Summary
Multiple security issues were discovered in Thunderbird. If a user were
tricked into opening a specially crafted website in a browsing context, an
attacker could potentially exploit these to cause a denial of service,
obtain sensitive information, bypass security restrictions, cross-site
tracing, or execute arbitrary code. (CVE-2024-2609, CVE-2024-3852,
CVE-2024-3864)
Bartek Nowotarski discovered that Thunderbird did not properly limit HTTP/2
CONTINUATION frames. An attacker could potentially exploit this issue to
cause a denial of service. (CVE-2024-3302)
Lukas Bernhard discovered that Thunderbird did not properly manage memory
during JIT optimisations, leading to an out-of-bounds read vulnerability.
An attacker could possibly use this issue to cause a denial of service or
expose sensitive information. (CVE-2024-3854)
Lukas Bernhard discovered that Thunderbird did not properly manage memory
when handling JIT created code during garbage collection. An attacker
could potentially exploit this issue to cause a denial of service, or
execute arbitrary code. (CVE-2024-3857)
Ronald Crane discovered that Thunderbird did not properly manage memory in
the OpenType sanitizer on 32-bit devices, leading to an out-of-bounds read
vulnerability. An attacker could possibly use this issue to cause a denial
of service or expose sensitive information. (CVE-2024-3859)
Ronald Crane discovered that Thunderbird did not properly manage memory
when handling an AlignedBuffer. An attacker could potentially exploit this
issue to cause denial of service, or execute arbitrary code. (CVE-2024-3861)
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 20.04 LTS 20.04:LTS | thunderbird | 1:115.10.1+build1-0ubuntu0.20.04.1 |
| Ubuntu · 22.04 LTS 22.04:LTS | thunderbird | 1:115.10.1+build1-0ubuntu0.22.04.1 |
Vulnerabilities 8
-
High 8.8
In some code patterns the JIT incorrectly optimized switch statements and generated code with out-of-bounds-reads. This…
-
High 8.1
Memory safety bug present in Firefox 124, Firefox ESR 115.9, and Thunderbird 115.9. This bug showed evidence of memory …
-
High 7.8
The JIT created incorrect code for arguments in certain cases. This led to potential use-after-free crashes during garb…
-
High 7.5
GetBoundName could return the wrong version of an object when JIT optimizations were applied. This vulnerability affect…
-
Medium 6.1
The permission prompt input delay could expire while the window is not in focus. This makes it vulnerable to clickjacki…
-
Medium 5.9
On 32-bit versions there were integer-overflows that led to an out-of-bounds-read that potentially could be triggered b…
-
Medium 4.0
If an AlignedBuffer were assigned to itself, the subsequent self-move could result in an incorrect reference count and …
-
Low 3.7
There was no limit to the number of HTTP/2 CONTINUATION frames that would be processed. A server could abuse this to cr…
References
-
report
https://ubuntu.com/security/CVE-2024-2609
-
report
https://ubuntu.com/security/CVE-2024-3302
-
report
https://ubuntu.com/security/CVE-2024-3852
-
report
https://ubuntu.com/security/CVE-2024-3854
-
report
https://ubuntu.com/security/CVE-2024-3857
-
report
https://ubuntu.com/security/CVE-2024-3859
-
report
https://ubuntu.com/security/CVE-2024-3861
-
report
https://ubuntu.com/security/CVE-2024-3864