiple security issues were discovered in Thunderbird. If a user were\ntricked in to opening a specially crafted website in a browsing context,\nan attacker could potentially exploit these to cause a denial of service,\nobtain sensitive information, bypass security restrictions, bypass\nsame-origin restrictions, conduct cross-site scripting (XSS) attacks, or\nexecute arbitrary code. (CVE-2019-11757, CVE-2019-11758, CVE-2019-11759,\nCVE-2019-11760, CVE-2019-11761, CVE-2019-11762, CVE-2019-11763,\nCVE-2019-11764, CVE-2019-17005, CVE-2019-17008, CVE-2019-17010,\nCVE-2019-17011, CVE-2019-17012, CVE-2019-17016, CVE-2019-17017,\nCVE-2019-17022, CVE-2019-17024, CVE-2019-17026, CVE-2019-20503,\nCVE-2020-6798, CVE-2020-6800, CVE-2020-6805, CVE-2020-6806, CVE-2020-6807,\nCVE-2020-6812, CVE-2020-6814, CVE-2020-6819, CVE-2020-6820, CVE-2020-6821,\nCVE-2020-6825)\n\nIt was discovered that NSS incorrectly handled certain memory operations.\nA remote attacker could potentially exploit this to cause a denial of\nservice, or execute arbitrary code. (CVE-2019-11745)\n\nIt was discovered that a specially crafted S/MIME message with an inner\nencryption layer could be displayed as having a valid signature in some\ncircumstances, even if the signer had no access to the encrypted message.\nAn attacker could potentially exploit this to spoof the message author.\n(CVE-2019-11755)\n\nA heap overflow was discovered in the expat library in Thunderbird. If a\nuser were tricked in to opening a specially crafted message, an attacker\ncould potentially exploit this to cause a denial of service, or execute\narbitrary code. (CVE-2019-15903)\n\nIt was discovered that Message ID calculation was based on uninitialized\ndata. An attacker could potentially exploit this to obtain sensitive\ninformation. (CVE-2020-6792)\n\nMutiple security issues were discovered in Thunderbird. If a user were\ntricked in to opening a specially crafted message, an attacker could\npotentially exploit these to cause a denial of service, obtain sensitive\ninformation, or execute arbitrary code. (CVE-2020-6793, CVE-2020-6795,\nCVE-2020-6822)\n\nIt was discovered that if a user saved passwords before Thunderbird 60 and\nthen later set a primary password, an unencrypted copy of these passwords\nwould still be accessible. A local user could exploit this to obtain\nsensitive information. (CVE-2020-6794)\n\nIt was discovered that the Devtools’ ‘Copy as cURL’ feature did not\nfully escape website-controlled data. If a user were tricked in to using\nthe ‘Copy as cURL’ feature to copy and paste a command with specially\ncrafted data in to a terminal, an attacker could potentially exploit this\nto execute arbitrary commands via command injection. (CVE-2020-6811)\n","status":"published","published":"2020-04-21T20:14:22Z","modified":"2026-04-27T15:48:45.185510058Z","updated_at":"2026-11-02T16:58:14.547547Z"}]}}