CVE-2024-8394

Mozilla Thunderbird is a standalone mail and newsgroup client.

Security Fix(es):

• thunderbird: 115.15/128.2 ()
• mozilla: Type confusion when looking up a property name in a "with" block (CVE-2024-8381)
• mozilla: Internal event interfaces were exposed to web content when browser EventHandler listener callbacks ran (CVE-2024-8382)
• mozilla: Garbage collection could mis-color cross-compartment objects in OOM conditions (CVE-2024-8384)
• mozilla: WASM type confusion involving ArrayTypes (CVE-2024-8385)
• mozilla: SelectElements could be shown over another site if popups are allowed (CVE-2024-8386)
• mozilla: Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2, and Thunderbird 128.2 (CVE-2024-8387)
• thunderbird: Crash when aborting verification of OTR chat (CVE-2024-8394)
• mozilla: Type Confusion in Async Generators in Javascript Engine (CVE-2024-7652)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Mozilla Thunderbird is a standalone mail and newsgroup client.

Security Fix(es):

• thunderbird: 115.15/128.2 ()
• mozilla: Type confusion when looking up a property name in a "with" block (CVE-2024-8381)
• mozilla: Internal event interfaces were exposed to web content when browser EventHandler listener callbacks ran (CVE-2024-8382)
• mozilla: Garbage collection could mis-color cross-compartment objects in OOM conditions (CVE-2024-8384)
• mozilla: WASM type confusion involving ArrayTypes (CVE-2024-8385)
• mozilla: SelectElements could be shown over another site if popups are allowed (CVE-2024-8386)
• mozilla: Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2, and Thunderbird 128.2 (CVE-2024-8387)
• thunderbird: Crash when aborting verification of OTR chat (CVE-2024-8394)
• mozilla: Type Confusion in Async Generators in Javascript Engine (CVE-2024-7652)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

• rebase from Thunderbird 115.4.1 to 140.12.0 ESR

• CVE-2022-3032: When receiving an HTML email that contained an iframe element, which used a srcdoc attribute to define the inner HTML document, remote objects specified in the nested document, for example images or videos, were not blocked

• CVE-2023-0430: Certificate OCSP revocation status was not checked when verifying S/Mime signatures

• CVE-2023-0547: OCSP revocation status of recipient certificates was not checked when sending S/Mime encrypted email, and revoked certificates would be accepted

• CVE-2023-0616: If a MIME email combines OpenPGP and OpenPGP MIME data in a certain way Thunderbird repeatedly attempts to process and display the message, which could cause Thunderbird's user interface to lock up and no longer respond to the user's actions

• CVE-2023-1945: Unexpected data returned from the Safe Browsing API could have led to memory corruption and a potentially exploitable crash

• CVE-2023-4573: When receiving rendering data over IPC mStream could have been destroyed when initialized, which could have led to a use-after-free causing a potentially exploitable crash

• CVE-2023-4574: When creating a callback over IPC for showing the Color Picker window, multiple of the same callbacks could have been created at a time and eventually all simultaneously destroyed as soon as one of the callbacks finished

• CVE-2023-4575: When creating a callback over IPC for showing the File Picker window, multiple of the same callbacks could have been created at a time and eventually all simultaneously destroyed as soon as one of the callbacks finished

• CVE-2023-4577: When UpdateRegExpStatics attempted to access initialStringHeap it could already have been garbage collected prior to entering the function, which could potentially have led to an exploitable crash

• CVE-2023-4578: When calling JS::CheckRegExpSyntax a Syntax Error could have been set which would end in calling convertToRuntimeErrorAndClear. A path in the function could attempt to allocate memory when none is available which would have caused a newly created Out of Memory exception to be mishandled as a Syntax Error

• CVE-2023-4580: Push notifications stored on disk in private browsing mode were not being encrypted potentially allowing the leak of sensitive information

• CVE-2023-4581: Excel .xll add-in files did not have a blocklist entry in Firefox's executable blocklist which allowed them to be downloaded without any warning of their potential harm

• CVE-2023-5169: A compromised content process could have provided malicious data in a PathRecording resulting in an out-of-bounds write, leading to a potentially exploitable crash in a privileged process

• CVE-2023-5171: During Ion compilation, a Garbage Collection could have resulted in a use-after-free condition, allowing an attacker to write two NUL bytes, and cause a potentially exploitable crash

• CVE-2023-5724: Drivers are not always robust to extremely large draw calls and in some cases this scenario could have led to a crash

• CVE-2023-5725: A malicious installed WebExtension could open arbitrary URLs, which under the right circumstance could be leveraged to collect sensitive user data

• CVE-2023-5732: An attacker could have created a malicious link using bidirectional characters to spoof the location in the address bar when visited

• CVE-2023-6204: On some systems—depending on the graphics settings and drivers—it was possible to force an out-of-bounds read and leak memory data into the images created on the canvas element

• CVE-2023-6205: It was possible to cause the use of a MessagePort after it had already been freed, which could potentially have led to an exploitable crash

• CVE-2023-6206: The black fade animation when exiting fullscreen is roughly the length of the anti-clickjacking delay on permission prompts

• CVE-2023-6207: Ownership…

Mozilla Thunderbird is a standalone mail and newsgroup client.

