Important: thunderbird security update

2024-07-0214:10:24

Google

osv.dev

mozilla thunderbird

security update

cve-2024-5702

cve-2024-5688

cve-2024-5690

cve-2024-5691

cve-2024-5693

cve-2024-5696

cve-2024-5700

memory corruption

networking vulnerability

javascript object transplant

8.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

7.6 High

AI Score

Confidence

High

JSON

Mozilla Thunderbird is a standalone mail and newsgroup client.

This update upgrades Thunderbird to version 115.12.1.

Security Fix(es):

thunderbird: Use-after-free in networking (CVE-2024-5702)
thunderbird: Use-after-free in JavaScript object transplant (CVE-2024-5688)
thunderbird: External protocol handlers leaked by timing attack (CVE-2024-5690)
thunderbird: Sandboxed iframes were able to bypass sandbox restrictions to open a new window (CVE-2024-5691)
thunderbird: Cross-Origin Image leak via Offscreen Canvas (CVE-2024-5693)
thunderbird: Memory Corruption in Text Fragments (CVE-2024-5696)
thunderbird: Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12, and Thunderbird 115.12 (CVE-2024-5700)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.