high7.5
CVE-2018-5162
Plaintext of decrypted emails can leak through the src attribute of remote images, or links.
Impact
Plaintext of decrypted emails can leak through the src attribute of remote images, or links. This vulnerability affects Thunderbird ESR < 52.8 and Thunderbird < 52.8.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Redhat | Enterprise Linux Desktop | Versions 6.0, 7.0 |
| Redhat | Enterprise Linux Server | Versions 6.0, 7.0 |
| Redhat | Enterprise Linux Server Aus | Version 7.6 |
| Redhat | Enterprise Linux Server Eus | Versions 7.5, 7.6 |
| Redhat | Enterprise Linux Server Tus | Version 7.6 |
| Redhat | Enterprise Linux Workstation | Versions 6.0, 7.0 |
| Debian | Debian Linux | Versions 7.0, 8.0, 9.0 |
| Canonical | Ubuntu Linux | Versions 14.04, 16.04, 17.10, 18.04 |
| Mozilla | Thunderbird | before 52.8.0 |
| Mozilla | Thunderbird Esr | before 52.8.0 |
Weakness classification
References
- NVD record
- CVE.org record
- http://www.securityfocus.com/bid/104240
- http://www.securitytracker.com/id/1040946
- https://access.redhat.com/errata/RHSA-2018:1725
- https://access.redhat.com/errata/RHSA-2018:1726
- https://bugzilla.mozilla.org/show_bug.cgi?id=1457721
- https://lists.debian.org/debian-lts-announce/2018/05/msg00013.html
- https://security.gentoo.org/glsa/201811-13
- https://usn.ubuntu.com/3660-1/
- https://www.debian.org/security/2018/dsa-4209
- https://www.mozilla.org/security/advisories/mfsa2018-13/
- http://www.securityfocus.com/bid/104240
- http://www.securitytracker.com/id/1040946
- https://access.redhat.com/errata/RHSA-2018:1725
- https://access.redhat.com/errata/RHSA-2018:1726
- https://bugzilla.mozilla.org/show_bug.cgi?id=1457721
- https://lists.debian.org/debian-lts-announce/2018/05/msg00013.html
- https://security.gentoo.org/glsa/201811-13
- https://usn.ubuntu.com/3660-1/
- https://www.debian.org/security/2018/dsa-4209
- https://www.mozilla.org/security/advisories/mfsa2018-13/