Summary
Multiple security issues were discovered in Thunderbird. If a user were
tricked into opening a specially crafted website in a browsing context, an
attacker could potentially exploit these to cause a denial of service,
obtain sensitive information, bypass security restrictions, cross-site
tracing, or execute arbitrary code. (CVE-2024-0743, CVE-2024-2611,
CVE-2024-2614)
Hubert Kario discovered that Thunderbird had a timing side-channel when
performing RSA decryption. A remote attacker could possibly use this
issue to recover sensitive information. (CVE-2023-5388)
Gary Kwong discovered that Thunderbird incorrectly updated return
registers for JIT code on Armv7-A systems. An attacker could potentially
exploit this issue to execute arbitrary code. (CVE-2024-2607)
Ronald Crane discovered that Thunderbird did not properly manage memory
during character encoding. An attacker could potentially exploit this
issue to cause a denial of service. (CVE-2024-2608)
Georg Felber and Marco Squarcina discovered that Thunderbird incorrectly
handled html and body tags. An attacker who was able to inject markup into
a page otherwise protected by a Content Security Policy may have been able
obtain sensitive information. (CVE-2024-2610)
Ronald Crane discovered a use-after-free in Thunderbird when handling code
in SafeRefPtr. An attacker could potentially exploit this issue to cause a
denial of service, or execute arbitrary code. (CVE-2024-2612)
Ryan VanderMeulen and Dan Minor discovered that Thunderbird did not
properly manage memory conditions in ICU. An attacker could potentially
exploit this issue to cause a denial of service. (CVE-2024-2616)
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 20.04 LTS 20.04:LTS | thunderbird | 1:115.9.0+build1-0ubuntu0.20.04.1 |
| Ubuntu · 22.04 LTS 22.04:LTS | thunderbird | 1:115.9.0+build1-0ubuntu0.22.04.1 |
Vulnerabilities 9
-
High 8.8
Memory safety bugs present in Firefox 123, Firefox ESR 115.8, and Thunderbird 115.8. Some of these bugs showed evidence…
-
High 8.4
`AppendEncodedAttributeValue(), ExtraSpaceNeededForAttrEncoding()` and `AppendEncodedCharacters()` could have experienc…
-
High 8.1
Return registers were overwritten which could have allowed an attacker to execute arbitrary code. *Note:* This issue on…
-
High 8.1
If an attacker could find a way to trigger a particular code path in `SafeRefPtr`, it could have triggered a crash or p…
-
High 7.5
An unchecked return value in TLS handshake code could have caused a potentially exploitable crash. This vulnerability a…
-
Medium 6.5
NSS was susceptible to a timing side-channel attack when performing RSA decryption. This attack could potentially allow…
-
Medium 6.1
Using a markup injection an attacker could have stolen nonce values. This could have been used to bypass strict content…
-
Medium 5.5
A missing delay on when pointer lock was used could have allowed a malicious page to trick a user into granting permiss…
-
Low 2.7
To harden ICU against exploitation, the behavior for out-of-memory conditions was changed to crash instead of attempt t…
References
-
report
https://ubuntu.com/security/CVE-2023-5388
-
report
https://ubuntu.com/security/CVE-2024-0743
-
report
https://ubuntu.com/security/CVE-2024-2607
-
report
https://ubuntu.com/security/CVE-2024-2608
-
report
https://ubuntu.com/security/CVE-2024-2610
-
report
https://ubuntu.com/security/CVE-2024-2611
-
report
https://ubuntu.com/security/CVE-2024-2612
-
report
https://ubuntu.com/security/CVE-2024-2614
-
report
https://ubuntu.com/security/CVE-2024-2616