CVE-2024-1548: Medium severity Mozilla Thunderbird vulnerability

Q: What is the severity of CVE-2024-1548?

CVE-2024-1548 has a moderate severity rating due to its potential to mislead users and facilitate spoofing attacks.

Q: How do I fix CVE-2024-1548?

To fix CVE-2024-1548, users should update their Mozilla Firefox, Thunderbird, or Firefox ESR to versions that address this vulnerability.

Q: Who is affected by CVE-2024-1548?

CVE-2024-1548 affects users of Mozilla Firefox, Thunderbird, and Firefox ESR versions prior to specified safe updates.

Q: What types of attacks are possible with CVE-2024-1548?

CVE-2024-1548 could lead to user confusion and allow for spoofing attacks by obscuring fullscreen notifications.

Q: Which versions of affected software should be updated to mitigate CVE-2024-1548?

Users should update to Firefox versions 123 and above, Thunderbird versions 115.8 and above, or Firefox ESR to mitigate CVE-2024-1548.

Published Feb 20, 2024

Updated

A website could have obscured the fullscreen notification by using a dropdown select input element. This could have led to user confusion and possible spoofing attacks.

Affected Software

20 affected componentsFixes available

Mozilla Thunderbird<115.8

115.8

Mozilla Firefox<123

123

Mozilla Firefox ESR<115.8

115.8

Mozilla Firefox<115.8.0

Mozilla Firefox<123.0

Mozilla Thunderbird<115.8.0

Debian Debian Linux=10.0

redhat/firefox<115.8

115.8

redhat/thunderbird<115.8

115.8

debian/firefox-esr<115.8.0esr-1~deb12u1

115.8.0esr-1~deb12u1

debian/firefox-esr<115.8.0esr-1

115.8.0esr-1

debian/firefox-esr<115.8.0esr-1

115.8.0esr-1

debian/thunderbird<1:115.8.0-1~deb12u1

1:115.8.0-1~deb12u1

debian/thunderbird<1:115.8.0-1

1:115.8.0-1

debian/thunderbird<1:115.8.0-1

1:115.8.0-1

alpine/firefox-esr<115.8.0-r0

115.8.0-r0

alpine/firefox-esr<115.8.0-r0

115.8.0-r0

debian/firefox

160.0-1

debian/firefox-esr

140.12.0esr-1~deb12u1153.7.0esr-1~deb12u1140.15.0esr-1~deb13u1153.7.0esr-1~deb13u1153.5.1esr-1153.7.0esr-1

debian/thunderbird

1:140.12.0esr-1~deb12u11:153.7.0esr-1~deb12u11:140.12.0esr-1~deb13u11:153.7.0esr-1~deb13u11:153.5.0esr-11:153.7.0esr-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Thunderbird to a version that resolves this vulnerability.
Fixed in 115.8
Upgrade
Upgrade Firefox to a version that resolves this vulnerability.
Fixed in 123
Upgrade
Upgrade Firefox ESR to a version that resolves this vulnerability.
Fixed in 115.8
Upgrade
Upgrade redhat/firefox to a version that resolves this vulnerability.
Fixed in 115.8
Upgrade
Upgrade redhat/thunderbird to a version that resolves this vulnerability.
Fixed in 115.8
Upgrade
Upgrade debian/firefox-esr to a version that resolves this vulnerability.
Fixed in 115.8.0esr-1~deb12u1
Upgrade
Upgrade debian/firefox-esr to a version that resolves this vulnerability.
Fixed in 115.8.0esr-1
Upgrade
Upgrade debian/thunderbird to a version that resolves this vulnerability.
Fixed in 1:115.8.0-1~deb12u1
Upgrade
Upgrade debian/thunderbird to a version that resolves this vulnerability.
Fixed in 1:115.8.0-1
Upgrade
Upgrade alpine/firefox-esr to a version that resolves this vulnerability.
Fixed in 115.8.0-r0
Upgrade
Upgrade debian/firefox to a version that resolves this vulnerability.
Fixed in 160.0-1
Upgrade
Upgrade debian/firefox-esr to a version that resolves this vulnerability.
Fixed in 140.12.0esr-1~deb12u1Fixed in 153.7.0esr-1~deb12u1Fixed in 140.15.0esr-1~deb13u1Fixed in 153.7.0esr-1~deb13u1Fixed in 153.5.1esr-1Fixed in 153.7.0esr-1
Upgrade
Upgrade debian/thunderbird to a version that resolves this vulnerability.
Fixed in 1:140.12.0esr-1~deb12u1Fixed in 1:153.7.0esr-1~deb12u1Fixed in 1:140.12.0esr-1~deb13u1Fixed in 1:153.7.0esr-1~deb13u1Fixed in 1:153.5.0esr-1Fixed in 1:153.7.0esr-1
Upgrade
Upgrade Mozilla Firefox to a version that resolves this vulnerability.
Fixed in 123
Upgrade
Upgrade Mozilla Firefox ESR to a version that resolves this vulnerability.
Fixed in 115.8
Upgrade
Upgrade Mozilla Thunderbird to a version that resolves this vulnerability.
Fixed in 115.8

Event History

Feb 20, 2024

CVE Published

via Mozilla·12:00 AM

CVE Published

via MITRE·01:21 PM

Data Sourced

via MITRE·01:21 PM

DescriptionWeakness

Data Sourced

via NVD·02:15 PM

DescriptionSeverityAffected Software

Feb 21, 2024

Data Sourced

via Red Hat·04:21 PM

DescriptionSeverityAffected Software

Parent advisories

This vulnerability appears in the following advisories.

Peer vulnerabilities

Found alongside the following vulnerabilities.

Frequently Asked Questions

What is the severity of CVE-2024-1548?

CVE-2024-1548 has a moderate severity rating due to its potential to mislead users and facilitate spoofing attacks.

How do I fix CVE-2024-1548?

To fix CVE-2024-1548, users should update their Mozilla Firefox, Thunderbird, or Firefox ESR to versions that address this vulnerability.

Who is affected by CVE-2024-1548?

CVE-2024-1548 affects users of Mozilla Firefox, Thunderbird, and Firefox ESR versions prior to specified safe updates.

What types of attacks are possible with CVE-2024-1548?

CVE-2024-1548 could lead to user confusion and allow for spoofing attacks by obscuring fullscreen notifications.

Which versions of affected software should be updated to mitigate CVE-2024-1548?

Users should update to Firefox versions 123 and above, Thunderbird versions 115.8 and above, or Firefox ESR to mitigate CVE-2024-1548.

CVE-2024-1548: Medium severity Mozilla Thunderbird vulnerability

Affected Software

Remediation

Event History

Parent advisories

Peer vulnerabilities

Frequently Asked Questions

What is the severity of CVE-2024-1548?

How do I fix CVE-2024-1548?

Who is affected by CVE-2024-1548?

What types of attacks are possible with CVE-2024-1548?

Which versions of affected software should be updated to mitigate CVE-2024-1548?

Company

Resources

Contact