Red Hat Security Advisory: thunderbird security update

Fixed packages 3

Vulnerabilities 7

• High 8.8
  CVE-2024-11697

  When handling keypress events, an attacker may have been able to trick a user into bypassing the "Open Executable File?…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine Wolfi
  Nov 26, 2024
• High 8.8
  CVE-2024-11699

  Memory safety bugs present in Firefox 132, Firefox ESR 128.4, and Thunderbird 128.4. Some of these bugs showed evidence…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine Wolfi
  Nov 26, 2024
• Medium 6.1
  CVE-2024-11694

  Enhanced Tracking Protection's Strict mode may have inadvertently allowed a CSP `frame-src` bypass and DOM-based XSS th…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine Wolfi
  Nov 26, 2024
• Medium 5.4
  CVE-2024-11695

  A crafted URL containing Arabic script and whitespace characters could have hidden the true origin of the page, resulti…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine Wolfi
  Nov 26, 2024
• Medium 5.4
  CVE-2024-11696

  The application failed to account for exceptions thrown by the `loadManifestFromFile` method during add-on signature ve…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine Wolfi
  Nov 26, 2024
• Medium 5.3
  CVE-2024-11159

  Using remote content in OpenPGP encrypted messages can lead to the disclosure of plaintext. This vulnerability affects …

  Mozilla Thunderbird thunderbird Debian
  Nov 13, 2024
• Medium 4.3
  CVE-2024-11692

  An attacker could cause a select dropdown to be shown over another tab; this could have led to user confusion and possi…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine Wolfi
  Nov 26, 2024

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2325896
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2328941
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2328943
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2328946
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2328947
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2328948
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2328950
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_10710.json
• report
  https://access.redhat.com/security/cve/CVE-2024-11159
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-11159
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-11159
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2024-61/#CVE-2024-11159
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2024-62/#CVE-2024-11159
• report
  https://access.redhat.com/security/cve/CVE-2024-11692
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-11692
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-11692
• article
  https://bugzilla.mozilla.org/show_bug.cgi?id=1909535
• article
  https://www.mozilla.org/security/advisories/mfsa2024-63/
• article
  https://www.mozilla.org/security/advisories/mfsa2024-64/
• article
  https://www.mozilla.org/security/advisories/mfsa2024-67/
• article
  https://www.mozilla.org/security/advisories/mfsa2024-68/
• report
  https://access.redhat.com/security/cve/CVE-2024-11694
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-11694
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-11694
• article
  https://bugzilla.mozilla.org/show_bug.cgi?id=1924167
• article
  https://www.mozilla.org/security/advisories/mfsa2024-65/
• report
  https://access.redhat.com/security/cve/CVE-2024-11695
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-11695
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-11695
• article
  https://bugzilla.mozilla.org/show_bug.cgi?id=1925496
• report
  https://access.redhat.com/security/cve/CVE-2024-11696
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-11696
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-11696
• article
  https://bugzilla.mozilla.org/show_bug.cgi?id=1929600
• report
  https://access.redhat.com/security/cve/CVE-2024-11697
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-11697
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-11697
• article
  https://bugzilla.mozilla.org/show_bug.cgi?id=1842187