Summary
Multiple security issues were discovered in Thunderbird. If a user were
tricked into opening a specially crafted website in a browsing context, an
attacker could potentially exploit these to cause a denial of service,
obtain sensitive information, bypass security restrictions, cross-site
tracing, or execute arbitrary code. (CVE-2024-0741, CVE-2024-0742,
CVE-2024-0747, CVE-2024-0749, CVE-2024-0750, CVE-2024-0751, CVE-2024-0753,
CVE-2024-0755, CVE-2024-1547, CVE-2024-1548, CVE-2024-1549, CVE-2024-1550,
CVE-2024-1553, CVE-2024-1936)
Cornel Ionce discovered that Thunderbird did not properly manage memory when
opening the print preview dialog. An attacker could potentially exploit
this issue to cause a denial of service. (CVE-2024-0746)
Alfred Peters discovered that Thunderbird did not properly manage memory when
storing and re-accessing data on a networking channel. An attacker could
potentially exploit this issue to cause a denial of service. (CVE-2024-1546)
Johan Carlsson discovered that Thunderbird incorrectly handled Set-Cookie
response headers in multipart HTTP responses. An attacker could potentially
exploit this issue to inject arbitrary cookie values. (CVE-2024-1551)
Gary Kwong discovered that Thunderbird incorrectly generated codes on 32-bit
ARM devices, which could lead to unexpected numeric conversions or undefined
behaviour. An attacker could possibly use this issue to cause a denial of
service. (CVE-2024-1552)
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 20.04 LTS 20.04:LTS | thunderbird | 1:115.8.1+build1-0ubuntu0.20.04.1 |
| Ubuntu · 22.04 LTS 22.04:LTS | thunderbird | 1:115.8.1+build1-0ubuntu0.22.04.1 |
Vulnerabilities 18
-
High 8.8
A bug in popup notifications delay calculation could have made it possible for an attacker to trick a user into grantin…
-
High 8.8
A malicious devtools extension could have been used to escalate privileges. This vulnerability affects Firefox < 122, F…
-
High 8.8
Memory safety bugs present in Firefox 121, Firefox ESR 115.6, and Thunderbird 115.6. Some of these bugs showed evidence…
-
High 8.1
Memory safety bugs present in Firefox 122, Firefox ESR 115.7, and Thunderbird 115.7. Some of these bugs showed evidence…
-
High 7.5
When storing and re-accessing data on a networking channel, the length of buffers may have been confused, resulting in …
-
High 7.5
Incorrect code generation could have led to unexpected numeric conversions and potential undefined behavior.*Note:* Thi…
-
High 7.5
The encrypted subject of an email message could be incorrectly and permanently assigned to an arbitrary other email mes…
-
Medium 6.5CVE-2024-0741 Public exploit
An out of bounds write in ANGLE could have allowed an attacker to corrupt memory leading to a potentially exploitable c…
-
Medium 6.5
A Linux user opening the print preview dialog could have caused the browser to crash. This vulnerability affects Firefo…
-
Medium 6.5
When a parent page loaded a child in an iframe with `unsafe-inline`, the parent Content Security Policy could have over…
-
Medium 6.5
In specific HSTS configurations an attacker could have bypassed HSTS on a subdomain. This vulnerability affects Firefox…
-
Medium 6.5
Through a series of API calls and redirects, an attacker-controlled alert dialog could have been displayed on another w…
-
Medium 6.1
If a website set a large custom cursor, portions of the cursor could have overlapped with the permission dialog, potent…
-
Medium 6.1
A malicious website could have used a combination of exiting fullscreen mode and `requestPointerLock` to cause the user…
-
Medium 6.1
Set-Cookie response headers were being incorrectly honored in multipart HTTP responses. If an attacker could control th…
-
Medium 4.3
It was possible for certain browser prompts and dialogs to be activated or dismissed unintentionally by the user due to…
-
Medium 4.3
A phishing site could have repurposed an `about:` dialog to show phishing content with an incorrect origin in the addre…
-
Medium 4.3
A website could have obscured the fullscreen notification by using a dropdown select input element. This could have led…
References
-
report
https://ubuntu.com/security/CVE-2024-0741
-
report
https://ubuntu.com/security/CVE-2024-0742
-
report
https://ubuntu.com/security/CVE-2024-0746
-
report
https://ubuntu.com/security/CVE-2024-0747
-
report
https://ubuntu.com/security/CVE-2024-0749
-
report
https://ubuntu.com/security/CVE-2024-0750
-
report
https://ubuntu.com/security/CVE-2024-0751
-
report
https://ubuntu.com/security/CVE-2024-0753
-
report
https://ubuntu.com/security/CVE-2024-0755
-
report
https://ubuntu.com/security/CVE-2024-1546
-
report
https://ubuntu.com/security/CVE-2024-1547
-
report
https://ubuntu.com/security/CVE-2024-1548
-
report
https://ubuntu.com/security/CVE-2024-1549
-
report
https://ubuntu.com/security/CVE-2024-1550
-
report
https://ubuntu.com/security/CVE-2024-1551
-
report
https://ubuntu.com/security/CVE-2024-1552
-
report
https://ubuntu.com/security/CVE-2024-1553
-
report
https://ubuntu.com/security/CVE-2024-1936