cve/2019/CVE-2019-11755.md

### [CVE-2019-11755](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11755)
![](https://img.shields.io/static/v1?label=Product&message=Thunderbird&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=%3C%2068.1.1%20&color=brighgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=Spoofing%20a%20message%20author%20via%20a%20crafted%20S%2FMIME%20message&color=brighgreen)

### Description

A crafted S/MIME message consisting of an inner encryption layer and an outer SignedData layer was shown as having a valid digital signature, although the signer might have had no access to the contents of the encrypted message, and might have stripped a different signature from the encrypted message. Previous versions had only suppressed showing a digital signature for messages with an outer multipart/signed layer. This vulnerability affects Thunderbird < 68.1.1.

### POC

#### Reference
- https://usn.ubuntu.com/4202-1/

#### Github
No PoCs found on GitHub currently.