Skip to content
OpenAdvisories
High ALSA-2024:7699 11 CVEs

Important: thunderbird security update

Published Oct 7, 2024 · Updated Nov 6, 2026

Ecosystem: AlmaLinux

Summary

Mozilla Thunderbird is a standalone mail and newsgroup client.

Security Fix(es):

* thunderbird: 115.16/128.3 ()
* firefox: thunderbird: Specially crafted WebTransport requests could lead to denial of service (CVE-2024-9399)
* firefox: thunderbird: Memory safety bugs fixed in Firefox 131 and Thunderbird 131 (CVE-2024-9403)
* firefox: thunderbird: Potential directory upload bypass via clickjacking (CVE-2024-9397)
* firefox: thunderbird: Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16, Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3 (CVE-2024-9401)
* firefox: thunderbird: Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3 (CVE-2024-9402)
* firefox: thunderbird: External protocol handlers could be enumerated via popups (CVE-2024-9398)
* firefox: thunderbird: Potential memory corruption during JIT compilation (CVE-2024-9400)
* firefox: thunderbird: Potential memory corruption may occur when cloning certain objects (CVE-2024-9396)
* firefox: thunderbird: Cross-origin access to PDF contents through multipart responses (CVE-2024-9393)
* firefox: thunderbird: Cross-origin access to JSON contents through multipart responses (CVE-2024-9394)
* firefox: thunderbird: Compromised content process can bypass site isolation (CVE-2024-9392)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 1

ReleasePackageFixed in
AlmaLinux · 8 thunderbird 128.3.0-1.el8_10.alma.1

Vulnerabilities 11

References

  • report
    https://access.redhat.com/security/cve/CVE-2024-9392
  • report
    https://access.redhat.com/security/cve/CVE-2024-9393
  • report
    https://access.redhat.com/security/cve/CVE-2024-9394
  • report
    https://access.redhat.com/security/cve/CVE-2024-9396
  • report
    https://access.redhat.com/security/cve/CVE-2024-9397
  • report
    https://access.redhat.com/security/cve/CVE-2024-9398
  • report
    https://access.redhat.com/security/cve/CVE-2024-9399
  • report
    https://access.redhat.com/security/cve/CVE-2024-9400
  • report
    https://access.redhat.com/security/cve/CVE-2024-9401
  • report
    https://access.redhat.com/security/cve/CVE-2024-9402
  • report
    https://access.redhat.com/security/cve/CVE-2024-9403
  • report
    https://bugzilla.redhat.com/2314431
  • report
    https://bugzilla.redhat.com/2315945
  • report
    https://bugzilla.redhat.com/2315947
  • report
    https://bugzilla.redhat.com/2315949
  • report
    https://bugzilla.redhat.com/2315950
  • report
    https://bugzilla.redhat.com/2315951
  • report
    https://bugzilla.redhat.com/2315952
  • report
    https://bugzilla.redhat.com/2315953
  • report
    https://bugzilla.redhat.com/2315954
  • report
    https://bugzilla.redhat.com/2315956
  • report
    https://bugzilla.redhat.com/2315957
  • report
    https://bugzilla.redhat.com/2315959
  • advisory
    https://errata.almalinux.org/8/ALSA-2024-7699.html