Red Hat Security Advisory: thunderbird security update

Fixed packages 6

Vulnerabilities 6

• High 8.8
  CVE-2024-4770

  When saving a page to PDF, certain font styles could have led to a potential use-after-free crash. This vulnerability a…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu
  May 14, 2024
• High 7.5
  CVE-2024-4777

  Memory safety bugs present in Firefox 125, Firefox ESR 115.10, and Thunderbird 115.10. Some of these bugs showed eviden…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu
  May 14, 2024
• Medium 6.1
  CVE-2024-4768

  A bug in popup notifications' interaction with WebAuthn made it easier for an attacker to trick a user into granting pe…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu
  May 14, 2024
• Medium 5.9
  CVE-2024-4769

  When importing resources using Web Workers, error messages would distinguish the difference between `application/javasc…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu
  May 14, 2024
• Medium 5.6
  CVE-2024-4367 Public exploit EPSS 71%

  PDF.js vulnerable to arbitrary JavaScript execution upon opening a malicious PDF

  A type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution in the PDF.js context. This vulnerability affects Firefox < 126, Firefox ESR < 115.11, and Thunderbird < 115.11.

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu npm
  May 14, 2024
• Medium 4.3
  CVE-2024-4767

  If the `browser.privatebrowsing.autostart` preference is enabled, IndexedDB files were not properly deleted when the wi…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu
  May 14, 2024

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2280382
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2280383
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2280384
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2280385
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2280386
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2280387
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_2913.json
• report
  https://access.redhat.com/security/cve/CVE-2024-4367
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-4367
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-4367
• article
  https://webkitgtk.org/security/WSA-2026-0004.html
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2024-22/#CVE-2024-4367
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2024-23/#CVE-2024-4367
• report
  https://access.redhat.com/security/cve/CVE-2024-4767
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-4767
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-4767
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2024-22/#CVE-2024-4767
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2024-23/#CVE-2024-4767
• report
  https://access.redhat.com/security/cve/CVE-2024-4768
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-4768
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-4768
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2024-22/#CVE-2024-4768
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2024-23/#CVE-2024-4768
• report
  https://access.redhat.com/security/cve/CVE-2024-4769
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-4769
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-4769
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2024-22/#CVE-2024-4769
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2024-23/#CVE-2024-4769
• report
  https://access.redhat.com/security/cve/CVE-2024-4770
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-4770
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-4770
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2024-22/#CVE-2024-4770
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2024-23/#CVE-2024-4770
• report
  https://access.redhat.com/security/cve/CVE-2024-4777
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-4777
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-4777
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2024-22/#CVE-2024-4777
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2024-23/#CVE-2024-4777