CVE-2024-0750: High severity Mozilla Thunderbird vulnerability

Q: What is the severity of CVE-2024-0750?

CVE-2024-0750 is considered a moderate severity vulnerability due to its potential to trick users into granting permissions.

Q: How do I fix CVE-2024-0750?

To fix CVE-2024-0750, update your affected Mozilla products to the latest version, specifically 115.14.0esr or higher for Firefox ESR, and 134.0.2-2 for Debian's Firefox.

Q: Which products are affected by CVE-2024-0750?

CVE-2024-0750 affects Mozilla Thunderbird up to version 115.7, Firefox ESR up to version 115.7, and Firefox up to version 122.

Q: What kind of attack does CVE-2024-0750 enable?

CVE-2024-0750 enables an attacker to exploit popup notifications to trick users into granting inappropriate permissions.

Q: Is there a workaround for CVE-2024-0750?

There is no official workaround for CVE-2024-0750, so upgrading to a secure version is the recommended approach.

Published Jan 23, 2024

Updated

A bug in popup notifications delay calculation could have made it possible for an attacker to trick a user into granting permissions.

Affected Software

20 affected componentsFixes available

Mozilla Thunderbird<115.7

115.7

Mozilla Firefox<122

122

Mozilla Firefox ESR<115.7

115.7

Mozilla Firefox<122.0

Mozilla Firefox ESR<115.7

Mozilla Thunderbird<=115.7

Debian Debian Linux=10.0

redhat/firefox<115.7

115.7

redhat/thunderbird<115.7

115.7

debian/firefox-esr<115.7.0esr-1~deb12u1

115.7.0esr-1~deb12u1

debian/firefox-esr<115.7.0esr-1

115.7.0esr-1

debian/firefox-esr<115.7.0esr-1

115.7.0esr-1

debian/thunderbird<1:115.7.0-1~deb12u1

1:115.7.0-1~deb12u1

debian/thunderbird<1:115.7.0-1

1:115.7.0-1

debian/thunderbird<1:115.7.0-1

1:115.7.0-1

alpine/firefox-esr<115.7.0-r0

115.7.0-r0

alpine/firefox-esr<115.7.0-r0

115.7.0-r0

debian/firefox

159.0.1-1

debian/firefox-esr

140.12.0esr-1~deb12u1153.6.0esr-1~deb12u2140.15.0esr-1~deb13u1153.6.0esr-1~deb13u1153.5.1esr-1153.6.0esr-1

debian/thunderbird

1:140.12.0esr-1~deb12u11:153.6.0esr-1~deb12u21:140.12.0esr-1~deb13u11:153.6.0esr-1~deb13u11:153.5.0esr-11:153.6.0esr-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Thunderbird to a version that resolves this vulnerability.
Fixed in 115.7
Upgrade
Upgrade Firefox to a version that resolves this vulnerability.
Fixed in 122
Upgrade
Upgrade Firefox ESR to a version that resolves this vulnerability.
Fixed in 115.7
Upgrade
Upgrade redhat/firefox to a version that resolves this vulnerability.
Fixed in 115.7
Upgrade
Upgrade redhat/thunderbird to a version that resolves this vulnerability.
Fixed in 115.7
Upgrade
Upgrade debian/firefox-esr to a version that resolves this vulnerability.
Fixed in 115.7.0esr-1~deb12u1
Upgrade
Upgrade debian/firefox-esr to a version that resolves this vulnerability.
Fixed in 115.7.0esr-1
Upgrade
Upgrade debian/thunderbird to a version that resolves this vulnerability.
Fixed in 1:115.7.0-1~deb12u1
Upgrade
Upgrade debian/thunderbird to a version that resolves this vulnerability.
Fixed in 1:115.7.0-1
Upgrade
Upgrade alpine/firefox-esr to a version that resolves this vulnerability.
Fixed in 115.7.0-r0
Upgrade
Upgrade debian/firefox to a version that resolves this vulnerability.
Fixed in 159.0.1-1
Upgrade
Upgrade debian/firefox-esr to a version that resolves this vulnerability.
Fixed in 140.12.0esr-1~deb12u1Fixed in 153.6.0esr-1~deb12u2Fixed in 140.15.0esr-1~deb13u1Fixed in 153.6.0esr-1~deb13u1Fixed in 153.5.1esr-1Fixed in 153.6.0esr-1
Upgrade
Upgrade debian/thunderbird to a version that resolves this vulnerability.
Fixed in 1:140.12.0esr-1~deb12u1Fixed in 1:153.6.0esr-1~deb12u2Fixed in 1:140.12.0esr-1~deb13u1Fixed in 1:153.6.0esr-1~deb13u1Fixed in 1:153.5.0esr-1Fixed in 1:153.6.0esr-1

Event History

Jan 23, 2024

CVE Published

via Mozilla·12:00 AM

CVE Published

via MITRE·01:48 PM

Data Sourced

via MITRE·01:48 PM

DescriptionWeakness

Data Sourced

via NVD·02:15 PM

DescriptionSeverityAffected Software

Data Sourced

via Red Hat·08:55 PM

DescriptionSeverityAffected Software

Parent advisories

This vulnerability appears in the following advisories.

Peer vulnerabilities

Found alongside the following vulnerabilities.

Frequently Asked Questions

What is the severity of CVE-2024-0750?

CVE-2024-0750 is considered a moderate severity vulnerability due to its potential to trick users into granting permissions.

How do I fix CVE-2024-0750?

To fix CVE-2024-0750, update your affected Mozilla products to the latest version, specifically 115.14.0esr or higher for Firefox ESR, and 134.0.2-2 for Debian's Firefox.

Which products are affected by CVE-2024-0750?

CVE-2024-0750 affects Mozilla Thunderbird up to version 115.7, Firefox ESR up to version 115.7, and Firefox up to version 122.

What kind of attack does CVE-2024-0750 enable?

CVE-2024-0750 enables an attacker to exploit popup notifications to trick users into granting inappropriate permissions.

Is there a workaround for CVE-2024-0750?

There is no official workaround for CVE-2024-0750, so upgrading to a secure version is the recommended approach.

CVE-2024-0750: High severity Mozilla Thunderbird vulnerability

Affected Software

Remediation

Event History

Parent advisories

Peer vulnerabilities

Frequently Asked Questions

What is the severity of CVE-2024-0750?

How do I fix CVE-2024-0750?

Which products are affected by CVE-2024-0750?

What kind of attack does CVE-2024-0750 enable?

Is there a workaround for CVE-2024-0750?

Company

Resources

Contact