Security update for MozillaThunderbird

2024-09-0315:03:52

Google

osv.dev

mozillathunderbird

gnupg

security

update

115.14

fix

cve-2024-7519

cve-2024-7521

cve-2024-7522

cve-2024-7525

cve-2024-7526

cve-2024-7527

cve-2024-7529

mfsa 2024-38

bmo#1906903

bmo#1908299

graphics

memory access

webassembly

javascript

streamfilter

CVSS3

9.6

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

AI Score

6.8

Confidence

Low

JSON

This update for MozillaThunderbird fixes the following issues:

Mozilla Thunderbird 115.14
- fixed: When using an external installation of GnuPG,
  Thunderbird occassionally sent/received corrupted messages
- fixed: Users of external GnuPG were unable to decrypt
  incorrectly encoded messages (bmo#1906903)
- fixed: Flatpak install of 128.0esr was incorrectly downgraded
  to 115.13.0esr (bmo#1908299)
- fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
- CVE-2024-7519: Out of bounds memory access in graphics shared memory handling
- CVE-2024-7521: Incomplete WebAssembly exception handing
- CVE-2024-7522: Out of bounds read in editor component
- CVE-2024-7525: Missing permission check when creating a StreamFilter
- CVE-2024-7526: Uninitialized memory used by WebGL
- CVE-2024-7527: Use-after-free in JavaScript garbage collection
- CVE-2024-7529: Document content could partially obscure security prompts