Summary
Masato Kinugawa discovered that Thunderbird did not properly validate the
CSP policy in the Web Compatibility extension. An attacker could
potentially exploit this issue to perform a cross-site scripting attack.
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 20.04 LTS 20.04:LTS | thunderbird | 1:115.18.0+build1-0ubuntu0.20.04.1 |
| Ubuntu · 22.04 LTS 22.04:LTS | thunderbird | 1:115.18.0+build1-0ubuntu0.22.04.1 |
Vulnerabilities 1
-
Medium 6.1
Enhanced Tracking Protection's Strict mode may have inadvertently allowed a CSP `frame-src` bypass and DOM-based XSS th…
References
-
report
https://ubuntu.com/security/CVE-2024-11694