CVE-2024-0750

A bug in popup notifications delay calculation could have made it possible for an attacker to trick a user into granting permissions. This vulnerability affects Firefox < 122, Firefox ESR < 115.7, and Thunderbird < 115.7.

A bug in popup notifications delay calculation could have made it possible for an attacker to trick a user into granting permissions. This vulnerability affects Firefox < 122, Firefox ESR < 115.7, and Thunderbird < 115.7.

Mozilla Thunderbird is a standalone mail and newsgroup client.

This update upgrades Thunderbird to version 115.7.0.

Security Fix(es):

• Mozilla: Out of bounds write in ANGLE (CVE-2024-0741)
• Mozilla: Failure to update user input timestamp (CVE-2024-0742)
• Mozilla: Crash when listing printers on Linux (CVE-2024-0746)
• Mozilla: Bypass of Content Security Policy when directive unsafe-inline was set (CVE-2024-0747)
• Mozilla: Phishing site popup could show local origin in address bar (CVE-2024-0749)
• Mozilla: Potential permissions request bypass via clickjacking (CVE-2024-0750)
• Mozilla: Privilege escalation through devtools (CVE-2024-0751)
• Mozilla: HSTS policy on subdomain could bypass policy of upper domain (CVE-2024-0753)
• Mozilla: Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7, and Thunderbird 115.7 (CVE-2024-0755)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.

This update upgrades Firefox to version 115.7.0 ESR.

Security Fix(es):

• Mozilla: Out of bounds write in ANGLE (CVE-2024-0741)
• Mozilla: Failure to update user input timestamp (CVE-2024-0742)
• Mozilla: Crash when listing printers on Linux (CVE-2024-0746)
• Mozilla: Bypass of Content Security Policy when directive unsafe-inline was set (CVE-2024-0747)
• Mozilla: Phishing site popup could show local origin in address bar (CVE-2024-0749)
• Mozilla: Potential permissions request bypass via clickjacking (CVE-2024-0750)
• Mozilla: Privilege escalation through devtools (CVE-2024-0751)
• Mozilla: HSTS policy on subdomain could bypass policy of upper domain (CVE-2024-0753)
• Mozilla: Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7, and Thunderbird 115.7 (CVE-2024-0755)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.

This update upgrades Firefox to version 115.7.0 ESR.

Security Fix(es):

• Mozilla: Out of bounds write in ANGLE (CVE-2024-0741)
• Mozilla: Failure to update user input timestamp (CVE-2024-0742)
• Mozilla: Crash when listing printers on Linux (CVE-2024-0746)
• Mozilla: Bypass of Content Security Policy when directive unsafe-inline was set (CVE-2024-0747)
• Mozilla: Phishing site popup could show local origin in address bar (CVE-2024-0749)
• Mozilla: Potential permissions request bypass via clickjacking (CVE-2024-0750)
• Mozilla: Privilege escalation through devtools (CVE-2024-0751)
• Mozilla: HSTS policy on subdomain could bypass policy of upper domain (CVE-2024-0753)
• Mozilla: Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7, and Thunderbird 115.7 (CVE-2024-0755)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Mozilla Thunderbird is a standalone mail and newsgroup client.

This update upgrades Thunderbird to version 115.7.0.

Security Fix(es):

• Mozilla: Out of bounds write in ANGLE (CVE-2024-0741)
• Mozilla: Failure to update user input timestamp (CVE-2024-0742)
• Mozilla: Crash when listing printers on Linux (CVE-2024-0746)
• Mozilla: Bypass of Content Security Policy when directive unsafe-inline was set (CVE-2024-0747)
• Mozilla: Phishing site popup could show local origin in address bar (CVE-2024-0749)
• Mozilla: Potential permissions request bypass via clickjacking (CVE-2024-0750)
• Mozilla: Privilege escalation through devtools (CVE-2024-0751)
• Mozilla: HSTS policy on subdomain could bypass policy of upper domain (CVE-2024-0753)
• Mozilla: Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7, and Thunderbird 115.7 (CVE-2024-0755)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

• rebase from Thunderbird 115.4.1 to 140.12.0 ESR

• CVE-2022-3032: When receiving an HTML email that contained an iframe element, which used a srcdoc attribute to define the inner HTML document, remote objects specified in the nested document, for example images or videos, were not blocked

• CVE-2023-0430: Certificate OCSP revocation status was not checked when verifying S/Mime signatures

• CVE-2023-0547: OCSP revocation status of recipient certificates was not checked when sending S/Mime encrypted email, and revoked certificates would be accepted

