Red Hat Security AdvisoryRHSA-2024:2912
thunderbird security update
Released 2024-05-20 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux AppStream EUS (v.8.6) thunderbird-115.11.0-1.el8_6
Fixes 6 records
Priority HIGH 78
A type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution in the PDF.js context.
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.7066 · Published 2024-05-14 · Partial fix · 126, 115.11 +1 CWE-754
Priority MEDIUM 41
Memory safety bugs present in Firefox 125, Firefox ESR 115.10, and Thunderbird 115.10.
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.00536 · Published 2024-05-14 · Partial fix · 126, 115.11 CWE-416
Priority MEDIUM 41
When saving a page to PDF, certain font styles could have led to a potential use-after-free crash.
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.00592 · Published 2024-05-14 · Partial fix · 126, 115.11 CWE-416
Priority LOW 28
A bug in popup notifications' interaction with WebAuthn made it easier for an attacker to trick a user into granting permissions.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00539 · Published 2024-05-14 · Partial fix · 126, 115.11 CWE-281
Priority LOW 27
When importing resources using Web Workers, error messages would distinguish the difference between `application/javascript` responses and non-script responses.
CVSS 3.1MEDIUM 5.9· Network · No auth · No interaction · EPSS 0.00369 · Published 2024-05-14 · Partial fix · 126, 115.11 CWE-351
Priority LOW 21
If the `browser.privatebrowsing.autostart` preference is enabled, IndexedDB files were not properly deleted when the window was closed.
CVSS 3.1MEDIUM 4.3· Network · No auth · User interaction · EPSS 0.00492 · Published 2024-05-14 · Partial fix · 126, 115.11 CWE-359
THREATIST.IORead the docs