RHSA-2024:9017MediumCVSS 8.8

Red Hat Security Advisory: thunderbird security update

Published
November 7, 2024
Last Modified
November 5, 2026

🔗 CVE IDs covered (10)

CVE-2024-10463 →CVE-2024-10466 →CVE-2024-10467 →CVE-2024-10459 →CVE-2024-10460 →CVE-2024-10462 →CVE-2024-10464 →CVE-2024-10465 →CVE-2024-10458 →CVE-2024-10461 →

📋 Description

CVE-2024-10458 — firefox: thunderbird: Permission leak via embed or object elements CVE-2024-10459 — firefox: thunderbird: Use-after-free in layout with accessibility CVE-2024-10460 — firefox: thunderbird: Confusing display of origin for external protocol handler prompt CVE-2024-10461 — firefox: thunderbird: XSS due to Content-Disposition being ignored in multipart/x-mixed-replace response CVE-2024-10462 — firefox: thunderbird: Origin of permission prompt could be spoofed by long URL CVE-2024-10463 — firefox: thunderbird: Cross origin video frame leak CVE-2024-10464 — firefox: thunderbird: History interface could have been used to cause a Denial of Service condition in the browser CVE-2024-10465 — firefox: thunderbird: Clipboard "paste" button persisted across tabs CVE-2024-10466 — firefox: DOM push subscription message could hang Firefox CVE-2024-10467 — firefox: thunderbird: Memory safety bugs fixed in Firefox 132, Thunderbird 132, Firefox ESR 128.4, and Thunderbird 128.4

🎯 Affected products24

  • Red Hat Enterprise Linux AppStream AUS (v.8.6)
  • Red Hat Enterprise Linux AppStream E4S (v.8.6)
  • Red Hat Enterprise Linux AppStream TUS (v.8.6)
  • thunderbird-0:128.4.0-1.el8_6.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.8.6)
  • thunderbird-0:128.4.0-1.el8_6.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.8.6)
  • thunderbird-0:128.4.0-1.el8_6.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.8.6)
  • thunderbird-0:128.4.0-1.el8_6.src as a component of Red Hat Enterprise Linux AppStream AUS (v.8.6)
  • thunderbird-0:128.4.0-1.el8_6.src as a component of Red Hat Enterprise Linux AppStream E4S (v.8.6)
  • thunderbird-0:128.4.0-1.el8_6.src as a component of Red Hat Enterprise Linux AppStream TUS (v.8.6)
  • thunderbird-0:128.4.0-1.el8_6.x86_64 as a component of Red Hat Enterprise Linux AppStream AUS (v.8.6)
  • thunderbird-0:128.4.0-1.el8_6.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.8.6)
  • thunderbird-0:128.4.0-1.el8_6.x86_64 as a component of Red Hat Enterprise Linux AppStream TUS (v.8.6)
  • thunderbird-debuginfo-0:128.4.0-1.el8_6.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.8.6)
  • thunderbird-debuginfo-0:128.4.0-1.el8_6.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.8.6)
  • thunderbird-debuginfo-0:128.4.0-1.el8_6.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.8.6)
  • thunderbird-debuginfo-0:128.4.0-1.el8_6.x86_64 as a component of Red Hat Enterprise Linux AppStream AUS (v.8.6)
  • thunderbird-debuginfo-0:128.4.0-1.el8_6.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.8.6)
  • thunderbird-debuginfo-0:128.4.0-1.el8_6.x86_64 as a component of Red Hat Enterprise Linux AppStream TUS (v.8.6)
  • thunderbird-debugsource-0:128.4.0-1.el8_6.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.8.6)
  • thunderbird-debugsource-0:128.4.0-1.el8_6.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.8.6)
  • thunderbird-debugsource-0:128.4.0-1.el8_6.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.8.6)
  • thunderbird-debugsource-0:128.4.0-1.el8_6.x86_64 as a component of Red Hat Enterprise Linux AppStream AUS (v.8.6)
  • thunderbird-debugsource-0:128.4.0-1.el8_6.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.8.6)
  • thunderbird-debugsource-0:128.4.0-1.el8_6.x86_64 as a component of Red Hat Enterprise Linux AppStream TUS (v.8.6)

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

🔗 References (13)