CVE-2024-1936

The encrypted subject of an email message could be incorrectly and permanently assigned to an arbitrary other email message in Thunderbird's local cache. Consequently, when replying to the contaminated email message, the user might accidentally leak the confidential subject to a third-party. While this update fixes the bug and avoids future message contamination, it does not automatically repair existing contaminations. Users are advised to use the repair folder functionality, which is available from the context menu of email folders, which will erase incorrect subject assignments. This vulnerability affects Thunderbird < 115.8.1.

• CWE-922

• https://bugzilla.mozilla.org/show_bug.cgi?id=1860977Exploit, Issue Tracking, Vendor Advisory
• https://lists.debian.org/debian-lts-announce/2024/03/msg00022.htmlMailing List
• https://www.mozilla.org/security/advisories/mfsa2024-11/Vendor Advisory
• https://bugzilla.mozilla.org/show_bug.cgi?id=1860977Exploit, Issue Tracking, Vendor Advisory
• https://lists.debian.org/debian-lts-announce/2024/03/msg00022.htmlMailing List
• https://www.mozilla.org/security/advisories/mfsa2024-11/Vendor Advisory

Published

Mar 4, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-1930No Limit on Number of Open Sessions / Bad Session Close Beha…6.5
• CVE-2024-1931NLnet Labs Unbound version 1.18.0 up to and including versio…7.5
• CVE-2024-1932Unrestricted Upload of File with Dangerous Type in freescout…4.8
• CVE-2024-1933Insecure UNIX Symbolic Link (Symlink) Following in TeamViewe…7.1
• CVE-2024-1934The WP Compress – Image Optimizer plugin for WordPress is vu…7.5
• CVE-2024-1935The Giveaways and Contests by RafflePress – Get More Website…6.1
• CVE-2024-1937The Brizy – Page Builder plugin for WordPress is vulnerable …6.5
• CVE-2024-1938Type Confusion in V8 in Google Chrome prior to 122.0.6261.94…8.8
• CVE-2024-1939Type Confusion in V8 in Google Chrome prior to 122.0.6261.94…8.8
• CVE-2024-1940The Brizy – Page Builder plugin for WordPress is vulnerable …5.4
• CVE-2024-1941 Delta Electronics CNCSoft-B versions 1.0.0.4 and prior are …7.8
• CVE-2024-1942Mattermost versions 8.1.x before 8.1.9, 9.2.x before 9.2.5, …4.3