ALSA-2024:4635 - Important: Thunderbird Security Update
Summary
ALSA-2024:4635: Important: thunderbird security update. Affects thunderbird versions < 115.13.0-3.el8_10.alma.1. Fixed in 115.13.0-3.el8_10.alma.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Mozilla Thunderbird is a standalone mail and newsgroup client. It provides users with a convenient way to manage their emails and participate in newsgroup discussions. Thunderbird is widely used and offers various features such as customizable email filters, advanced search capabilities, and support for multiple email accounts. However, it is susceptible to security vulnerabilities that can compromise user data and system integrity.
Vulnerability Detail
The recently discovered vulnerability in Thunderbird, identified as CVE-2024-6604, is related to memory safety bugs. These bugs have been fixed in the latest versions of Firefox (128) and Thunderbird (115.13). The vulnerability could potentially allow an attacker to exploit memory corruption issues, leading to arbitrary code execution or denial of service attacks. Additionally, Thunderbird is also affected by a race condition in permission assignment (CVE-2024-6601) and memory corruption in thread creation (CVE-2024-6603). These vulnerabilities may result in unauthorized access, privilege escalation, or system instability.
How To Fix
Minimum fixed version
115.13.0-3.el8_10.alma.1
This is the first release that contains the fix.
sudo dnf update thunderbirdTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
Thunderbird users should be aware of the recently discovered vulnerabilities and take immediate action to update their installations. By applying the latest security patches, users can mitigate the risks associated with memory safety bugs, race conditions, and memory corruption. Regularly checking for updates and following the recommended update process is crucial to ensure the ongoing security and stability of Thunderbird.
See every vulnerability recorded for thunderbird →
FAQ
Thunderbird is a standalone mail and newsgroup client developed by Mozilla. It allows users to manage their emails and participate in newsgroup discussions.
The vulnerabilities in Thunderbird could potentially lead to arbitrary code execution, denial of service attacks, unauthorized access, privilege escalation, or system instability.
To fix these vulnerabilities, update Thunderbird to the latest version (115.13.0-3.el8_10.alma.1) using the official update process recommended by your operating system or package manager.
No specific workarounds have been provided for these vulnerabilities. It is essential to update Thunderbird to the latest version to mitigate the risks.
You can find more information about these vulnerabilities, including their impact and technical details, on the CVE pages listed in the References section of the original advisory.
Related vulnerabilities
Recent vulnerabilities recorded for thunderbird.