• CVE-2023-0616: If a MIME email combines OpenPGP and OpenPGP MIME data in a certain way Thunderbird repeatedly attempts to process and display the message, which could cause Thunderbird's user interface to lock up and no longer respond to the user's actions

• CVE-2023-1945: Unexpected data returned from the Safe Browsing API could have led to memory corruption and a potentially exploitable crash

• CVE-2023-4573: When receiving rendering data over IPC mStream could have been destroyed when initialized, which could have led to a use-after-free causing a potentially exploitable crash

• CVE-2023-4574: When creating a callback over IPC for showing the Color Picker window, multiple of the same callbacks could have been created at a time and eventually all simultaneously destroyed as soon as one of the callbacks finished

• CVE-2023-4575: When creating a callback over IPC for showing the File Picker window, multiple of the same callbacks could have been created at a time and eventually all simultaneously destroyed as soon as one of the callbacks finished

• CVE-2023-4577: When UpdateRegExpStatics attempted to access initialStringHeap it could already have been garbage collected prior to entering the function, which could potentially have led to an exploitable crash

• CVE-2023-4578: When calling JS::CheckRegExpSyntax a Syntax Error could have been set which would end in calling convertToRuntimeErrorAndClear. A path in the function could attempt to allocate memory when none is available which would have caused a newly created Out of Memory exception to be mishandled as a Syntax Error

• CVE-2023-4580: Push notifications stored on disk in private browsing mode were not being encrypted potentially allowing the leak of sensitive information

• CVE-2023-4581: Excel .xll add-in files did not have a blocklist entry in Firefox's executable blocklist which allowed them to be downloaded without any warning of their potential harm

• CVE-2023-5169: A compromised content process could have provided malicious data in a PathRecording resulting in an out-of-bounds write, leading to a potentially exploitable crash in a privileged process

• CVE-2023-5171: During Ion compilation, a Garbage Collection could have resulted in a use-after-free condition, allowing an attacker to write two NUL bytes, and cause a potentially exploitable crash

• CVE-2023-5724: Drivers are not always robust to extremely large draw calls and in some cases this scenario could have led to a crash

• CVE-2023-5725: A malicious installed WebExtension could open arbitrary URLs, which under the right circumstance could be leveraged to collect sensitive user data

• CVE-2023-5732: An attacker could have created a malicious link using bidirectional characters to spoof the location in the address bar when visited

• CVE-2023-6204: On some systems—depending on the graphics settings and drivers—it was possible to force an out-of-bounds read and leak memory data into the images created on the canvas element

• CVE-2023-6205: It was possible to cause the use of a MessagePort after it had already been freed, which could potentially have led to an exploitable crash

• CVE-2023-6206: The black fade animation when exiting fullscreen is roughly the length of the anti-clickjacking delay on permission prompts

• CVE-2023-6207: Ownership…

Out of bounds write in ANGLE. (CVE-2024-0741)

Failure to update user input timestamp. (CVE-2024-0742)

Crash when listing printers on Linux. (CVE-2024-0746)

Bypass of Content Security Policy when directive unsafe-inline was set. (CVE-2024-0747)

Phishing site popup could show local origin in address bar. (CVE-2024-0749)

Potential permissions request bypass via clickjacking. (CVE-2024-0750)

Privilege escalation through devtools. (CVE-2024-0751)

HSTS policy on subdomain could bypass policy of upper domain. (CVE-2024-0753)

Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7, and Thunderbird 115.7. (CVE-2024-0755)

Out of bounds write in ANGLE. (CVE-2024-0741)

Failure to update user input timestamp. (CVE-2024-0742)

Crash when listing printers on Linux. (CVE-2024-0746)

Bypass of Content Security Policy when directive unsafe-inline was set. (CVE-2024-0747)

Phishing site popup could show local origin in address bar. (CVE-2024-0749)

Potential permissions request bypass via clickjacking. (CVE-2024-0750)

Privilege escalation through devtools. (CVE-2024-0751)

HSTS policy on subdomain could bypass policy of upper domain. (CVE-2024-0753)

Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7, and Thunderbird 115.7. (CVE-2024-0755)

These are all security issues fixed in the MozillaThunderbird-115.7.0-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the MozillaFirefox-122.0-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the firefox-esr-128.5.1-1.1 package on the GA media of openSUSE Tumbleweed.

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.

This update upgrades Firefox to version 115.7.0 ESR.

