Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2019-11705: Thunderbird can crash processing certain calendar emails
CVE-2019-11705 · published 7 years ago
Summary
Thunderbird versions earlier than 60.7.1 may stop working when they handle specially crafted iCal data in email messages. The problem could let an attacker cause the program to crash, potentially disrupting users. Update Thunderbird to version 60.7.1 or later to fix the issue.
What to do
- Update debian thunderbird to version 1:60.7.1-1.
- Update mozilla thunderbird to version 60.7.1 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:12 | debian | thunderbird |
< 1:60.7.1-1 Fix: upgrade to 1:60.7.1-1
|
| Debian:13 | debian | thunderbird |
< 1:60.7.1-1 Fix: upgrade to 1:60.7.1-1
|
| Debian:14 | debian | thunderbird |
< 1:60.7.1-1 Fix: upgrade to 1:60.7.1-1
|
| – | mozilla | thunderbird |
< 60.7.1 cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:* |
Original advisory text
A flaw in Thunderbird's implementation of iCal causes a stack buffer overflow in icalrecur_add_bydayrules when processing certain email messages, resulting in a potentially exploitable crash. This ...
A flaw in Thunderbird's implementation of iCal causes a stack buffer overflow in icalrecur_add_bydayrules when processing certain email messages, resulting in a potentially exploitable crash. This vulnerability affects Thunderbird < 60.7.1.
References
- https://security-tracker.debian.org/tracker/CVE-2019-11705 Vendor Advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=1553808 Issue Tracking Permissions Required Vendor Advisory
- https://security.gentoo.org/glsa/201908-20 Third Party Advisory
- https://www.mozilla.org/security/advisories/mfsa2019-17/ Vendor Advisory
Severity
9.8
Critical
Type
CWE-787Out-of-bounds Write
Timeline
Published23 Jul 2019
Updated15 Oct 2026
First seen21 Sep 2026
Track software like this
Free during beta