thunderbird

Mozilla Thunderbird is a standalone mail and newsgroup client.

Security Fix(es):

* firefox: thunderbird: History interface could have been used to cause a Denial of Service condition in the browser (CVE-2024-10464)

* firefox: thunderbird: XSS due to Content-Disposition being ignored in multipart/x-mixed-replace response (CVE-2024-10461)

* firefox: thunderbird: Permission leak via embed or object elements (CVE-2024-10458)

* firefox: thunderbird: Use-after-free in layout with accessibility (CVE-2024-10459)

* firefox: thunderbird: Memory safety bugs fixed in Firefox 132, Thunderbird 132, Firefox ESR 128.4, and Thunderbird 128.4 (CVE-2024-10467)

* firefox: thunderbird: Clipboard "paste" button persisted across tabs (CVE-2024-10465)

* firefox: DOM push subscription message could hang Firefox (CVE-2024-10466)

* firefox: thunderbird: Cross origin video frame leak (CVE-2024-10463)

* firefox: thunderbird: Origin of permission prompt could be spoofed by long URL (CVE-2024-10462)

* firefox: thunderbird: Confusing display of origin for external protocol handler prompt (CVE-2024-10460)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat Security Advisory: thunderbird security update

Multiple security vulnerabilities have been identified and fixed in Mozilla Thunderbird, including permission leaks, use-after-free, cross-site scripting, denial of service, and memory safety issues. These vulnerabilities affect Thunderbird versions up to 128.4 and have been addressed in security updates released for Red Hat Enterprise Linux 9 and related distributions. The update mitigates risks such as denial of service, cross-origin data leaks, and spoofing of permission prompts.

Multiple security vulnerabilities affecting Mozilla Firefox and Thunderbird have been addressed in recent updates. These include issues such as permission leaks, use-after-free bugs, cross-site scripting (XSS), denial of service (DoS), memory safety bugs, and UI spoofing. The vulnerabilities have been fixed in Firefox 132, Thunderbird 132, Firefox ESR 128.4, and Thunderbird 128.4. Red Hat Enterprise Linux 9 packages have been updated to include these fixes. The update is rated as having moderate security impact.

Red Hat Security Advisory: firefox security update

firefox

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.

Security Fix(es):

* firefox: thunderbird: History interface could have been used to cause a Denial of Service condition in the browser (CVE-2024-10464)

* firefox: thunderbird: XSS due to Content-Disposition being ignored in multipart/x-mixed-replace response (CVE-2024-10461)

* firefox: thunderbird: Permission leak via embed or object elements (CVE-2024-10458)

* firefox: thunderbird: Use-after-free in layout with accessibility (CVE-2024-10459)

* firefox: thunderbird: Memory safety bugs fixed in Firefox 132, Thunderbird 132, Firefox ESR 128.4, and Thunderbird 128.4 (CVE-2024-10467)

* firefox: thunderbird: Clipboard "paste" button persisted across tabs (CVE-2024-10465)

* firefox: DOM push subscription message could hang Firefox (CVE-2024-10466)

* firefox: thunderbird: Cross origin video frame leak (CVE-2024-10463)

* firefox: thunderbird: Origin of permission prompt could be spoofed by long URL (CVE-2024-10462)

* firefox: thunderbird: Confusing display of origin for external protocol handler prompt (CVE-2024-10460)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Multiple security vulnerabilities affecting Mozilla Firefox and Thunderbird have been addressed in a Red Hat security update for Red Hat Enterprise Linux 9.2 Extended Update Support. These include issues such as denial of service, cross-site scripting (XSS), permission leaks, use-after-free, memory safety bugs, and UI spoofing. The update fixes these issues in Firefox 132, Thunderbird 132, Firefox ESR 128.4, and Thunderbird 128.4.

CVE-2024-10458 is a high-severity vulnerability in Mozilla Firefox and Thunderbird where a permission leak could occur from a trusted site to an untrusted site via embed or object elements. This flaw affects Firefox versions prior to 132, Firefox ESR versions prior to 128.4 and 115.17, and Thunderbird versions prior to 128.4 and 132. The issue was addressed in Firefox 132 and Firefox ESR 128.4 releases.

A permission leak could have occurred from a trusted site to an untrusted site via embed or object… (CVE-2024-10458)

A permission leak could have occurred from a trusted site to an untrusted site via `embed` or `object` elements. This vulnerability affects Firefox < 132, Firefox ESR < 128.4, Firefox ESR < 115.17, Thunderbird < 128.4, and Thunderbird < 132.

Search: CVE-2024-10458