Important: Thunderbird Security Update - Arbitrary JavaScript Execution and Memory Safety Bugs
Summary
ALSA-2024:2888: Important: thunderbird security update. Affects thunderbird versions < 115.11.0-1.el9_4.alma.1. Fixed in 115.11.0-1.el9_4.alma.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Mozilla Thunderbird is a standalone mail and newsgroup client. It provides users with a convenient way to manage their emails and participate in newsgroups. Thunderbird is susceptible to various security vulnerabilities that can compromise the confidentiality, integrity, and availability of user data.
Vulnerability Detail
This security update addresses multiple vulnerabilities in Thunderbird:
-
Arbitrary JavaScript execution in PDF.js (CVE-2024-4367): This vulnerability allows an attacker to execute arbitrary JavaScript code within the context of the Thunderbird application when processing specially crafted PDF files.
-
IndexedDB files retained in private browsing mode (CVE-2024-4767): In private browsing mode, Thunderbird should not retain any data from IndexedDB. However, due to a flaw, certain files may still be accessible, potentially exposing sensitive information.
-
Potential permissions request bypass via clickjacking (CVE-2024-4768): By tricking a user into interacting with a specially crafted webpage, an attacker can bypass permissions requests, leading to unauthorized access to user data.
-
Cross-origin responses could be distinguished between script and non-script content-types (CVE-2024-4769): This vulnerability allows an attacker to determine whether a cross-origin response is script or non-script, potentially aiding in the exploitation of other vulnerabilities.
-
Use-after-free could occur when printing to PDF (CVE-2024-4770): A use-after-free vulnerability can be triggered when Thunderbird attempts to print to PDF, potentially leading to arbitrary code execution.
-
Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11, and Thunderbird 115.11 (CVE-2024-4777): This vulnerability refers to multiple memory safety bugs that have been fixed in the latest versions of Thunderbird, preventing potential memory corruption and arbitrary code execution.
How To Fix
Minimum fixed version
115.11.0-1.el9_4.alma.1
This is the first release that contains the fix.
sudo dnf update thunderbirdTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
This security update addresses multiple vulnerabilities in Thunderbird, including arbitrary JavaScript execution, potential permissions request bypass, and memory safety bugs. To ensure the security of your Thunderbird installation, it is crucial to update to version 115.11.0 or later. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for thunderbird →
FAQ
Thunderbird is a standalone mail and newsgroup client developed by Mozilla. It allows users to manage their emails and participate in newsgroups.
These vulnerabilities can lead to arbitrary code execution, unauthorized access to user data, and potential memory corruption. Attackers may exploit these vulnerabilities to compromise the confidentiality, integrity, and availability of Thunderbird users' information.
To fix these vulnerabilities, update Thunderbird to version 115.11.0 or later. This update includes patches for all the mentioned security issues.
No specific workarounds have been mentioned for these vulnerabilities. It is recommended to update Thunderbird to the latest version as soon as possible.
You can find more information about these vulnerabilities, including their impact, CVSS scores, and related details, on the respective CVE pages: CVE-2024-4367, CVE-2024-4767, CVE-2024-4768, CVE-2024-4769, CVE-2024-4770, and CVE-2024-4777.
Related vulnerabilities
Recent vulnerabilities recorded for thunderbird.