Security Fix(es):

• Mozilla: Out of bounds write in ANGLE (CVE-2024-0741)

• Mozilla: Failure to update user input timestamp (CVE-2024-0742)

• Mozilla: Crash when listing printers on Linux (CVE-2024-0746)

• Mozilla: Bypass of Content Security Policy when directive unsafe-inline was set (CVE-2024-0747)

• Mozilla: Phishing site popup could show local origin in address bar (CVE-2024-0749)

• Mozilla: Potential permissions request bypass via clickjacking (CVE-2024-0750)

• Mozilla: Privilege escalation through devtools (CVE-2024-0751)

• Mozilla: HSTS policy on subdomain could bypass policy of upper domain (CVE-2024-0753)

• Mozilla: Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7, and Thunderbird 115.7 (CVE-2024-0755)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Mozilla Thunderbird is a standalone mail and newsgroup client.

This update upgrades Thunderbird to version 115.7.0.

Security Fix(es):

• Mozilla: Out of bounds write in ANGLE (CVE-2024-0741)

• Mozilla: Failure to update user input timestamp (CVE-2024-0742)

• Mozilla: Crash when listing printers on Linux (CVE-2024-0746)

• Mozilla: Bypass of Content Security Policy when directive unsafe-inline was set (CVE-2024-0747)

• Mozilla: Phishing site popup could show local origin in address bar (CVE-2024-0749)

• Mozilla: Potential permissions request bypass via clickjacking (CVE-2024-0750)

• Mozilla: Privilege escalation through devtools (CVE-2024-0751)

• Mozilla: HSTS policy on subdomain could bypass policy of upper domain (CVE-2024-0753)

• Mozilla: Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7, and Thunderbird 115.7 (CVE-2024-0755)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

This update for MozillaFirefox fixes the following issues:

Update to Firefox Extended Support Release 115.7.0 ESR (MFSA 2024-02) (bsc#1218955):

• CVE-2024-0741: Out of bounds write in ANGLE
• CVE-2024-0742: Failure to update user input timestamp
• CVE-2024-0746: Crash when listing printers on Linux
• CVE-2024-0747: Bypass of Content Security Policy when directive unsafe-inline was set
• CVE-2024-0749: Phishing site popup could show local origin in address bar
• CVE-2024-0750: Potential permissions request bypass via clickjacking
• CVE-2024-0751: Privilege escalation through devtools
• CVE-2024-0753: HSTS policy on subdomain could bypass policy of upper domain
• CVE-2024-0755: Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7, and Thunderbird 115.7

This update for MozillaFirefox fixes the following issues:

Update to Firefox Extended Support Release 115.7.0 ESR (MFSA 2024-02) (bsc#1218955):

• CVE-2024-0741: Out of bounds write in ANGLE
• CVE-2024-0742: Failure to update user input timestamp
• CVE-2024-0746: Crash when listing printers on Linux
• CVE-2024-0747: Bypass of Content Security Policy when directive unsafe-inline was set
• CVE-2024-0749: Phishing site popup could show local origin in address bar
• CVE-2024-0750: Potential permissions request bypass via clickjacking
• CVE-2024-0751: Privilege escalation through devtools
• CVE-2024-0753: HSTS policy on subdomain could bypass policy of upper domain
• CVE-2024-0755: Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7, and Thunderbird 115.7

This update for MozillaFirefox fixes the following issues:

Update to Firefox Extended Support Release 115.7.0 ESR (MFSA2024-02) (bsc#1218955):

• CVE-2024-0741: Out of bounds write in ANGLE
• CVE-2024-0742: Failure to update user input timestamp
• CVE-2024-0746: Crash when listing printers on Linux
• CVE-2024-0747: Bypass of Content Security Policy when directive unsafe-inline was set
• CVE-2024-0749: Phishing site popup could show local origin in address bar
• CVE-2024-0750: Potential permissions request bypass via clickjacking
• CVE-2024-0751: Privilege escalation through devtools
• CVE-2024-0753: HSTS policy on subdomain could bypass policy of upper domain
• CVE-2024-0755: Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7, and Thunderbird 115.7

This update for MozillaThunderbird fixes the following issues:

Update to Mozilla Thunderbird 115.7 (MFSA 2024-04) (bsc#1218955):

• CVE-2024-0741: Out of bounds write in ANGLE
• CVE-2024-0742: Failure to update user input timestamp
• CVE-2024-0746: Crash when listing printers on Linux
• CVE-2024-0747: Bypass of Content Security Policy when directive unsafe-inline was set
• CVE-2024-0749: Phishing site popup could show local origin in address bar
• CVE-2024-0750: Potential permissions request bypass via clickjacking
• CVE-2024-0751: Privilege escalation through devtools
• CVE-2024-0753: HSTS policy on subdomain could bypass policy of upper domain
• CVE-2024-0755: Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7, and Thunderbird 115.7

Other fixes:

