CVE-2024-2616: Low severity Mozilla Thunderbird vulnerability
Last updated 28 February 2025
Other sources
To harden ICU against exploitation, the behavior for out-of-memory conditions was changed to crash instead of attempt to continue.
— Mozilla
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Thunderbirdto a version that resolves this vulnerability.Fixed in 115.9 - Upgrade
Upgrade
Firefox ESRto a version that resolves this vulnerability.Fixed in 115.9 - Upgrade
Upgrade
redhat/firefoxto a version that resolves this vulnerability.Fixed in 115.9 - Upgrade
Upgrade
redhat/thunderbirdto a version that resolves this vulnerability.Fixed in 115.9 - Upgrade
Upgrade
debian/firefox-esrto a version that resolves this vulnerability.Fixed in 115.9.0esr-1~deb12u1 - Upgrade
Upgrade
debian/firefox-esrto a version that resolves this vulnerability.Fixed in 115.9.0esr-1 - Upgrade
Upgrade
debian/thunderbirdto a version that resolves this vulnerability.Fixed in 1:115.9.0-1~deb12u1 - Upgrade
Upgrade
debian/thunderbirdto a version that resolves this vulnerability.Fixed in 1:115.9.0-1 - Upgrade
Upgrade
alpine/firefox-esrto a version that resolves this vulnerability.Fixed in 115.9.0-r0 - Upgrade
Upgrade
debian/firefox-esrto a version that resolves this vulnerability.Fixed in 140.12.0esr-1~deb12u1Fixed in 153.7.0esr-1~deb12u1Fixed in 140.15.0esr-1~deb13u1Fixed in 153.7.0esr-1~deb13u1Fixed in 153.5.1esr-1Fixed in 153.7.0esr-1 - Upgrade
Upgrade
debian/thunderbirdto a version that resolves this vulnerability.Fixed in 1:140.12.0esr-1~deb12u1Fixed in 1:153.7.0esr-1~deb12u1Fixed in 1:140.12.0esr-1~deb13u1Fixed in 1:153.7.0esr-1~deb13u1Fixed in 1:153.5.0esr-1Fixed in 1:153.7.0esr-1
Event History
Parent advisories
This vulnerability appears in the following advisories.
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2024-2616?
CVE-2024-2616 is classified as a moderate severity vulnerability due to its potential impact on application stability.
How do I fix CVE-2024-2616?
To remediate CVE-2024-2616, upgrade Firefox ESR or Thunderbird to at least version 115.14.0 or apply the latest security patches from your distribution.
What platforms are affected by CVE-2024-2616?
CVE-2024-2616 affects Mozilla Firefox ESR, Mozilla Thunderbird, and their respective packages in various Linux distributions prior to the specified versions.
What changes were made in response to CVE-2024-2616?
In response to CVE-2024-2616, the handling of out-of-memory conditions in ICU was modified to crash instead of attempting to continue.
Is there a workaround for CVE-2024-2616?
There are no specific workarounds for CVE-2024-2616; the best course of action is to update to the latest versions of the affected software.