Windows apps · Application version · February 21, 2024
Mozilla Thunderbird (en-US) 115.8.0
Mozilla Thunderbird (en-US) 115.8.0, released February 21, 2024, fixes 120 CVEs in Mozilla Thunderbird (en-US). 2 of them are being exploited (CVE-2023-4863); 2 on CISA KEV. Patch Radar priority: Patch now. The latest Mozilla Thunderbird (en-US) is 159.0, which also fixes every one of these CVEs.
Patch now2 on CISA KEV2 publicly disclosed
Superseded. The latest Mozilla Thunderbird (en-US) is 159.0, which also fixes every CVE on this page. Install that instead.
CVEs closed
120
7 rated Critical
Exploited
2
CVE-2023-4863
Highest CVSS
9.8
Base score, 0 to 10
Highest EPSS
0.9998
99th percentile
Priority of the 120 CVEs
Patch now 2
Urgent 7
High 85
Routine 26
Applies to
| Product | Version |
|---|---|
| Mozilla Thunderbird (en-US) | 115.8.0 |
CVEs this fix closes
| Priority | CVE | Title | CVSS | EPSS | Exploitation |
|---|---|---|---|---|---|
| Patch now | CVE-2023-4863 | Chromium: CVE-2023-4863 Heap buffer overflow in WebP | 9.6 | 0.9998 | KEVDisclosedExploited |
| Patch now | CVE-2023-5217 | Chromium: CVE-2023-5217 Heap buffer overflow in vp8 encoding in libvpx | 8.8 | 0.4901 | KEVDisclosedExploited |
| Urgent | CVE-2023-5176 | Mozilla Firefox ESR and 5 others: Out-of-bounds Write | 9.8 | 0.0139 | None reported |
| Urgent | CVE-2023-5174 | Mozilla Firefox ESR and 5 others: Use After Free | 9.8 | 0.0120 | None reported |
| Urgent | CVE-2023-5168 | Mozilla Firefox ESR and 5 others: Out-of-bounds Write | 9.8 | 0.0112 | None reported |
| Urgent | CVE-2023-29542 | Mozilla Firefox and 4 others: A newline in a filename could have been used to bypass the file extension security mechanisms that replace… | 9.8 | 0.0094 | None reported |
| Urgent | CVE-2023-34416 | Mozilla Firefox and 4 others: Memory safety bugs present in Firefox 113, Firefox ESR 102.11, and Thunderbird 102.12. | 9.8 | 0.0093 | None reported |
| Urgent | CVE-2023-4057 | Mozilla Firefox ESR and 5 others: Memory safety bugs present in Firefox 115, Firefox ESR 115.0, and Thunderbird 115.0. | 9.8 | 0.0089 | None reported |
| Urgent | CVE-2024-2614 | Mozilla Firefox ESR and 5 others: Out-of-bounds Write | 8.8 | 0.0089 | None reported |
| High | CVE-2023-6856 | Mozilla Firefox ESR and 5 others: The WebGL `DrawElementsInstanced` method was susceptible to a heap buffer overflow when used on systems… | 8.8 | 0.2063 | None reported |
| High | CVE-2024-0741 | Mozilla Firefox ESR and 5 others: Out-of-bounds Write | 7.5 | 0.0216 | None reported |
| High | CVE-2023-6858 | Mozilla Firefox ESR and 5 others: Out-of-bounds Write | 8.8 | 0.0154 | None reported |
| High | CVE-2023-5730 | Mozilla Firefox ESR and 5 others: Memory safety bugs present in Firefox 118, Firefox ESR 115.3, and Thunderbird 115.3. | 9.8 | 0.0154 | None reported |
| High | CVE-2023-5724 | Mozilla Firefox ESR and 5 others: Uncontrolled Resource Consumption | 7.5 | 0.0152 | None reported |
| High | CVE-2023-6861 | Mozilla Firefox ESR and 5 others: The `nsWindow::PickerOpen(void)` method was susceptible to a heap buffer overflow when running in headless… | 8.8 | 0.0141 | None reported |
| High | CVE-2023-5728 | Mozilla Firefox ESR and 5 others: Use After Free | 7.5 | 0.0132 | None reported |
| High | CVE-2023-6864 | Mozilla Firefox ESR and 5 others: Memory safety bugs present in Firefox 120, Firefox ESR 115.5, and Thunderbird 115.5. | 8.8 | 0.0119 | None reported |
| High | CVE-2023-6859 | Mozilla Firefox ESR and 5 others: A use-after-free condition affected TLS socket creation when under memory pressure. | 8.8 | 0.0109 | None reported |
| High | CVE-2023-6863 | Mozilla Firefox ESR and 5 others: The `ShutdownObserver()` was susceptible to potentially undefined behavior due to its reliance on a dynamic… | 8.8 | 0.0104 | None reported |
| High | CVE-2023-6862 | Mozilla Thunderbird and 1 other: A use-after-free was identified in the `nsDNSService::Init`. | 8.8 | 0.0095 | None reported |
| High | CVE-2023-6212 | Mozilla Firefox ESR and 5 others: Memory safety bugs present in Firefox 119, Firefox ESR 115.4, and Thunderbird 115.4. | 8.8 | 0.0095 | None reported |
| High | CVE-2023-32214 | Mozilla Firefox and 4 others: Protocol handlers `ms-cxh` and `ms-cxh-full` could have been leveraged to trigger a denial of service. | 7.5 | 0.0092 | None reported |
| High | CVE-2023-6207 | Mozilla Firefox ESR and 5 others: Ownership mismanagement led to a use-after-free in ReadableByteStreams This vulnerability affects Firefox… | 8.8 | 0.0091 | None reported |
| High | CVE-2023-34414 | Mozilla Firefox and 4 others: The error page for sites with invalid TLS certificates was missing the activation-delay Firefox uses… | 9.8 | 0.0090 | None reported |
| High | CVE-2023-6208 | Mozilla Firefox ESR and 5 others: When using X11, text selected by the page using the Selection API was erroneously copied into the primary… | 8.8 | 0.0089 | None reported |
Showing 1 to 25 of 120
1Next
Patch Radar data is free to use with attribution. Terms and how to credit it.
Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.