Red Hat Security Advisory: thunderbird security update

Fixed packages 3

Vulnerabilities 12

• Critical 9.8
  CVE-2024-9680 Exploited · Ransomware Public exploit EPSS 23%

  An attacker was able to achieve code execution in the content process by exploiting a use-after-free in Animation timel…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine Wolfi
  Oct 9, 2024

  KEV Oct 15, 2024
• Critical 9.8
  CVE-2024-9392

  A compromised content process could have allowed for the arbitrary loading of cross-origin pages. This vulnerability af…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Wolfi
  Oct 1, 2024
• Critical 9.8
  CVE-2024-9401

  Memory safety bugs present in Firefox 130, Firefox ESR 115.15, Firefox ESR 128.2, and Thunderbird 128.2. Some of these …

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Wolfi
  Oct 1, 2024
• Critical 9.8
  CVE-2024-9402

  Memory safety bugs present in Firefox 130, Firefox ESR 128.2, and Thunderbird 128.2. Some of these bugs showed evidence…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Wolfi
  Oct 1, 2024
• High 8.8
  CVE-2024-9396

  It is currently unknown if this issue is exploitable but a condition may arise where the structured clone of certain ob…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Wolfi
  Oct 1, 2024
• High 8.8
  CVE-2024-9400

  A potential memory corruption vulnerability could be triggered if an attacker had the ability to trigger an OOM at a sp…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Wolfi
  Oct 1, 2024
• High 7.5
  CVE-2024-9393

  An attacker could, via a specially crafted multipart response, execute arbitrary JavaScript under the `resource://pdf.j…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Wolfi
  Oct 1, 2024
• High 7.5
  CVE-2024-9399

  A website configured to initiate a specially crafted WebTransport session could crash the Firefox process leading to a …

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Wolfi
  Oct 1, 2024
• High 7.3
  CVE-2024-9403

  Memory safety bugs present in Firefox 130. Some of these bugs showed evidence of memory corruption and we presume that …

  Mozilla Firefox Thunderbird thunderbird Browsers Ubuntu Wolfi
  Oct 1, 2024
• Medium 6.1
  CVE-2024-9394

  An attacker could, via a specially crafted multipart response, execute arbitrary JavaScript under the `resource://devto…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Wolfi
  Oct 1, 2024
• Medium 6.1
  CVE-2024-9397

  A missing delay in directory upload UI could have made it possible for an attacker to trick a user into granting permis…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Wolfi
  Oct 1, 2024
• Medium 5.3
  CVE-2024-9398

  By checking the result of calls to `window.open` with specifically set protocol handlers, an attacker could determine i…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Wolfi
  Oct 1, 2024

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2314431
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2315945
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2315947
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2315949
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2315950
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2315951
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2315952
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2315953
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2315954
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2315956
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2315957
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2315959
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2317442
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_8166.json
• report
  https://access.redhat.com/security/cve/CVE-2024-9392
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-9392
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-9392
• article
  https://www.mozilla.org/security/advisories/mfsa2024-47/
• article
  https://www.mozilla.org/security/advisories/mfsa2024-48/
• article
  https://www.mozilla.org/security/advisories/mfsa2024-49/
• article
  https://www.mozilla.org/security/advisories/mfsa2024-50/
• report
  https://access.redhat.com/security/cve/CVE-2024-9393
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-9393
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-9393
• report
  https://access.redhat.com/security/cve/CVE-2024-9394
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-9394
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-9394
• report
  https://access.redhat.com/security/cve/CVE-2024-9396
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-9396
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-9396
• article
  https://bugzilla.mozilla.org/show_bug.cgi?id=1912471
• article
  https://www.mozilla.org/security/advisories/mfsa2024-46/
• report
  https://access.redhat.com/security/cve/CVE-2024-9397
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-9397
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-9397
• article
  https://bugzilla.mozilla.org/show_bug.cgi?id=1916659
• report
  https://access.redhat.com/security/cve/CVE-2024-9398
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-9398