CVE-2024-11692: Medium severity Mozilla Thunderbird vulnerability

Q: What is the severity of CVE-2024-11692?

CVE-2024-11692 is classified as a moderate severity vulnerability that may lead to user confusion and potential spoofing attacks.

Q: How do I fix CVE-2024-11692?

To fix CVE-2024-11692, update Microsoft Thunderbird and Firefox to version 134 or later.

Q: Which versions of software are affected by CVE-2024-11692?

CVE-2024-11692 affects Mozilla Thunderbird and Firefox versions up to 133, as well as Firefox ESR versions up to 128.5.

Q: What types of attacks does CVE-2024-11692 enable?

CVE-2024-11692 may enable spoofing attacks due to select dropdowns being displayed over other tabs.

Q: Is there a specific version for Debian that addresses CVE-2024-11692?

Yes, the fixed versions for Debian packages are firefox 134.0.2-3 and firefox-esr versions starting from 128.6.0esr.

Published Nov 26, 2024

Updated

An attacker could cause a select dropdown to be shown over another tab; this could have led to user confusion and possible spoofing attacks.

Affected Software

21 affected componentsFixes available

Mozilla Thunderbird<133

133

Mozilla Thunderbird<128.5

128.5

Mozilla Firefox<133

133

Mozilla Firefox ESR<128.5

128.5

Mozilla Firefox<128.5.0

Mozilla Firefox<133.0

Mozilla Thunderbird<128.5

Mozilla Thunderbird>=129.0<133.0

debian/firefox-esr<128.5.0esr-1~deb12u1

128.5.0esr-1~deb12u1

debian/firefox-esr<128.5.0esr-1

128.5.0esr-1

debian/firefox-esr<128.5.0esr-1

128.5.0esr-1

debian/thunderbird<1:128.5.0esr-1~deb12u1

1:128.5.0esr-1~deb12u1

debian/thunderbird<1:128.5.0esr-1

1:128.5.0esr-1

debian/thunderbird<1:128.5.0esr-1

1:128.5.0esr-1

debian/firefox

159.0-1

debian/firefox-esr

140.12.0esr-1~deb12u1153.6.0esr-1~deb12u2140.15.0esr-1~deb13u1153.6.0esr-1~deb13u1153.5.1esr-1153.6.0esr-1

debian/thunderbird

1:140.12.0esr-1~deb12u11:153.6.0esr-1~deb12u21:140.12.0esr-1~deb13u11:153.6.0esr-1~deb13u11:153.5.0esr-11:153.6.0esr-1

alpine/thunderbird>=129.0<128.5.0-r0

128.5.0-r0

alpine/thunderbird>=129.0<128.5.0-r0

128.5.0-r0

alpine/thunderbird>=129.0<128.5.0-r0

128.5.0-r0

alpine/thunderbird>=129.0<128.5.0-r0

128.5.0-r0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Thunderbird to a version that resolves this vulnerability.
Fixed in 133
Upgrade
Upgrade Thunderbird to a version that resolves this vulnerability.
Fixed in 128.5
Upgrade
Upgrade Firefox to a version that resolves this vulnerability.
Fixed in 133
Upgrade
Upgrade Firefox ESR to a version that resolves this vulnerability.
Fixed in 128.5
Upgrade
Upgrade debian/firefox-esr to a version that resolves this vulnerability.
Fixed in 128.5.0esr-1~deb12u1
Upgrade
Upgrade debian/firefox-esr to a version that resolves this vulnerability.
Fixed in 128.5.0esr-1
Upgrade
Upgrade debian/thunderbird to a version that resolves this vulnerability.
Fixed in 1:128.5.0esr-1~deb12u1
Upgrade
Upgrade debian/thunderbird to a version that resolves this vulnerability.
Fixed in 1:128.5.0esr-1
Upgrade
Upgrade debian/firefox to a version that resolves this vulnerability.
Fixed in 159.0-1
Upgrade
Upgrade debian/firefox-esr to a version that resolves this vulnerability.
Fixed in 140.12.0esr-1~deb12u1Fixed in 153.6.0esr-1~deb12u2Fixed in 140.15.0esr-1~deb13u1Fixed in 153.6.0esr-1~deb13u1Fixed in 153.5.1esr-1Fixed in 153.6.0esr-1
Upgrade
Upgrade debian/thunderbird to a version that resolves this vulnerability.
Fixed in 1:140.12.0esr-1~deb12u1Fixed in 1:153.6.0esr-1~deb12u2Fixed in 1:140.12.0esr-1~deb13u1Fixed in 1:153.6.0esr-1~deb13u1Fixed in 1:153.5.0esr-1Fixed in 1:153.6.0esr-1
Upgrade
Upgrade alpine/thunderbird to a version that resolves this vulnerability.
Fixed in 128.5.0-r0

Event History

Nov 26, 2024

CVE Published

via Mozilla·12:00 AM

CVE Published

via MITRE·01:33 PM

Data Sourced

via MITRE·01:33 PM

DescriptionWeakness

Data Sourced

via Red Hat·02:02 PM

DescriptionSeverityAffected Software

Data Sourced

via NVD·02:15 PM

DescriptionSeverityWeaknessAffected Software

Data Sourced

via OSV·02:15 PM

DescriptionSeverityAffected Software

Parent advisories

This vulnerability appears in the following advisories.

Peer vulnerabilities

Found alongside the following vulnerabilities.

Frequently Asked Questions

What is the severity of CVE-2024-11692?

CVE-2024-11692 is classified as a moderate severity vulnerability that may lead to user confusion and potential spoofing attacks.

How do I fix CVE-2024-11692?

To fix CVE-2024-11692, update Microsoft Thunderbird and Firefox to version 134 or later.

Which versions of software are affected by CVE-2024-11692?

CVE-2024-11692 affects Mozilla Thunderbird and Firefox versions up to 133, as well as Firefox ESR versions up to 128.5.

What types of attacks does CVE-2024-11692 enable?

CVE-2024-11692 may enable spoofing attacks due to select dropdowns being displayed over other tabs.

Is there a specific version for Debian that addresses CVE-2024-11692?

Yes, the fixed versions for Debian packages are firefox 134.0.2-3 and firefox-esr versions starting from 128.6.0esr.

CVE-2024-11692: Medium severity Mozilla Thunderbird vulnerability

Affected Software

Remediation

Event History

Parent advisories

Peer vulnerabilities

Frequently Asked Questions

What is the severity of CVE-2024-11692?

How do I fix CVE-2024-11692?

Which versions of software are affected by CVE-2024-11692?

What types of attacks does CVE-2024-11692 enable?

Is there a specific version for Debian that addresses CVE-2024-11692?

Company

Resources

Contact