• new: Autocrypt Gossip key distribution added (bmo#1853674)
• fixed: When starting Thunderbird, unread message count did not appear on collapsed accounts (bmo#1862774)
• fixed: Blank window was sometimes displayed when starting Thunderbird (bmo#1870817)
• fixed: Thunderbird '--chrome' flag incorrectly opened extra messenger.xhtml (bmo#1866915)
• fixed: Add-ons did not start correctly when opening Thunderbird from other programs (bmo#1800423)
• fixed: Drag-and-drop installation of add-ons did not work if Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
• fixed: Double-clicking empty space in message pane incorrectly opened the currently selected message (bmo#1867407)
• fixed: Canceling SMTP send before progress reached 100% did not stop message from sending (bmo#1816540)
• fixed: PDF attachments open in a separate tab did not always restore correctly after restarting Thunderbird (bmo#1846054)
• fixed: Some OpenPGP dialogs were too small for their contents (bmo#1870809)
• fixed: Account Manager did not work with hostnames entered as punycode (bmo#1870720,bmo#1872632)
• fixed: Downloading complete message from POP3 headers caused message tab/window to close when 'Close message window/tab on move or delete' was enabled (bmo#1861886)
• fixed: Some ECC GPG keys could not be exported (bmo#1867765)
• fixed: Contacts deleted from mailing list view still visible in Details view (bmo#1799362)
• fixed: After selecting contacts in Address Book and starting a new search, the search results list did not update (bmo#1812726)
• fixed: Various UX and visual improvements (bmo#1866061,bmo#18 67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185 6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
• fixed: Security fixes

• Mozilla Thunderbird 115.6.1
  • new: OAuth2 now supported for comcast.net (bmo#1844810)
  • fixed: High CPU usage sometimes occurred with IMAP CONDSTORE (conditional STORE) enabled (bmo#1839256)
  • fixed: Replying to a collapsed thread via keyboard shortcut (Ctrl+R/Cmd+R) opened a reply for every message in the thread (bmo#1866819)
  • fixed: Enabling Grouped By view after reversing sort order of column header caused messages to be grouped incorrectly (bmo#1868794)
  • fixed: Opening thread pane context menu via keyboard did not always scroll view to selection (bmo#1867532)
  • fixed: New mail indicator for POP3 accounts did not indicate new messages ready to be downloaded (bmo#1870619)
  • fixed: Messages could not be moved to folders using Message > Move To if text or a link in the message had been clicked on first (bmo#1868474)
  • fixed: MIME part boundaries were not properly terminated (bmo#1805558)

Multiple security issues were discovered in Firefox. If a user were tricked into opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service, obtain sensitive information across domains, or execute arbitrary code. (CVE-2024-0741, CVE-2024-0742, CVE-2024-0743, CVE-2024-0744, CVE-2024-0745, CVE-2024-0747, CVE-2024-0748, CVE-2024-0749, CVE-2024-0750, CVE-2024-0751, CVE-2024-0753, CVE-2024-0754, CVE-2024-0755)

Cornel Ionce discovered that Firefox did not properly manage memory when opening the print preview dialog. An attacker could potentially exploit this issue to cause a denial of service. (CVE-2024-0746)

Multiple security issues were discovered in Thunderbird. If a user were tricked into opening a specially crafted website in a browsing context, an attacker could potentially exploit these to cause a denial of service, obtain sensitive information, bypass security restrictions, cross-site tracing, or execute arbitrary code. (CVE-2024-0741, CVE-2024-0742, CVE-2024-0747, CVE-2024-0749, CVE-2024-0750, CVE-2024-0751, CVE-2024-0753, CVE-2024-0755, CVE-2024-1547, CVE-2024-1548, CVE-2024-1549, CVE-2024-1550, CVE-2024-1553, CVE-2024-1936)

Cornel Ionce discovered that Thunderbird did not properly manage memory when opening the print preview dialog. An attacker could potentially exploit this issue to cause a denial of service. (CVE-2024-0746)

Alfred Peters discovered that Thunderbird did not properly manage memory when storing and re-accessing data on a networking channel. An attacker could potentially exploit this issue to cause a denial of service. (CVE-2024-1546)

Johan Carlsson discovered that Thunderbird incorrectly handled Set-Cookie response headers in multipart HTTP responses. An attacker could potentially exploit this issue to inject arbitrary cookie values. (CVE-2024-1551)

Gary Kwong discovered that Thunderbird incorrectly generated codes on 32-bit ARM devices, which could lead to unexpected numeric conversions or undefined behaviour. An attacker could possibly use this issue to cause a denial of service. (CVE-2024-1552)