CVE-2024-10460: Medium severity Mozilla Thunderbird vulnerability
Last updated 4 November 2024
Other sources
The origin of an external protocol handler prompt could have been obscured using a data: URL within an iframe. This vulnerability affects Firefox < 132, Firefox ESR < 128.4, Thunderbird < 128.4, and Thunderbird < 132.
— MITRE
The origin of an external protocol handler prompt could have been obscured using a data: URL within an iframe.
— Mozilla
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/firefoxto a version that resolves this vulnerability.Fixed in 132.0.1-1 - Upgrade
Upgrade
debian/firefox-esrto a version that resolves this vulnerability.Fixed in 128.4.0esr-1~deb11u1Fixed in 128.4.0esr-1~deb12u1Fixed in 128.4.0esr-1 - Upgrade
Upgrade
debian/thunderbirdto a version that resolves this vulnerability.Fixed in 1:128.4.0esr-1~deb11u1Fixed in 1:128.4.0esr-1~deb12u1Fixed in 1:128.4.0esr-1Fixed in 1:128.4.2esr-1 - Upgrade
Upgrade
Thunderbirdto a version that resolves this vulnerability.Fixed in 128.4 - Upgrade
Upgrade
Thunderbirdto a version that resolves this vulnerability.Fixed in 132 - Upgrade
Upgrade
Firefoxto a version that resolves this vulnerability.Fixed in 132 - Upgrade
Upgrade
Firefox ESRto a version that resolves this vulnerability.Fixed in 128.4
Event History
Parent advisories
This vulnerability appears in the following advisories.
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2024-10460?
CVE-2024-10460 has been rated as a high severity vulnerability due to potential information disclosure risks.
How do I fix CVE-2024-10460?
To fix CVE-2024-10460, update Mozilla Firefox to version 132 or later and Thunderbird to version 128.4 or later.
Which versions are affected by CVE-2024-10460?
CVE-2024-10460 affects Firefox versions prior to 132, Firefox ESR versions prior to 128.4, and Thunderbird versions prior to 132.
What products does CVE-2024-10460 impact?
CVE-2024-10460 impacts Mozilla Firefox, Firefox ESR, and Mozilla Thunderbird.
Does CVE-2024-10460 allow remote code execution?
No, CVE-2024-10460 does not allow remote code execution but may expose users to phishing attacks.