CVE-2024-1550: Medium severity Mozilla Thunderbird vulnerability
A malicious website could have used a combination of exiting fullscreen mode and requestPointerLock to cause the user's mouse to be re-positioned unexpectedly, which could have led to user confusion and inadvertently granting permissions they did not intend to grant.
External Reference: https://www.mozilla.org/en-US/security/advisories/mfsa2024-06/#CVE-2024-1550
Other sources
A malicious website could have used a combination of exiting fullscreen mode and requestPointerLock to cause the user's mouse to be re-positioned unexpectedly, which could have led to user confusion and inadvertently granting permissions they did not intend to grant. This vulnerability affects Firefox < 123, Firefox ESR < 115.8, and Thunderbird < 115.8.
— Launchpad
A malicious website could have used a combination of exiting fullscreen mode and requestPointerLock to cause the user's mouse to be re-positioned unexpectedly, which could have led to user confusion and inadvertently granting permissions they did not intend to grant.
— Mozilla
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Thunderbirdto a version that resolves this vulnerability.Fixed in 115.8 - Upgrade
Upgrade
Firefoxto a version that resolves this vulnerability.Fixed in 123 - Upgrade
Upgrade
Firefox ESRto a version that resolves this vulnerability.Fixed in 115.8 - Upgrade
Upgrade
redhat/firefoxto a version that resolves this vulnerability.Fixed in 115.8 - Upgrade
Upgrade
redhat/thunderbirdto a version that resolves this vulnerability.Fixed in 115.8 - Upgrade
Upgrade
debian/firefox-esrto a version that resolves this vulnerability.Fixed in 115.8.0esr-1~deb12u1 - Upgrade
Upgrade
debian/firefox-esrto a version that resolves this vulnerability.Fixed in 115.8.0esr-1 - Upgrade
Upgrade
debian/thunderbirdto a version that resolves this vulnerability.Fixed in 1:115.8.0-1~deb12u1 - Upgrade
Upgrade
debian/thunderbirdto a version that resolves this vulnerability.Fixed in 1:115.8.0-1 - Upgrade
Upgrade
alpine/firefox-esrto a version that resolves this vulnerability.Fixed in 115.8.0-r0 - Upgrade
Upgrade
debian/firefoxto a version that resolves this vulnerability.Fixed in 160.0-1 - Upgrade
Upgrade
debian/firefox-esrto a version that resolves this vulnerability.Fixed in 140.12.0esr-1~deb12u1Fixed in 153.7.0esr-1~deb12u1Fixed in 140.15.0esr-1~deb13u1Fixed in 153.7.0esr-1~deb13u1Fixed in 153.5.1esr-1Fixed in 153.7.0esr-1 - Upgrade
Upgrade
debian/thunderbirdto a version that resolves this vulnerability.Fixed in 1:140.12.0esr-1~deb12u1Fixed in 1:153.7.0esr-1~deb12u1Fixed in 1:140.12.0esr-1~deb13u1Fixed in 1:153.7.0esr-1~deb13u1Fixed in 1:153.5.0esr-1Fixed in 1:153.7.0esr-1 - Upgrade
Upgrade
Mozilla Firefoxto a version that resolves this vulnerability.Fixed in 123 - Upgrade
Upgrade
Mozilla Firefox ESRto a version that resolves this vulnerability.Fixed in 115.8 - Upgrade
Upgrade
Mozilla Thunderbirdto a version that resolves this vulnerability.Fixed in 115.8
Event History
Parent advisories
This vulnerability appears in the following advisories.
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2024-1550?
CVE-2024-1550 is classified as a medium severity vulnerability, as it can lead to unintentional user actions and permissions granted without consent.
How do I fix CVE-2024-1550?
To mitigate CVE-2024-1550, users should update their Mozilla Firefox to version 123 or later, or Thunderbird to version 115.8 or later.
Which software is affected by CVE-2024-1550?
CVE-2024-1550 affects Mozilla Firefox versions prior to 123, Thunderbird prior to 115.8, and Firefox ESR versions before 115.8.
What happens if I don't fix CVE-2024-1550?
If CVE-2024-1550 is not addressed, users may experience unexpected mouse behavior leading to possible security risks and unintentional actions.
Is there a workaround for CVE-2024-1550?
Currently, there is no known workaround for CVE-2024-1550 other than updating to the latest versions of the affected software.