Summary
Mozilla Thunderbird is a standalone mail and newsgroup client.
Security Fix(es):
* EMBARGOED Thunderbird: 115.14/128.1 ()
* mozilla: Fullscreen notification dialog can be obscured by document content (CVE-2024-7518)
* mozilla: Out of bounds memory access in graphics shared memory handling (CVE-2024-7519)
* mozilla: Type confusion in WebAssembly (CVE-2024-7520)
* mozilla: Incomplete WebAssembly exception handing (CVE-2024-7521)
* mozilla: Out of bounds read in editor component (CVE-2024-7522)
* mozilla: Missing permission check when creating a StreamFilter (CVE-2024-7525)
* mozilla: Uninitialized memory used by WebGL (CVE-2024-7526)
* mozilla: Use-after-free in JavaScript garbage collection (CVE-2024-7527)
* mozilla: Use-after-free in IndexedDB (CVE-2024-7528)
* mozilla: Document content could partially obscure security prompts (CVE-2024-7529)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux · 9 | thunderbird | 115.14.0-1.el9_4.alma.1 |
Vulnerabilities 10
-
Critical 9.8
Incomplete WebAssembly exception handing could have led to a use-after-free. This vulnerability affects Firefox < 129, …
-
Critical 9.8
Incorrect garbage collection interaction in IndexedDB could have led to a use-after-free. This vulnerability affects Fi…
-
Critical 9.1
Editor code failed to check an attribute value. This could have led to an out-of-bounds read. This vulnerability affect…
-
Critical 9.1
It was possible for a web extension with minimal permissions to create a `StreamFilter` which could be used to read and…
-
High 8.8
Insufficient checks when processing graphics shared memory could have led to memory corruption. This could be leveraged…
-
High 8.8
A type confusion bug in WebAssembly could be leveraged by an attacker to potentially achieve code execution. This vulne…
-
High 8.8
Unexpected marking work at the start of sweeping could have led to a use-after-free. This vulnerability affects Firefox…
-
High 8.1
The date picker could partially obscure security prompts. This could be used by a malicious site to trick a user into g…
-
High 7.5
ANGLE failed to initialize parameters which lead to reading from uninitialized memory. This could be leveraged to leak …
-
Medium 6.5
Select options could obscure the fullscreen notification dialog. This could be used by a malicious site to perform a sp…
References
-
report
https://access.redhat.com/security/cve/CVE-2024-7518
-
report
https://access.redhat.com/security/cve/CVE-2024-7519
-
report
https://access.redhat.com/security/cve/CVE-2024-7520
-
report
https://access.redhat.com/security/cve/CVE-2024-7521
-
report
https://access.redhat.com/security/cve/CVE-2024-7522
-
report
https://access.redhat.com/security/cve/CVE-2024-7525
-
report
https://access.redhat.com/security/cve/CVE-2024-7526
-
report
https://access.redhat.com/security/cve/CVE-2024-7527
-
report
https://access.redhat.com/security/cve/CVE-2024-7528
-
report
https://access.redhat.com/security/cve/CVE-2024-7529
-
report
https://bugzilla.redhat.com/2303135
-
report
https://bugzilla.redhat.com/2303136
-
report
https://bugzilla.redhat.com/2303137
-
report
https://bugzilla.redhat.com/2303138
-
report
https://bugzilla.redhat.com/2303139
-
report
https://bugzilla.redhat.com/2303142
-
report
https://bugzilla.redhat.com/2303143
-
report
https://bugzilla.redhat.com/2303144
-
report
https://bugzilla.redhat.com/2303145
-
report
https://bugzilla.redhat.com/2303146
-
advisory
https://errata.almalinux.org/9/ALSA-2024-5392.html