CVE-2024-10463: High severity Mozilla Thunderbird vulnerability

Q: What is the severity of CVE-2024-10463?

The severity of CVE-2024-10463 is considered high due to the potential for video frame leakage between origins.

Q: How do I fix CVE-2024-10463?

To fix CVE-2024-10463, upgrade to Firefox version 132 or higher, Firefox ESR version 128.4 or higher, or Thunderbird version 132 or higher.

Q: Which software is affected by CVE-2024-10463?

CVE-2024-10463 affects Firefox versions below 132, Firefox ESR versions below 128.4 and 115.17, and Thunderbird versions below 132.

Q: What are the risks associated with CVE-2024-10463?

The risks associated with CVE-2024-10463 include unauthorized access to potentially sensitive video frame data due to origin leaking.

Q: Is there a known exploit for CVE-2024-10463?

As of now, there are no public exploits available for CVE-2024-10463, but the vulnerability's existence poses a significant risk.

Published Oct 29, 2024

Updated

Last updated 6 November 2024

Other sources

Video frames could have been leaked between origins in some situations.

— Mozilla

Affected Software

22 affected componentsFixes available

Mozilla Thunderbird<128.4

128.4

Mozilla Thunderbird<132

132

Mozilla Firefox<115.17.0

Mozilla Firefox<132.0

Mozilla Firefox>=128.1.0<128.4.0

Mozilla Thunderbird<128.4.0

Mozilla Thunderbird>=129.0<132.0

Mozilla Firefox<132

132

Mozilla Firefox ESR<128.4

128.4

Mozilla Firefox ESR<115.17

115.17

debian/firefox-esr<128.4.0esr-1~deb12u1

128.4.0esr-1~deb12u1

debian/firefox-esr<128.4.0esr-1

128.4.0esr-1

debian/firefox-esr<128.4.0esr-1

128.4.0esr-1

debian/thunderbird<1:128.4.0esr-1~deb12u1

1:128.4.0esr-1~deb12u1

debian/thunderbird<1:128.4.0esr-1

1:128.4.0esr-1

debian/thunderbird<1:128.4.0esr-1

1:128.4.0esr-1

alpine/firefox-esr<115.17.0-r0

115.17.0-r0

alpine/firefox-esr<115.17.0-r0

115.17.0-r0

alpine/firefox-esr<115.17.0-r0

115.17.0-r0

debian/firefox

160.0-1

debian/firefox-esr

140.12.0esr-1~deb12u1153.7.0esr-1~deb12u1140.15.0esr-1~deb13u1153.6.0esr-1~deb13u1153.5.1esr-1153.7.0esr-1

debian/thunderbird

1:140.12.0esr-1~deb12u11:153.6.0esr-1~deb12u21:140.12.0esr-1~deb13u11:153.6.0esr-1~deb13u11:153.5.0esr-11:153.7.0esr-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Thunderbird to a version that resolves this vulnerability.
Fixed in 128.4
Upgrade
Upgrade Thunderbird to a version that resolves this vulnerability.
Fixed in 132
Upgrade
Upgrade Firefox to a version that resolves this vulnerability.
Fixed in 132
Upgrade
Upgrade Firefox ESR to a version that resolves this vulnerability.
Fixed in 128.4
Upgrade
Upgrade Firefox ESR to a version that resolves this vulnerability.
Fixed in 115.17
Upgrade
Upgrade debian/firefox-esr to a version that resolves this vulnerability.
Fixed in 128.4.0esr-1~deb12u1
Upgrade
Upgrade debian/firefox-esr to a version that resolves this vulnerability.
Fixed in 128.4.0esr-1
Upgrade
Upgrade debian/thunderbird to a version that resolves this vulnerability.
Fixed in 1:128.4.0esr-1~deb12u1
Upgrade
Upgrade debian/thunderbird to a version that resolves this vulnerability.
Fixed in 1:128.4.0esr-1
Upgrade
Upgrade alpine/firefox-esr to a version that resolves this vulnerability.
Fixed in 115.17.0-r0
Upgrade
Upgrade debian/firefox to a version that resolves this vulnerability.
Fixed in 160.0-1
Upgrade
Upgrade debian/firefox-esr to a version that resolves this vulnerability.
Fixed in 140.12.0esr-1~deb12u1Fixed in 153.7.0esr-1~deb12u1Fixed in 140.15.0esr-1~deb13u1Fixed in 153.6.0esr-1~deb13u1Fixed in 153.5.1esr-1Fixed in 153.7.0esr-1
Upgrade
Upgrade debian/thunderbird to a version that resolves this vulnerability.
Fixed in 1:140.12.0esr-1~deb12u1Fixed in 1:153.6.0esr-1~deb12u2Fixed in 1:140.12.0esr-1~deb13u1Fixed in 1:153.6.0esr-1~deb13u1Fixed in 1:153.5.0esr-1Fixed in 1:153.7.0esr-1

Event History

Oct 29, 2024

CVE Published

via Mozilla·12:00 AM

CVE Published

via MITRE·12:19 PM

Data Sourced

via MITRE·12:19 PM

DescriptionWeakness

Data Sourced

via Red Hat·01:02 PM

DescriptionSeverityAffected Software

Data Sourced

via NVD·01:15 PM

DescriptionSeverityWeaknessAffected Software

Data Sourced

via OSV·01:15 PM

DescriptionSeverityAffected Software

Parent advisories

This vulnerability appears in the following advisories.

Peer vulnerabilities

Found alongside the following vulnerabilities.

Frequently Asked Questions

What is the severity of CVE-2024-10463?

The severity of CVE-2024-10463 is considered high due to the potential for video frame leakage between origins.

How do I fix CVE-2024-10463?

To fix CVE-2024-10463, upgrade to Firefox version 132 or higher, Firefox ESR version 128.4 or higher, or Thunderbird version 132 or higher.

Which software is affected by CVE-2024-10463?

CVE-2024-10463 affects Firefox versions below 132, Firefox ESR versions below 128.4 and 115.17, and Thunderbird versions below 132.

What are the risks associated with CVE-2024-10463?

The risks associated with CVE-2024-10463 include unauthorized access to potentially sensitive video frame data due to origin leaking.

Is there a known exploit for CVE-2024-10463?

As of now, there are no public exploits available for CVE-2024-10463, but the vulnerability's existence poses a significant risk.

CVE-2024-10463: High severity Mozilla Thunderbird vulnerability

Other sources

Affected Software

Remediation

Event History

Parent advisories

Peer vulnerabilities

Frequently Asked Questions

What is the severity of CVE-2024-10463?

How do I fix CVE-2024-10463?

Which software is affected by CVE-2024-10463?

What are the risks associated with CVE-2024-10463?

Is there a known exploit for CVE-2024-10463?

Company

Resources

Contact