Linux · Security advisory · November 13, 2024

RHSA-2024:9552: thunderbird security update

RHSA-2024:9552, released November 13, 2024, fixes 11 CVEs in thunderbird (version 0:128.4.0-1.el9_5). One of them is being exploited (CVE-2024-9680); 1 on CISA KEV. Patch Radar priority: Patch now.

Patch now1 on CISA KEVKnown ransomware use
CVEs closed
11
None rated Critical
Exploited
1
CVE-2024-9680
Exploitation more likely
0
Vendor assessment
Highest EPSS
0.2318
97th percentile

Priority of the 11 CVEs

Patch now 1 Urgent 0 High 4 Routine 6

Fixed package versions

ProductReleaseFixed in
thunderbirdRHEL 90:128.4.0-1.el9_5

CVEs this fix closes

PriorityCVETitleImpactCVSSEPSSExploitation
Patch now CVE-2024-9680 Mozilla Firefox Use-After-Free Vulnerability 9.8 0.2318 KEVRansomwareExploited
High CVE-2024-10466 Mozilla Firefox ESR and 7 others: Uncontrolled Resource Consumption 7.5 0.0081 None reported
High CVE-2024-10458 Mozilla Firefox ESR and 7 others: Improper Preservation of Permissions 8.2 0.0064 None reported
High CVE-2024-10459 Mozilla Firefox ESR and 7 others: Use After Free 7.6 0.0063 None reported
High CVE-2024-10467 Mozilla Firefox ESR and 7 others: Out-of-bounds Read 8.8 0.0063 None reported
Routine CVE-2024-10463 Mozilla Firefox ESR and 7 others: Observable Discrepancy 6.5 0.0073 None reported
Routine CVE-2024-10464 Mozilla Firefox ESR and 7 others: Out-of-bounds Read 6.5 0.0064 None reported
Routine CVE-2024-10461 Mozilla Firefox ESR and 7 others: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') 6.1 0.0060 None reported
Routine CVE-2024-10462 Mozilla Firefox ESR and 7 others: Authentication Bypass by Spoofing 6.5 0.0057 None reported
Routine CVE-2024-10465 Mozilla Firefox ESR and 7 others: Authentication Bypass by Spoofing 6.5 0.0057 None reported
Routine CVE-2024-10460 Mozilla Firefox ESR and 7 others: Origin Validation Error 5.3 0.0034 None reported
Showing 1 to 11 of 11 1