CVE-2024-3852: High severity Mozilla Thunderbird vulnerability
GetBoundName could return the wrong version of an object when JIT optimizations were applied.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Thunderbirdto a version that resolves this vulnerability.Fixed in 115.10 - Upgrade
Upgrade
Firefoxto a version that resolves this vulnerability.Fixed in 125 - Upgrade
Upgrade
Firefox ESRto a version that resolves this vulnerability.Fixed in 115.10 - Upgrade
Upgrade
redhat/firefoxto a version that resolves this vulnerability.Fixed in 115.10 - Upgrade
Upgrade
redhat/thunderbirdto a version that resolves this vulnerability.Fixed in 115.10 - Upgrade
Upgrade
debian/firefox-esrto a version that resolves this vulnerability.Fixed in 115.10.0esr-1~deb12u1 - Upgrade
Upgrade
debian/firefox-esrto a version that resolves this vulnerability.Fixed in 115.10.0esr-1 - Upgrade
Upgrade
debian/thunderbirdto a version that resolves this vulnerability.Fixed in 1:115.10.1-1~deb12u1 - Upgrade
Upgrade
debian/thunderbirdto a version that resolves this vulnerability.Fixed in 1:115.10.1-1 - Upgrade
Upgrade
debian/firefoxto a version that resolves this vulnerability.Fixed in 160.0-1 - Upgrade
Upgrade
debian/firefox-esrto a version that resolves this vulnerability.Fixed in 140.12.0esr-1~deb12u1Fixed in 153.7.0esr-1~deb12u1Fixed in 140.15.0esr-1~deb13u1Fixed in 153.6.0esr-1~deb13u1Fixed in 153.5.1esr-1Fixed in 153.7.0esr-1 - Upgrade
Upgrade
debian/thunderbirdto a version that resolves this vulnerability.Fixed in 1:140.12.0esr-1~deb12u1Fixed in 1:153.6.0esr-1~deb12u2Fixed in 1:140.12.0esr-1~deb13u1Fixed in 1:153.6.0esr-1~deb13u1Fixed in 1:153.5.0esr-1Fixed in 1:153.7.0esr-1
Event History
Parent advisories
This vulnerability appears in the following advisories.
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2024-3852?
CVE-2024-3852 is classified as a medium severity vulnerability.
How do I fix CVE-2024-3852?
To fix CVE-2024-3852, upgrade to the patched versions of affected software as specified by the vendor.
What products are affected by CVE-2024-3852?
CVE-2024-3852 affects Mozilla Firefox, Firefox ESR, Thunderbird, as well as specific versions from Red Hat and Debian.
What kind of vulnerability is CVE-2024-3852?
CVE-2024-3852 is a vulnerability that allows GetBoundName to return the wrong version of an object due to JIT optimizations.
When was CVE-2024-3852 disclosed?
CVE-2024-3852 was disclosed in 2024 as part of Mozilla's security advisories.