Red Hat Security Advisory: thunderbird security update

Fixed packages 3

Vulnerabilities 8

• High 8.8
  CVE-2024-3854

  In some code patterns the JIT incorrectly optimized switch statements and generated code with out-of-bounds-reads. This…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu
  Apr 16, 2024
• High 8.1
  CVE-2024-3864

  Memory safety bug present in Firefox 124, Firefox ESR 115.9, and Thunderbird 115.9. This bug showed evidence of memory …

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Apr 16, 2024
• High 7.8
  CVE-2024-3857

  The JIT created incorrect code for arguments in certain cases. This led to potential use-after-free crashes during garb…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu
  Apr 16, 2024
• High 7.5
  CVE-2024-3852

  GetBoundName could return the wrong version of an object when JIT optimizations were applied. This vulnerability affect…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu
  Apr 16, 2024
• Medium 6.1
  CVE-2024-2609

  The permission prompt input delay could expire while the window is not in focus. This makes it vulnerable to clickjacki…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu
  Mar 19, 2024
• Medium 5.9
  CVE-2024-3859

  On 32-bit versions there were integer-overflows that led to an out-of-bounds-read that potentially could be triggered b…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu
  Apr 16, 2024
• Medium 4.0
  CVE-2024-3861

  If an AlignedBuffer were assigned to itself, the subsequent self-move could result in an incorrect reference count and …

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu
  Apr 16, 2024
• Low 3.7
  CVE-2024-3302

  There was no limit to the number of HTTP/2 CONTINUATION frames that would be processed. A server could abuse this to cr…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu
  Apr 16, 2024

References

• article
  https://access.redhat.com/security/updates/classification/#low
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2273383
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_1941.json
• report
  https://access.redhat.com/security/cve/CVE-2024-2609
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2275551
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-2609
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-2609
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2024-19/#CVE-2024-2609
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2024-20/#CVE-2024-2609
• report
  https://access.redhat.com/security/cve/CVE-2024-3302
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-3302
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-3302
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2024-19/#CVE-2024-3302
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2024-20/#CVE-2024-3302
• report
  https://access.redhat.com/security/cve/CVE-2024-3852
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2275547
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-3852
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-3852
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2024-19/#CVE-2024-3852
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2024-20/#CVE-2024-3852
• report
  https://access.redhat.com/security/cve/CVE-2024-3854
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2275549
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-3854
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-3854
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2024-19/#CVE-2024-3854
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2024-20/#CVE-2024-3854
• report
  https://access.redhat.com/security/cve/CVE-2024-3857
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2275550
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-3857
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-3857
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2024-19/#CVE-2024-3857
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2024-20/#CVE-2024-3857
• report
  https://access.redhat.com/security/cve/CVE-2024-3859
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2275552
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-3859
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-3859
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2024-19/#CVE-2024-3859
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2024-20/#CVE-2024-3859
• report
  https://access.redhat.com/security/cve/CVE-2024-3861