Red Hat Security Advisory: thunderbird security update

Fixed packages 6

Vulnerabilities 9

• High 8.8
  CVE-2024-0750

  A bug in popup notifications delay calculation could have made it possible for an attacker to trick a user into grantin…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Jan 23, 2024
• High 8.8
  CVE-2024-0751

  A malicious devtools extension could have been used to escalate privileges. This vulnerability affects Firefox < 122, F…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Jan 23, 2024
• High 8.8
  CVE-2024-0755

  Memory safety bugs present in Firefox 121, Firefox ESR 115.6, and Thunderbird 115.6. Some of these bugs showed evidence…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Jan 23, 2024
• Medium 6.5
  CVE-2024-0741 Public exploit

  An out of bounds write in ANGLE could have allowed an attacker to corrupt memory leading to a potentially exploitable c…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Jan 23, 2024
• Medium 6.5
  CVE-2024-0746

  A Linux user opening the print preview dialog could have caused the browser to crash. This vulnerability affects Firefo…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Jan 23, 2024
• Medium 6.5
  CVE-2024-0747

  When a parent page loaded a child in an iframe with `unsafe-inline`, the parent Content Security Policy could have over…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Jan 23, 2024
• Medium 6.5
  CVE-2024-0753

  In specific HSTS configurations an attacker could have bypassed HSTS on a subdomain. This vulnerability affects Firefox…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Jan 23, 2024
• Medium 4.3
  CVE-2024-0742

  It was possible for certain browser prompts and dialogs to be activated or dismissed unintentionally by the user due to…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Jan 23, 2024
• Medium 4.3
  CVE-2024-0749

  A phishing site could have repurposed an `about:` dialog to show phishing content with an incorrect origin in the addre…

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu
  Jan 23, 2024

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2259926
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2259927
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2259928
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2259929
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2259930
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2259931
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2259932
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2259933
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2259934
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_0601.json
• report
  https://access.redhat.com/security/cve/CVE-2024-0741
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-0741
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-0741
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2024-02/#CVE-2024-0741
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2024-04/#CVE-2024-0741
• report
  https://access.redhat.com/security/cve/CVE-2024-0742
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-0742
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-0742
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2024-02/#CVE-2024-0742
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2024-04/#CVE-2024-0742
• report
  https://access.redhat.com/security/cve/CVE-2024-0746
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-0746
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-0746
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2024-02/#CVE-2024-0746
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2024-04/#CVE-2024-0746
• report
  https://access.redhat.com/security/cve/CVE-2024-0747
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-0747
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-0747
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2024-02/#CVE-2024-0747
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2024-04/#CVE-2024-0747
• report
  https://access.redhat.com/security/cve/CVE-2024-0749
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-0749
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-0749
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2024-02/#CVE-2024-0749
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2024-04/#CVE-2024-0749
• report
  https://access.redhat.com/security/cve/CVE-2024-0750
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-0750
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-0750