79Vt9V4

**Name of the Vulnerable Software and Affected Versions** Tuta versions 3.118.12 through 3.119.9 **Description** Tuta is an encrypted email service. An attacker can send a manipulated email to put the app into an unusable state, preventing the user from accessing received emails. This issue affects not only the app but also the web application, leaving the user with no way to access received emails. The issue was tested with iOS and the web app, but it is possible all clients are affected. **Recommendations** For versions 3.118.12 through 3.119.9, update to version 3.119.10 to resolve the issue. As a temporary workaround, consider avoiding the use of the affected email service until the update is applied.

**Name of the Vulnerable Software and Affected Versions** Tuta versions prior to 119.10 **Description** The issue concerns the loading of external content in emails. In the default setting, external resources should not be loaded without user confirmation. However, certain embedded images can be loaded even when the "Automatic Reloading of Images" function is disabled, and this loading occurs unencrypted via HTTP, with the service following redirections. This behavior poses a risk as it allows the sender to determine that the email address is in use, when the email was read, the device used, and exposes the user's IP address. **Recommendations** For versions prior to 119.10, update to version 119.10 to resolve the issue. As a temporary workaround, consider disabling the automatic loading of images in the email service settings to minimize the risk of exploitation. Restrict access to external content in emails to prevent unintended loading of resources. Avoid using the default setting that allows automatic reloading of images until the issue is resolved.