A flaw during verification of certain S/MIME signatures causes emails to be shown in Thunderbird as having a valid digital signature, even if the shown message contents aren't covered by the signature. The flaw allows an attacker to reuse a valid S/MIME signature to craft an email message with arbitrary content. This vulnerability affects Thunderbird < 60.5.1.
A flaw during verification of certain S/MIME signatures causes emails to be shown in Thunderbird as having a valid digital signature, even if the shown message contents aren't covered by the signature. The flaw allows an attacker to reuse a valid S/MIME signature to craft an email message with arbitrary content. This vulnerability affects Thunderbird < 60.5.1.
Security update for MozillaThunderbird
mozilla: Use after free in Skia Mozilla: Proxy Auto-Configuration file can define localhost access to be proxied thunderbird: flaw in verification of S/MIME signature resulting in signature spoofing mozilla: Integer overflow in Skia Mozilla: Memory safety bugs fixed in Firefox 66 and Firefox ESR 60.6 Mozilla: Use-after-free when removing in-use DOM elements Mozilla: Type inference is incorrect for constructors entered through on-stack replacement with IonMonkey Mozilla: IonMonkey leaks JS_OPTIMIZED_OUT magic value to script Mozilla: Improper bounds checks when Spectre mitigations are disabled Mozilla: Type-confusion in IonMonkey JIT compiler Mozilla: Use-after-free with SMIL animation controller Mozilla: IonMonkey MArraySlice has incorrect alias information Mozilla: Ionmonkey type confusion with __proto__ mutations
Security update for MozillaThunderbird
Affected: Ubuntu:14.04:LTS: thunderbird, Ubuntu:16.04:LTS: thunderbird, Ubuntu:18.04:LTS: thunderbird
A flaw during verification of certain S/MIME signatures causes emails to be shown in Thunderbird as having a valid digital signature, even if the shown message contents aren't covered by the signature. The flaw allows an attacker to reuse a valid S/MIME signature to craft an email message with arbitrary content. This vulnerability affects Thunderbird < 60.5.1.