Summary
Multiple security issues were discovered in Thunderbird. If a user were
tricked into opening a specially crafted website in a browsing context, an
attacker could potentially exploit these to cause a denial of service,
obtain sensitive information, bypass security restrictions, cross-site
tracing, or execute arbitrary code. (CVE-2024-7521, CVE-2024-7526,
CVE-2024-7527, CVE-2024-7529, CVE-2024-8382)
It was discovered that Thunderbird did not properly manage certain memory
operations when processing graphics shared memory. An attacker could
potentially exploit this issue to escape the sandbox. (CVE-2024-7519)
Irvan Kurniawan discovered that Thunderbird did not properly check an
attribute value in the editor component, leading to an out-of-bounds read
vulnerability. An attacker could possibly use this issue to cause a denial
of service or expose sensitive information. (CVE-2024-7522)
Rob Wu discovered that Thunderbird did not properly check permissions when
creating a StreamFilter. An attacker could possibly use this issue to
modify response body of requests on any site using a web extension.
(CVE-2024-7525)
Nils Bars discovered that Thunderbird contained a type confusion
vulnerability when performing certain property name lookups. An attacker
could potentially exploit this issue to cause a denial of service, or
execute arbitrary code. (CVE-2024-8381)
It was discovered that Thunderbird did not properly manage memory during
garbage collection. An attacker could potentially exploit this issue to
cause a denial of service, or execute arbitrary code. (CVE-2024-8384)
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 20.04 LTS 20.04:LTS | thunderbird | 1:115.15.0+build1-0ubuntu0.20.04.1 |
| Ubuntu · 22.04 LTS 22.04:LTS | thunderbird | 1:115.15.0+build1-0ubuntu0.22.04.1 |
Vulnerabilities 10
-
Critical 9.8
Incomplete WebAssembly exception handing could have led to a use-after-free. This vulnerability affects Firefox < 129, …
-
Critical 9.8CVE-2024-8381 Public exploit
A potentially exploitable type confusion could be triggered when looking up a property name on an object being used as …
-
Critical 9.8
The JavaScript garbage collector could mis-color cross-compartment objects if OOM conditions were detected at the right…
-
Critical 9.1
Editor code failed to check an attribute value. This could have led to an out-of-bounds read. This vulnerability affect…
-
Critical 9.1
It was possible for a web extension with minimal permissions to create a `StreamFilter` which could be used to read and…
-
High 8.8
Insufficient checks when processing graphics shared memory could have led to memory corruption. This could be leveraged…
-
High 8.8
Unexpected marking work at the start of sweeping could have led to a use-after-free. This vulnerability affects Firefox…
-
High 8.8
Internal browser event interfaces were exposed to web content when privileged EventHandler listener callbacks ran for t…
-
High 8.1
The date picker could partially obscure security prompts. This could be used by a malicious site to trick a user into g…
-
High 7.5
ANGLE failed to initialize parameters which lead to reading from uninitialized memory. This could be leveraged to leak …
References
-
report
https://ubuntu.com/security/CVE-2024-7519
-
report
https://ubuntu.com/security/CVE-2024-7521
-
report
https://ubuntu.com/security/CVE-2024-7522
-
report
https://ubuntu.com/security/CVE-2024-7525
-
report
https://ubuntu.com/security/CVE-2024-7526
-
report
https://ubuntu.com/security/CVE-2024-7527
-
report
https://ubuntu.com/security/CVE-2024-7529
-
report
https://ubuntu.com/security/CVE-2024-8381
-
report
https://ubuntu.com/security/CVE-2024-8382
-
report
https://ubuntu.com/security/CVE-2024-8384