Lucene search

K
osvGoogleOSV:SUSE-SU-2024:3112-1
HistorySep 03, 2024 - 3:03 p.m.

Security update for MozillaThunderbird

2024-09-0315:03:52
Google
osv.dev

CVSS3

9.6

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

AI Score

6.8

Confidence

Low

This update for MozillaThunderbird fixes the following issues:

  • Mozilla Thunderbird 115.14
    • fixed: When using an external installation of GnuPG,
      Thunderbird occassionally sent/received corrupted messages
    • fixed: Users of external GnuPG were unable to decrypt
      incorrectly encoded messages (bmo#1906903)
    • fixed: Flatpak install of 128.0esr was incorrectly downgraded
      to 115.13.0esr (bmo#1908299)
    • fixed: Security fixes
      MFSA 2024-38 (bsc#1228648)
    • CVE-2024-7519: Out of bounds memory access in graphics shared memory handling
    • CVE-2024-7521: Incomplete WebAssembly exception handing
    • CVE-2024-7522: Out of bounds read in editor component
    • CVE-2024-7525: Missing permission check when creating a StreamFilter
    • CVE-2024-7526: Uninitialized memory used by WebGL
    • CVE-2024-7527: Use-after-free in JavaScript garbage collection
    • CVE-2024-7529: Document content could partially obscure security prompts

CVSS3

9.6

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

AI Score

6.8

Confidence

Low