Read the docs
Red Hat Security Advisory

RHSA-2024:5402

thunderbird security update

Released 2024-08-14 · Red Hat rating Important · View on Red Hat →

Fixed in

Fixes 10 records

TI-2024-06977 CVE-2024-7528 · GHSA-gx25-vx95-m52w

Use after free in Mozilla Firefox

Priority MEDIUM 49

Incorrect garbage collection interaction in IndexedDB could have led to a use-after-free.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00516 Published 2024-08-06 Partial fix · 129, 128.1 CWE-416
TI-2024-06974 CVE-2024-7525 · GHSA-7369-x5q2-rh2m

Improper access control in Mozilla Firefox

Priority MEDIUM 46

It was possible for a web extension with minimal permissions to create a `StreamFilter` which could be used to read and modify the response body of requests on any site.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00598 Published 2024-08-06 Partial fix · 129, 115.14 +1 CWE-284
TI-2024-06971 CVE-2024-7522 · GHSA-7jrj-xq8x-h553

Out-of-bounds read in Mozilla Firefox

Priority MEDIUM 46

Editor code failed to check an attribute value.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00634 Published 2024-08-06 Partial fix · 129, 115.14 +1 CWE-125
TI-2024-06968 CVE-2024-7519 · GHSA-9wvx-3hw8-4ghf

Out-of-bounds write in Mozilla Firefox

Priority MEDIUM 44

Insufficient checks when processing graphics shared memory could have led to memory corruption.

CVSS 3.1CRITICAL 9.6 Network No auth User interaction EPSS 0.00629 Published 2024-08-06 Partial fix · 129, 115.14 +1 CWE-787
TI-2024-06976 CVE-2024-7527 · GHSA-69x6-6jqx-q847

Use after free in Mozilla Firefox

Priority MEDIUM 41

Unexpected marking work at the start of sweeping could have led to a use-after-free.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00607 Published 2024-08-06 Partial fix · 129, 115.14 +1 CWE-416
TI-2024-06969 CVE-2024-7520 · GHSA-7j5g-jfh2-w58c

Code injection in Mozilla Firefox

Priority MEDIUM 41

A type confusion bug in WebAssembly could be leveraged by an attacker to potentially achieve code execution.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00638 Published 2024-08-06 Partial fix · 129, 128.1 CWE-94
TI-2024-06975 CVE-2024-7526 · GHSA-hf5v-h65q-2g27

Use of uninitialized resource in Mozilla Firefox

Priority MEDIUM 40

ANGLE failed to initialize parameters which lead to reading from uninitialized memory.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0058 Published 2024-08-06 Partial fix · 129, 115.14 +1 CWE-908
TI-2024-06967 CVE-2024-7518 · GHSA-mcjx-2c4v-mvg9

Clickjacking in Mozilla Firefox

Priority LOW 29

Select options could obscure the fullscreen notification dialog.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00509 Published 2024-08-06 Partial fix · 129, 128.1 CWE-1021