CVE-2024-3302: Low severity Mozilla Thunderbird vulnerability

Q: What is the severity of CVE-2024-3302?

CVE-2024-3302 has been classified as a denial of service (DoS) vulnerability affecting certain versions of Mozilla Firefox and Thunderbird.

Q: How do I fix CVE-2024-3302?

To mitigate CVE-2024-3302, users should update their installations of Mozilla Firefox and Thunderbird to versions beyond 115.10 or follow the specific remediation instructions for their OS package.

Q: Which versions of Mozilla Firefox are affected by CVE-2024-3302?

CVE-2024-3302 affects Mozilla Firefox versions up to and including 115.10.

Q: Which versions of Mozilla Thunderbird are affected by CVE-2024-3302?

CVE-2024-3302 impacts Mozilla Thunderbird versions up to and including 115.10.

Q: What are the implications of CVE-2024-3302 on users' applications?

CVE-2024-3302 could allow attackers to disrupt service, leading to potential downtime for users relying on Firefox or Thunderbird.

Published Apr 4, 2024

Updated

Last updated 24 July 2024

Other sources

Per initial information provided via VINCE:

Mozilla has reserved CVE-2024-3302 for this issue in the Gecko networking implementation; the Firefox and Thunderbird clients would be vulnerable to a DoS from a malicious server.

— Red Hat

There was no limit to the number of HTTP/2 CONTINUATION frames that would be processed. A server could abuse this to create an Out of Memory condition in the browser.

— Mozilla

Affected Software

17 affected componentsFixes available

Mozilla Thunderbird<115.10

115.10

Mozilla Firefox<125

125

Mozilla Firefox ESR<115.10

115.10

Mozilla Firefox<115.10

Mozilla Firefox<125.0

Mozilla Thunderbird<=115.10

redhat/firefox<115.10

115.10

redhat/thunderbird<115.10

115.10

debian/firefox-esr<115.10.0esr-1~deb12u1

115.10.0esr-1~deb12u1

debian/firefox-esr<115.10.0esr-1

115.10.0esr-1

debian/firefox-esr<115.10.0esr-1

115.10.0esr-1

debian/thunderbird<1:115.10.1-1~deb12u1

1:115.10.1-1~deb12u1

debian/thunderbird<1:115.10.1-1

1:115.10.1-1

debian/thunderbird<1:115.10.1-1

1:115.10.1-1

debian/firefox

160.0-1

debian/firefox-esr

140.12.0esr-1~deb12u1153.7.0esr-1~deb12u1140.15.0esr-1~deb13u1153.6.0esr-1~deb13u1153.5.1esr-1153.7.0esr-1

debian/thunderbird

1:140.12.0esr-1~deb12u11:153.6.0esr-1~deb12u21:140.12.0esr-1~deb13u11:153.6.0esr-1~deb13u11:153.5.0esr-11:153.7.0esr-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Thunderbird to a version that resolves this vulnerability.
Fixed in 115.10
Upgrade
Upgrade Firefox to a version that resolves this vulnerability.
Fixed in 125
Upgrade
Upgrade Firefox ESR to a version that resolves this vulnerability.
Fixed in 115.10
Upgrade
Upgrade redhat/firefox to a version that resolves this vulnerability.
Fixed in 115.10
Upgrade
Upgrade redhat/thunderbird to a version that resolves this vulnerability.
Fixed in 115.10
Upgrade
Upgrade debian/firefox-esr to a version that resolves this vulnerability.
Fixed in 115.10.0esr-1~deb12u1
Upgrade
Upgrade debian/firefox-esr to a version that resolves this vulnerability.
Fixed in 115.10.0esr-1
Upgrade
Upgrade debian/thunderbird to a version that resolves this vulnerability.
Fixed in 1:115.10.1-1~deb12u1
Upgrade
Upgrade debian/thunderbird to a version that resolves this vulnerability.
Fixed in 1:115.10.1-1
Upgrade
Upgrade debian/firefox to a version that resolves this vulnerability.
Fixed in 160.0-1
Upgrade
Upgrade debian/firefox-esr to a version that resolves this vulnerability.
Fixed in 140.12.0esr-1~deb12u1Fixed in 153.7.0esr-1~deb12u1Fixed in 140.15.0esr-1~deb13u1Fixed in 153.6.0esr-1~deb13u1Fixed in 153.5.1esr-1Fixed in 153.7.0esr-1
Upgrade
Upgrade debian/thunderbird to a version that resolves this vulnerability.
Fixed in 1:140.12.0esr-1~deb12u1Fixed in 1:153.6.0esr-1~deb12u2Fixed in 1:140.12.0esr-1~deb13u1Fixed in 1:153.6.0esr-1~deb13u1Fixed in 1:153.5.0esr-1Fixed in 1:153.7.0esr-1

Event History

Apr 4, 2024

Data Sourced

via Red Hat·02:25 PM

DescriptionSeverityAffected Software

Apr 16, 2024

CVE Published

via Mozilla·12:00 AM

CVE Published

via MITRE·03:14 PM

Data Sourced

via MITRE·03:14 PM

DescriptionWeakness

Data Sourced

via OSV·04:15 PM

DescriptionSeverity

Data Sourced

via OSV·04:15 PM

Affected Software

Parent advisories

This vulnerability appears in the following advisories.

Peer vulnerabilities

Found alongside the following vulnerabilities.

Frequently Asked Questions

What is the severity of CVE-2024-3302?

CVE-2024-3302 has been classified as a denial of service (DoS) vulnerability affecting certain versions of Mozilla Firefox and Thunderbird.

How do I fix CVE-2024-3302?

To mitigate CVE-2024-3302, users should update their installations of Mozilla Firefox and Thunderbird to versions beyond 115.10 or follow the specific remediation instructions for their OS package.

Which versions of Mozilla Firefox are affected by CVE-2024-3302?

CVE-2024-3302 affects Mozilla Firefox versions up to and including 115.10.

Which versions of Mozilla Thunderbird are affected by CVE-2024-3302?

CVE-2024-3302 impacts Mozilla Thunderbird versions up to and including 115.10.

What are the implications of CVE-2024-3302 on users' applications?

CVE-2024-3302 could allow attackers to disrupt service, leading to potential downtime for users relying on Firefox or Thunderbird.

CVE-2024-3302: Low severity Mozilla Thunderbird vulnerability

Other sources

Affected Software

Remediation

Event History

Parent advisories

Peer vulnerabilities

Frequently Asked Questions

What is the severity of CVE-2024-3302?

How do I fix CVE-2024-3302?

Which versions of Mozilla Firefox are affected by CVE-2024-3302?

Which versions of Mozilla Thunderbird are affected by CVE-2024-3302?

What are the implications of CVE-2024-3302 on users' applications?

Company

Resources

Contact