Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2019-11704: Thunderbird can crash when reading some calendar emails
CVE-2019-11704 · published 7 years ago
Summary
Thunderbird versions before 60.7.1 may mishandle certain calendar data in email messages, causing the program to run out of memory and crash. This could allow an attacker to cause a denial of service for the user. Upgrade Thunderbird to version 60.7.1 or later, or apply any available patches from your distribution.
What to do
- Update debian thunderbird to version 1:60.7.1-1.
- Update mozilla thunderbird to version 60.7.1 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:12 | debian | thunderbird |
< 1:60.7.1-1 Fix: upgrade to 1:60.7.1-1
|
| Debian:13 | debian | thunderbird |
< 1:60.7.1-1 Fix: upgrade to 1:60.7.1-1
|
| Debian:14 | debian | thunderbird |
< 1:60.7.1-1 Fix: upgrade to 1:60.7.1-1
|
| – | mozilla | thunderbird |
< 60.7.1 cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:* |
Original advisory text
A flaw in Thunderbird's implementation of iCal causes a heap buffer overflow in icalmemory_strdup_and_dequote when processing certain email messages, resulting in a potentially exploitable crash. T...
A flaw in Thunderbird's implementation of iCal causes a heap buffer overflow in icalmemory_strdup_and_dequote when processing certain email messages, resulting in a potentially exploitable crash. This vulnerability affects Thunderbird < 60.7.1.
References
- https://security-tracker.debian.org/tracker/CVE-2019-11704 Vendor Advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=1553814 Exploit Issue Tracking Vendor Advisory
- https://security.gentoo.org/glsa/201908-20 Third Party Advisory
- https://www.mozilla.org/security/advisories/mfsa2019-17/ Vendor Advisory
Severity
9.8
Critical
Type
CWE-787Out-of-bounds Write
Timeline
Published23 Jul 2019
Updated17 Oct 2026
First seen21 Sep 2026
Track software like this
Free during beta