CVE-2024-1936

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-1936
The encrypted subject of an email message could be incorrectly and permanently assigned to an arbitrary other email message in Thunderbird's local cache. Consequently, when replying to the contaminated email message, the user might accidentally leak the confidential subject to a third-party. While this update fixes the bug and avoids future message contamination, it does not automatically repair existing contaminations. Users are advised to use the repair folder functionality, which is available from the context menu of email folders, which will erase incorrect subject assignments. This vulnerability affects Thunderbird < 115.8.1.
CVSS

No CVSS.

References
Link Resource
https://bugzilla.mozilla.org/show_bug.cgi?id=1860977 Issue Tracking Exploit Vendor Advisory
https://bugzilla.mozilla.org/show_bug.cgi?id=1860977 Issue Tracking Exploit Vendor Advisory
https://lists.debian.org/debian-lts-announce/2024/03/msg00022.html Mailing List
https://lists.debian.org/debian-lts-announce/2024/03/msg00022.html Mailing List
https://www.mozilla.org/security/advisories/mfsa2024-11/ Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2024-11/ Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*

Configuration 2 (hide)

cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
History

30 Jun 2025, 12:12

Type Values Removed Values Added
References () https://www.mozilla.org/security/advisories/mfsa2024-11/ - () https://www.mozilla.org/security/advisories/mfsa2024-11/ - Vendor Advisory
References () https://bugzilla.mozilla.org/show_bug.cgi?id=1860977 - () https://bugzilla.mozilla.org/show_bug.cgi?id=1860977 - Issue Tracking, Exploit, Vendor Advisory
References () https://lists.debian.org/debian-lts-announce/2024/03/msg00022.html - () https://lists.debian.org/debian-lts-announce/2024/03/msg00022.html - Mailing List
CPE cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*
First Time Debian debian Linux
Mozilla thunderbird
Debian
Mozilla

26 Nov 2024, 14:15

Type Values Removed Values Added
Summary The encrypted subject of an email message could be incorrectly and permanently assigned to an arbitrary other email message in Thunderbird's local cache. Consequently, when replying to the contaminated email message, the user might accidentally leak the confidential subject to a third party. While this update fixes the bug and avoids future message contamination, it does not automatically repair existing contaminations. Users are advised to use the repair folder functionality, which is available from the context menu of email folders, which will erase incorrect subject assignments. This vulnerability affects Thunderbird < 115.8.1. The encrypted subject of an email message could be incorrectly and permanently assigned to an arbitrary other email message in Thunderbird's local cache. Consequently, when replying to the contaminated email message, the user might accidentally leak the confidential subject to a third-party. While this update fixes the bug and avoids future message contamination, it does not automatically repair existing contaminations. Users are advised to use the repair folder functionality, which is available from the context menu of email folders, which will erase incorrect subject assignments. This vulnerability affects Thunderbird < 115.8.1.

23 Mar 2024, 12:15

Type Values Removed Values Added
References
  • () https://lists.debian.org/debian-lts-announce/2024/03/msg00022.html -

04 Mar 2024, 22:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-03-04 22:15

Updated : 2025-06-30 12:12

NVD link : CVE-2024-1936

Mitre link : CVE-2024-1936

JSON object : View

Products Affected

debian

  • debian_linux

mozilla

  • thunderbird
CWE

No CWE.