Summary
Mozilla Thunderbird is a standalone mail and newsgroup client.
This update upgrades Thunderbird to version 115.10.0.
Security Fix(es):
* Mozilla: Denial of Service using HTTP/2 CONTINUATION frames (CVE-2024-3302)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux · 9 | thunderbird | 115.10.0-2.el9_3.alma.1 |
Vulnerabilities 8
-
High 8.8
In some code patterns the JIT incorrectly optimized switch statements and generated code with out-of-bounds-reads. This…
-
High 8.1
Memory safety bug present in Firefox 124, Firefox ESR 115.9, and Thunderbird 115.9. This bug showed evidence of memory …
-
High 7.8
The JIT created incorrect code for arguments in certain cases. This led to potential use-after-free crashes during garb…
-
High 7.5
GetBoundName could return the wrong version of an object when JIT optimizations were applied. This vulnerability affect…
-
Medium 6.1
The permission prompt input delay could expire while the window is not in focus. This makes it vulnerable to clickjacki…
-
Medium 5.9
On 32-bit versions there were integer-overflows that led to an out-of-bounds-read that potentially could be triggered b…
-
Medium 4.0
If an AlignedBuffer were assigned to itself, the subsequent self-move could result in an incorrect reference count and …
-
Low 3.7
There was no limit to the number of HTTP/2 CONTINUATION frames that would be processed. A server could abuse this to cr…
References
-
report
https://access.redhat.com/security/cve/CVE-2024-2609
-
report
https://access.redhat.com/security/cve/CVE-2024-3302
-
report
https://access.redhat.com/security/cve/CVE-2024-3852
-
report
https://access.redhat.com/security/cve/CVE-2024-3854
-
report
https://access.redhat.com/security/cve/CVE-2024-3857
-
report
https://access.redhat.com/security/cve/CVE-2024-3859
-
report
https://access.redhat.com/security/cve/CVE-2024-3861
-
report
https://access.redhat.com/security/cve/CVE-2024-3864
-
report
https://bugzilla.redhat.com/2273383
-
report
https://bugzilla.redhat.com/2275547
-
report
https://bugzilla.redhat.com/2275549
-
report
https://bugzilla.redhat.com/2275550
-
report
https://bugzilla.redhat.com/2275551
-
report
https://bugzilla.redhat.com/2275552
-
report
https://bugzilla.redhat.com/2275553
-
report
https://bugzilla.redhat.com/2275555
-
advisory
https://errata.almalinux.org/9/ALSA-2024-1940.html