CVE-2024-2614: High severity Mozilla Thunderbird vulnerability
Last updated 28 February 2025
Other sources
Memory safety bugs present in Firefox 123, Firefox ESR 115.8, and Thunderbird 115.8. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.
— Mozilla
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Thunderbirdto a version that resolves this vulnerability.Fixed in 115.9 - Upgrade
Upgrade
Firefoxto a version that resolves this vulnerability.Fixed in 124 - Upgrade
Upgrade
Firefox ESRto a version that resolves this vulnerability.Fixed in 115.9 - Upgrade
Upgrade
redhat/firefoxto a version that resolves this vulnerability.Fixed in 115.9 - Upgrade
Upgrade
redhat/thunderbirdto a version that resolves this vulnerability.Fixed in 115.9 - Upgrade
Upgrade
debian/firefox-esrto a version that resolves this vulnerability.Fixed in 115.9.0esr-1~deb12u1 - Upgrade
Upgrade
debian/firefox-esrto a version that resolves this vulnerability.Fixed in 115.9.0esr-1 - Upgrade
Upgrade
debian/thunderbirdto a version that resolves this vulnerability.Fixed in 1:115.9.0-1~deb12u1 - Upgrade
Upgrade
debian/thunderbirdto a version that resolves this vulnerability.Fixed in 1:115.9.0-1 - Upgrade
Upgrade
alpine/firefox-esrto a version that resolves this vulnerability.Fixed in 115.9.0-r0 - Upgrade
Upgrade
debian/firefoxto a version that resolves this vulnerability.Fixed in 160.0-1 - Upgrade
Upgrade
debian/firefox-esrto a version that resolves this vulnerability.Fixed in 140.12.0esr-1~deb12u1Fixed in 153.7.0esr-1~deb12u1Fixed in 140.15.0esr-1~deb13u1Fixed in 153.7.0esr-1~deb13u1Fixed in 153.5.1esr-1Fixed in 153.7.0esr-1 - Upgrade
Upgrade
debian/thunderbirdto a version that resolves this vulnerability.Fixed in 1:140.12.0esr-1~deb12u1Fixed in 1:153.7.0esr-1~deb12u1Fixed in 1:140.12.0esr-1~deb13u1Fixed in 1:153.7.0esr-1~deb13u1Fixed in 1:153.5.0esr-1Fixed in 1:153.7.0esr-1
Event History
Parent advisories
This vulnerability appears in the following advisories.
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2024-2614?
CVE-2024-2614 is classified as a memory safety vulnerability, which could potentially allow for arbitrary code execution under certain conditions.
How do I fix CVE-2024-2614?
To remediate CVE-2024-2614, update your Firefox to version 124, Firefox ESR to version 115.9, or Thunderbird to version 115.9.
Which software versions are affected by CVE-2024-2614?
CVE-2024-2614 affects Firefox versions up to 123, Firefox ESR versions up to 115.8, and Thunderbird versions up to 115.8.
Can CVE-2024-2614 be exploited?
Yes, CVE-2024-2614 includes memory safety bugs that may be exploited to execute arbitrary code if leveraged appropriately.
Is there a patch available for CVE-2024-2614?
Yes, patches for CVE-2024-2614 are available in the latest software versions released by Mozilla.