Security update for MozillaThunderbird

2024-06-1815:47:16

Google

osv.dev

mozillathunderbird

security update

use-after-free

bypass

memory corruption

CVSS3

8.6

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H

AI Score

7.9

Confidence

High

This update for MozillaThunderbird fixes the following issues:

Update to version 115.12.0 ESR (bsc#1226027)
CVE-2024-5702: Use-after-free in networking
CVE-2024-5688: Use-after-free in JavaScript object transplant
CVE-2024-5690: External protocol handlers leaked by timing attack
CVE-2024-5691: Sandboxed iframes were able to bypass sandbox restrictions to open a new window
CVE-2024-5692: Bypass of file name restrictions during saving
CVE-2024-5693: Cross-Origin Image leak via Offscreen Canvas
CVE-2024-5696: Memory Corruption in Text Fragments
CVE-2024-5700: Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12, and Thunderbird 115.12