Red Hat Security Advisory: thunderbird security update

Fixed packages 3

Vulnerabilities 7

• High 8.6
  CVE-2024-5696

  By manipulating the text in an `<input>` tag, an attacker could have caused corrupt memory leading to a potential…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Wolfi
  Jun 11, 2024
• High 8.1
  CVE-2024-5688

  If a garbage collection was triggered at the right time, a use-after-free could have occurred during object transplant.…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Wolfi
  Jun 11, 2024
• High 7.5
  CVE-2024-5702

  Memory corruption in the networking stack could have led to a potentially exploitable crash. This vulnerability affects…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu
  Jun 11, 2024
• High 7.0
  CVE-2024-5700

  Memory safety bugs present in Firefox 126, Firefox ESR 115.11, and Thunderbird 115.11. Some of these bugs showed eviden…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Wolfi
  Jun 11, 2024
• Medium 6.1
  CVE-2024-5693

  Offscreen Canvas did not properly track cross-origin tainting, which could be used to access image data from another si…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Wolfi
  Jun 11, 2024
• Medium 4.7
  CVE-2024-5691

  By tricking the browser with a `X-Frame-Options` header, a sandboxed iframe could have presented a button that, if clic…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Wolfi
  Jun 11, 2024
• Medium 4.3
  CVE-2024-5690

  By monitoring the time certain operations take, an attacker could have guessed which external protocol handlers were fu…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Wolfi
  Jun 11, 2024

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2291394
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2291395
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2291396
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2291397
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2291399
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2291400
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2291401
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_4036.json
• report
  https://access.redhat.com/security/cve/CVE-2024-5688
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-5688
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-5688
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2024-26/#CVE-2024-5688
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2024-28/#CVE-2024-5688
• report
  https://access.redhat.com/security/cve/CVE-2024-5690
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-5690
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-5690
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2024-26/#CVE-2024-5690
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2024-28/#CVE-2024-5690
• report
  https://access.redhat.com/security/cve/CVE-2024-5691
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-5691
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-5691
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2024-26/#CVE-2024-5691
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2024-28/#CVE-2024-5691
• report
  https://access.redhat.com/security/cve/CVE-2024-5693
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-5693
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-5693
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2024-26/#CVE-2024-5693
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2024-28/#CVE-2024-5693
• report
  https://access.redhat.com/security/cve/CVE-2024-5696
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-5696
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-5696
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2024-26/#CVE-2024-5696
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2024-28/#CVE-2024-5696
• report
  https://access.redhat.com/security/cve/CVE-2024-5700
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-5700
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-5700
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2024-26/#CVE-2024-5700
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2024-28/#CVE-2024-5700