Security Fix(es):

• thunderbird: 115.15/128.2 ()

• mozilla: Type confusion when looking up a property name in a "with" block (CVE-2024-8381)

• mozilla: Internal event interfaces were exposed to web content when browser EventHandler listener callbacks ran (CVE-2024-8382)

• mozilla: Garbage collection could mis-color cross-compartment objects in OOM conditions (CVE-2024-8384)

• mozilla: WASM type confusion involving ArrayTypes (CVE-2024-8385)

• mozilla: SelectElements could be shown over another site if popups are allowed (CVE-2024-8386)

• mozilla: Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2, and Thunderbird 128.2 (CVE-2024-8387)

• thunderbird: Crash when aborting verification of OTR chat (CVE-2024-8394)

• mozilla: Type Confusion in Async Generators in Javascript Engine (CVE-2024-7652)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Mozilla Thunderbird is a standalone mail and newsgroup client.

Security Fix(es):

• thunderbird: 115.15/128.2 ()

• mozilla: Type confusion when looking up a property name in a "with" block (CVE-2024-8381)

• mozilla: Internal event interfaces were exposed to web content when browser EventHandler listener callbacks ran (CVE-2024-8382)

• mozilla: Garbage collection could mis-color cross-compartment objects in OOM conditions (CVE-2024-8384)

• mozilla: WASM type confusion involving ArrayTypes (CVE-2024-8385)

• mozilla: SelectElements could be shown over another site if popups are allowed (CVE-2024-8386)

• mozilla: Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2, and Thunderbird 128.2 (CVE-2024-8387)

• thunderbird: Crash when aborting verification of OTR chat (CVE-2024-8394)

• mozilla: Type Confusion in Async Generators in Javascript Engine (CVE-2024-7652)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

This update for MozillaThunderbird fixes the following issues:

• Mozilla Thunderbird 128.2.3 MFSA 2024-43 (bsc#1229821)
  • CVE-2024-8394: Crash when aborting verification of OTR chat.
  • CVE-2024-8385: WASM type confusion involving ArrayTypes.
  • CVE-2024-8381: Type confusion when looking up a property name in a 'with' block.
  • CVE-2024-8382: Internal event interfaces were exposed to web content when browser EventHandler listener callbacks ran.
  • CVE-2024-8384: Garbage collection could mis-color cross-compartment objects in OOM conditions.
  • CVE-2024-8386: SelectElements could be shown over another site if popups are allowed.
  • CVE-2024-8387: Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2, and Thunderbird 128.2. MFSA 2024-37 (bsc#1228648)
  • CVE-2024-7518: Fullscreen notification dialog can be obscured by document content.
  • CVE-2024-7519: Out of bounds memory access in graphics shared memory handling.
  • CVE-2024-7520: Type confusion in WebAssembly.
  • CVE-2024-7521: Incomplete WebAssembly exception handing.
  • CVE-2024-7522: Out of bounds read in editor component.
  • CVE-2024-7525: Missing permission check when creating a StreamFilter.
  • CVE-2024-7526: Uninitialized memory used by WebGL.
  • CVE-2024-7527: Use-after-free in JavaScript garbage collection.
  • CVE-2024-7528: Use-after-free in IndexedDB.
  • CVE-2024-7529: Document content could partially obscure security prompts. MFSA 2024-32 (bsc#1226316)
  • CVE-2024-6606: Out-of-bounds read in clipboard component.
  • CVE-2024-6607: Leaving pointerlock by pressing the escape key could be prevented.
  • CVE-2024-6608: Cursor could be moved out of the viewport using pointerlock.
  • CVE-2024-6609: Memory corruption in NSS.
  • CVE-2024-6610: Form validation popups could block exiting full-screen mode.
  • CVE-2024-6600: Memory corruption in WebGL API.
  • CVE-2024-6601: Race condition in permission assignment.
  • CVE-2024-6602: Memory corruption in NSS.
  • CVE-2024-6603: Memory corruption in thread creation.
  • CVE-2024-6611: Incorrect handling of SameSite cookies.
  • CVE-2024-6612: CSP violation leakage when using devtools.
  • CVE-2024-6613: Incorrect listing of stack frames.
  • CVE-2024-6614: Incorrect listing of stack frames.
  • CVE-2024-6604: Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13, Thunderbird 128, and Thunderbird 115.13.
  • CVE-2024-6615: Memory safety bugs fixed in Firefox 128 and Thunderbird 128.

Bug fixes:

• Recommend libfido2-udev in order to try to get security keys (e.g. Yubikeys) working out of the box. (bsc#1184272)