CVE-2024-1936

The encrypted subject of an email message could be incorrectly and permanently assigned to an arbitrary other email message in Thunderbird's local cache. Consequently, when replying to the contaminated email message, the user might accidentally leak the confidential subject to a third-party. While this update fixes the bug and avoids future message contamination, it does not automatically repair existing contaminations. Users are advised to use the repair folder functionality, which is available from the context menu of email folders, which will erase incorrect subject assignments. This vulnerability affects Thunderbird < 115.8.1.

Mozilla Thunderbird is a standalone mail and newsgroup client.

This update upgrades Thunderbird to version 115.9.0.

Security Fix(es):

• nss: timing attack against RSA decryption (CVE-2023-5388)
• Mozilla: Crash in NSS TLS method (CVE-2024-0743)
• Mozilla: Leaking of encrypted email subjects to other conversations (CVE-2024-1936)
• Mozilla: JIT code failed to save return registers on Armv7-A (CVE-2024-2607)
• Mozilla: Integer overflow could have led to out of bounds write (CVE-2024-2608)
• Mozilla: Improper handling of html and body tags enabled CSP nonce leakage (CVE-2024-2610)
• Mozilla: Clickjacking vulnerability could have led to a user accidentally granting permissions (CVE-2024-2611)
• Mozilla: Self referencing object could have potentially led to a use-after-free (CVE-2024-2612)
• Mozilla: Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9, and Thunderbird 115.9 (CVE-2024-2614)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Mozilla Thunderbird is a standalone mail and newsgroup client.

This update upgrades Thunderbird to version 115.9.0.

Security Fix(es):

• nss: timing attack against RSA decryption (CVE-2023-5388)
• Mozilla: Crash in NSS TLS method (CVE-2024-0743)
• Mozilla: Leaking of encrypted email subjects to other conversations (CVE-2024-1936)
• Mozilla: JIT code failed to save return registers on Armv7-A (CVE-2024-2607)
• Mozilla: Integer overflow could have led to out of bounds write (CVE-2024-2608)
• Mozilla: Improper handling of html and body tags enabled CSP nonce leakage (CVE-2024-2610)
• Mozilla: Clickjacking vulnerability could have led to a user accidentally granting permissions (CVE-2024-2611)
• Mozilla: Self referencing object could have potentially led to a use-after-free (CVE-2024-2612)
• Mozilla: Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9, and Thunderbird 115.9 (CVE-2024-2614)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Mozilla fixed some bugs and security vulnerability CVE-2024-1936

These are all security issues fixed in the MozillaThunderbird-115.8.1-1.1 package on the GA media of openSUSE Tumbleweed.

Mozilla Thunderbird is a standalone mail and newsgroup client.

This update upgrades Thunderbird to version 115.9.0.

Security Fix(es):

• nss: timing attack against RSA decryption (CVE-2023-5388)

• Mozilla: Crash in NSS TLS method (CVE-2024-0743)

• Mozilla: Leaking of encrypted email subjects to other conversations (CVE-2024-1936)

• Mozilla: JIT code failed to save return registers on Armv7-A (CVE-2024-2607)

• Mozilla: Integer overflow could have led to out of bounds write (CVE-2024-2608)

• Mozilla: Improper handling of html and body tags enabled CSP nonce leakage (CVE-2024-2610)

• Mozilla: Clickjacking vulnerability could have led to a user accidentally granting permissions (CVE-2024-2611)

• Mozilla: Self referencing object could have potentially led to a use-after-free (CVE-2024-2612)

• Mozilla: Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9, and Thunderbird 115.9 (CVE-2024-2614)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

This update for MozillaThunderbird fixes the following issues:

Security Vulnerabilities fixed in Thunderbird 115.8.1 (bsc#1221054):

• CVE-2024-1936: Fixed leaking of encrypted email subjects to other conversations (MFSA 2024-11) (bsc#1221054).

Multiple security issues were discovered in Thunderbird. If a user were tricked into opening a specially crafted website in a browsing context, an attacker could potentially exploit these to cause a denial of service, obtain sensitive information, bypass security restrictions, cross-site tracing, or execute arbitrary code. (CVE-2024-0741, CVE-2024-0742, CVE-2024-0747, CVE-2024-0749, CVE-2024-0750, CVE-2024-0751, CVE-2024-0753, CVE-2024-0755, CVE-2024-1547, CVE-2024-1548, CVE-2024-1549, CVE-2024-1550, CVE-2024-1553, CVE-2024-1936)

Cornel Ionce discovered that Thunderbird did not properly manage memory when opening the print preview dialog. An attacker could potentially exploit this issue to cause a denial of service. (CVE-2024-0746)

Alfred Peters discovered that Thunderbird did not properly manage memory when storing and re-accessing data on a networking channel. An attacker could potentially exploit this issue to cause a denial of service. (CVE-2024-1546)

Johan Carlsson discovered that Thunderbird incorrectly handled Set-Cookie response headers in multipart HTTP responses. An attacker could potentially exploit this issue to inject arbitrary cookie values. (CVE-2024-1551)

Gary Kwong discovered that Thunderbird incorrectly generated codes on 32-bit ARM devices, which could lead to unexpected numeric conversions or undefined behaviour. An attacker could possibly use this issue to cause a denial of service. (CVE-2024-1552)