CVE-2024-2609: Medium severity Mozilla Thunderbird vulnerability

Q: What is the severity of CVE-2024-2609?

CVE-2024-2609 has been rated as a high-severity vulnerability due to its potential for clickjacking attacks.

Q: How do I fix CVE-2024-2609?

To remediate CVE-2024-2609, update to the latest version of affected software such as Firefox, Firefox ESR, or Thunderbird.

Q: Who is affected by CVE-2024-2609?

CVE-2024-2609 affects users of Firefox, Firefox ESR, Thunderbird, and their respective packages on various platforms.

Q: What type of vulnerability is CVE-2024-2609?

CVE-2024-2609 is a clickjacking vulnerability that can be exploited when the permission prompt input delay expires.

Q: What versions are vulnerable to CVE-2024-2609?

Versions of Firefox up to 124, Firefox ESR up to 115.10, and Thunderbird up to 115.10 are vulnerable to CVE-2024-2609.

Published Mar 19, 2024

Updated

Last updated 24 July 2024

Other sources

The permission prompt input delay could expire while the window is not in focus. This makes it vulnerable to clickjacking by malicious websites.

— Mozilla

The permission prompt input delay could have expired while the window is not in focus, which made the prompt vulnerable to clickjacking by malicious websites.

— Mozilla

Affected Software

18 affected componentsFixes available

Mozilla Thunderbird<115.10

115.10

Mozilla Firefox<124

124

Mozilla Firefox ESR<115.10

115.10

Mozilla Firefox<115.10.0

Mozilla Firefox<124.0

Mozilla Thunderbird<115.10.0

Debian Debian Linux=10.0

redhat/firefox<115.10

115.10

redhat/thunderbird<115.10

115.10

debian/firefox-esr<115.10.0esr-1~deb12u1

115.10.0esr-1~deb12u1

debian/firefox-esr<115.10.0esr-1

115.10.0esr-1

debian/firefox-esr<115.10.0esr-1

115.10.0esr-1

debian/thunderbird<1:115.10.1-1~deb12u1

1:115.10.1-1~deb12u1

debian/thunderbird<1:115.10.1-1

1:115.10.1-1

debian/thunderbird<1:115.10.1-1

1:115.10.1-1

debian/firefox

160.0-1

debian/firefox-esr

140.12.0esr-1~deb12u1153.7.0esr-1~deb12u1140.15.0esr-1~deb13u1153.7.0esr-1~deb13u1153.5.1esr-1153.7.0esr-1

debian/thunderbird

1:140.12.0esr-1~deb12u11:153.7.0esr-1~deb12u11:140.12.0esr-1~deb13u11:153.7.0esr-1~deb13u11:153.5.0esr-11:153.7.0esr-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Thunderbird to a version that resolves this vulnerability.
Fixed in 115.10
Upgrade
Upgrade Firefox to a version that resolves this vulnerability.
Fixed in 124
Upgrade
Upgrade Firefox ESR to a version that resolves this vulnerability.
Fixed in 115.10
Upgrade
Upgrade redhat/firefox to a version that resolves this vulnerability.
Fixed in 115.10
Upgrade
Upgrade redhat/thunderbird to a version that resolves this vulnerability.
Fixed in 115.10
Upgrade
Upgrade debian/firefox-esr to a version that resolves this vulnerability.
Fixed in 115.10.0esr-1~deb12u1
Upgrade
Upgrade debian/firefox-esr to a version that resolves this vulnerability.
Fixed in 115.10.0esr-1
Upgrade
Upgrade debian/thunderbird to a version that resolves this vulnerability.
Fixed in 1:115.10.1-1~deb12u1
Upgrade
Upgrade debian/thunderbird to a version that resolves this vulnerability.
Fixed in 1:115.10.1-1
Upgrade
Upgrade debian/firefox to a version that resolves this vulnerability.
Fixed in 160.0-1
Upgrade
Upgrade debian/firefox-esr to a version that resolves this vulnerability.
Fixed in 140.12.0esr-1~deb12u1Fixed in 153.7.0esr-1~deb12u1Fixed in 140.15.0esr-1~deb13u1Fixed in 153.7.0esr-1~deb13u1Fixed in 153.5.1esr-1Fixed in 153.7.0esr-1
Upgrade
Upgrade debian/thunderbird to a version that resolves this vulnerability.
Fixed in 1:140.12.0esr-1~deb12u1Fixed in 1:153.7.0esr-1~deb12u1Fixed in 1:140.12.0esr-1~deb13u1Fixed in 1:153.7.0esr-1~deb13u1Fixed in 1:153.5.0esr-1Fixed in 1:153.7.0esr-1

Event History

Mar 19, 2024

CVE Published

via Mozilla·12:00 AM

CVE Published

via MITRE·12:02 PM

Data Sourced

via MITRE·12:02 PM

DescriptionWeakness

Data Sourced

via OSV·12:15 PM

DescriptionSeverity

Apr 17, 2024

Data Sourced

via Red Hat·03:17 PM

DescriptionSeverityAffected Software

Nov 2, 2026

Data Sourced

via OSV·12:01 PM

Affected Software

Parent advisories

This vulnerability appears in the following advisories.

Peer vulnerabilities

Found alongside the following vulnerabilities.

Frequently Asked Questions

What is the severity of CVE-2024-2609?

CVE-2024-2609 has been rated as a high-severity vulnerability due to its potential for clickjacking attacks.

How do I fix CVE-2024-2609?

To remediate CVE-2024-2609, update to the latest version of affected software such as Firefox, Firefox ESR, or Thunderbird.

Who is affected by CVE-2024-2609?

CVE-2024-2609 affects users of Firefox, Firefox ESR, Thunderbird, and their respective packages on various platforms.

What type of vulnerability is CVE-2024-2609?

CVE-2024-2609 is a clickjacking vulnerability that can be exploited when the permission prompt input delay expires.

What versions are vulnerable to CVE-2024-2609?

Versions of Firefox up to 124, Firefox ESR up to 115.10, and Thunderbird up to 115.10 are vulnerable to CVE-2024-2609.

CVE-2024-2609: Medium severity Mozilla Thunderbird vulnerability

Other sources

Affected Software

Remediation

Event History

Parent advisories

Peer vulnerabilities

Frequently Asked Questions

What is the severity of CVE-2024-2609?

How do I fix CVE-2024-2609?

Who is affected by CVE-2024-2609?

What type of vulnerability is CVE-2024-2609?

What versions are vulnerable to CVE-2024-2609?

Company

Resources

Contact