Red Hat Security Advisory: thunderbird security update

Fixed packages 3

Vulnerabilities 8

• Critical 9.8
  CVE-2024-8381 Public exploit

  A potentially exploitable type confusion could be triggered when looking up a property name on an object being used as …

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Wolfi
  Sep 3, 2024
• Critical 9.8
  CVE-2024-8384

  The JavaScript garbage collector could mis-color cross-compartment objects if OOM conditions were detected at the right…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine Wolfi
  Sep 3, 2024
• Critical 9.8
  CVE-2024-8385

  A difference in the handling of StructFields and ArrayTypes in WASM could be used to trigger an exploitable type confus…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Wolfi
  Sep 3, 2024
• Critical 9.8
  CVE-2024-8387

  Memory safety bugs present in Firefox 129, Firefox ESR 128.1, and Thunderbird 128.1. Some of these bugs showed evidence…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Wolfi
  Sep 3, 2024
• High 8.8
  CVE-2024-8382

  Internal browser event interfaces were exposed to web content when privileged EventHandler listener callbacks ran for t…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Wolfi
  Sep 3, 2024
• High 7.5
  CVE-2024-7652

  Type Confusion in Async Generators in Javascript Engine

  An error in the ECMA-262 specification relating to Async Generators could have resulted in a type confusion, potentially leading to memory corruption and an exploitable crash. This vulnerability affects Firefox < 128, Firefox ESR < 115.13, Thunderbird < 115.1…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Wolfi
  Sep 6, 2024
• Medium 6.5
  CVE-2024-8394

  When aborting the verification of an OTR chat session, an attacker could have caused a use-after-free bug leading to a …

  Mozilla Thunderbird thunderbird Debian
  Sep 6, 2024
• Medium 6.1
  CVE-2024-8386

  If a site had been granted the permission to open popup windows, it could cause Select elements to appear on top of ano…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Wolfi
  Sep 3, 2024

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2307331
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2309427
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2309428
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2309430
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2309431
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2309432
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2309433
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2310481
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2310490
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_6723.json
• report
  https://access.redhat.com/security/cve/CVE-2024-7652
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-7652
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-7652
• article
  https://bugzilla.mozilla.org/show_bug.cgi?id=1901411
• article
  https://github.com/tc39/ecma262/security/advisories/GHSA-g38c-wh3c-5h9r
• article
  https://www.mozilla.org/security/advisories/mfsa2024-29/
• article
  https://www.mozilla.org/security/advisories/mfsa2024-30/
• article
  https://www.mozilla.org/security/advisories/mfsa2024-31/
• article
  https://www.mozilla.org/security/advisories/mfsa2024-32/
• report
  https://access.redhat.com/security/cve/CVE-2024-8381
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-8381
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-8381
• article
  https://bugzilla.mozilla.org/show_bug.cgi?id=1912715
• article
  https://www.mozilla.org/security/advisories/mfsa2024-39/
• article
  https://www.mozilla.org/security/advisories/mfsa2024-40/
• article
  https://www.mozilla.org/security/advisories/mfsa2024-41/
• report
  https://access.redhat.com/security/cve/CVE-2024-8382
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-8382
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-8382
• article
  https://bugzilla.mozilla.org/show_bug.cgi?id=1906744
• report
  https://access.redhat.com/security/cve/CVE-2024-8384
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-8384
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-8384
• article
  https://bugzilla.mozilla.org/show_bug.cgi?id=1911288
• report
  https://access.redhat.com/security/cve/CVE-2024-8385
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-8385
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-8385
• article
  https://bugzilla.mozilla.org/show_bug.cgi?id=1911909