CVE-2024-5693: Medium severity Mozilla Thunderbird vulnerability

Q: What is the severity of CVE-2024-5693?

CVE-2024-5693 is classified as a moderate severity vulnerability due to its potential to bypass same-origin policy protections.

Q: How do I fix CVE-2024-5693?

To fix CVE-2024-5693, update your affected software to the latest version that addresses this vulnerability.

Q: Which software is affected by CVE-2024-5693?

CVE-2024-5693 affects Mozilla Firefox ESR versions up to 115.12, Mozilla Thunderbird up to 115.12, and others listed in specific package distributions.

Q: What impact does CVE-2024-5693 have on web security?

CVE-2024-5693 can potentially allow malicious sites to access image data from other origins, undermining the same-origin policy.

Q: Is there a known exploit for CVE-2024-5693?

As of now, there is no publicly known exploit specifically targeting CVE-2024-5693, but the vulnerability itself poses security risks.

Published Jun 11, 2024

Updated

Last updated 24 July 2024

Other sources

Offscreen Canvas did not properly track cross-origin tainting, which could be used to access image data from another site in violation of same-origin policy.

— Mozilla

Affected Software

17 affected componentsFixes available

Mozilla Thunderbird<115.12

115.12

Mozilla Firefox<127

127

Mozilla Firefox ESR<115.12

115.12

redhat/firefox<115.12

115.12

redhat/thunderbird<115.12

115.12

Mozilla Firefox<115.12

Mozilla Firefox<127.0

Mozilla Thunderbird<115.12

debian/firefox-esr<115.12.0esr-1~deb12u1

115.12.0esr-1~deb12u1

debian/firefox-esr<115.12.0esr-1

115.12.0esr-1

debian/firefox-esr<115.12.0esr-1

115.12.0esr-1

debian/thunderbird<1:115.12.0-1~deb12u1

1:115.12.0-1~deb12u1

debian/thunderbird<1:115.12.0-1

1:115.12.0-1

debian/thunderbird<1:115.12.0-1

1:115.12.0-1

debian/firefox

160.0-1

debian/firefox-esr

140.12.0esr-1~deb12u1153.7.0esr-1~deb12u1140.15.0esr-1~deb13u1153.6.0esr-1~deb13u1153.5.1esr-1153.7.0esr-1

debian/thunderbird

1:140.12.0esr-1~deb12u11:153.6.0esr-1~deb12u21:140.12.0esr-1~deb13u11:153.6.0esr-1~deb13u11:153.5.0esr-11:153.7.0esr-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Thunderbird to a version that resolves this vulnerability.
Fixed in 115.12
Upgrade
Upgrade Firefox to a version that resolves this vulnerability.
Fixed in 127
Upgrade
Upgrade Firefox ESR to a version that resolves this vulnerability.
Fixed in 115.12
Upgrade
Upgrade redhat/firefox to a version that resolves this vulnerability.
Fixed in 115.12
Upgrade
Upgrade redhat/thunderbird to a version that resolves this vulnerability.
Fixed in 115.12
Upgrade
Upgrade debian/firefox-esr to a version that resolves this vulnerability.
Fixed in 115.12.0esr-1~deb12u1
Upgrade
Upgrade debian/firefox-esr to a version that resolves this vulnerability.
Fixed in 115.12.0esr-1
Upgrade
Upgrade debian/thunderbird to a version that resolves this vulnerability.
Fixed in 1:115.12.0-1~deb12u1
Upgrade
Upgrade debian/thunderbird to a version that resolves this vulnerability.
Fixed in 1:115.12.0-1
Upgrade
Upgrade debian/firefox to a version that resolves this vulnerability.
Fixed in 160.0-1
Upgrade
Upgrade debian/firefox-esr to a version that resolves this vulnerability.
Fixed in 140.12.0esr-1~deb12u1Fixed in 153.7.0esr-1~deb12u1Fixed in 140.15.0esr-1~deb13u1Fixed in 153.6.0esr-1~deb13u1Fixed in 153.5.1esr-1Fixed in 153.7.0esr-1
Upgrade
Upgrade debian/thunderbird to a version that resolves this vulnerability.
Fixed in 1:140.12.0esr-1~deb12u1Fixed in 1:153.6.0esr-1~deb12u2Fixed in 1:140.12.0esr-1~deb13u1Fixed in 1:153.6.0esr-1~deb13u1Fixed in 1:153.5.0esr-1Fixed in 1:153.7.0esr-1
Upgrade
Upgrade Mozilla Firefox to a version that resolves this vulnerability.
Fixed in 127
Upgrade
Upgrade Mozilla Firefox ESR to a version that resolves this vulnerability.
Fixed in 115.12
Upgrade
Upgrade Mozilla Thunderbird to a version that resolves this vulnerability.
Fixed in 115.12

Event History

Jun 11, 2024

CVE Published

via Mozilla·12:00 AM

CVE Published

via MITRE·12:40 PM

Data Sourced

via MITRE·12:40 PM

DescriptionWeakness

Data Sourced

via NVD·01:15 PM

DescriptionSeverityWeakness

Data Sourced

via OSV·01:15 PM

DescriptionSeverityAffected Software

Data Sourced

via Red Hat·08:45 PM

DescriptionSeverityAffected Software

Jun 17, 2026

Data Sourced

via NVD·08:16 AM

Affected Software

Parent advisories

This vulnerability appears in the following advisories.

Peer vulnerabilities

Found alongside the following vulnerabilities.

Frequently Asked Questions

What is the severity of CVE-2024-5693?

CVE-2024-5693 is classified as a moderate severity vulnerability due to its potential to bypass same-origin policy protections.

How do I fix CVE-2024-5693?

To fix CVE-2024-5693, update your affected software to the latest version that addresses this vulnerability.

Which software is affected by CVE-2024-5693?

CVE-2024-5693 affects Mozilla Firefox ESR versions up to 115.12, Mozilla Thunderbird up to 115.12, and others listed in specific package distributions.

What impact does CVE-2024-5693 have on web security?

CVE-2024-5693 can potentially allow malicious sites to access image data from other origins, undermining the same-origin policy.

Is there a known exploit for CVE-2024-5693?

As of now, there is no publicly known exploit specifically targeting CVE-2024-5693, but the vulnerability itself poses security risks.

CVE-2024-5693: Medium severity Mozilla Thunderbird vulnerability

Other sources

Affected Software

Remediation

Event History

Parent advisories

Peer vulnerabilities

Frequently Asked Questions

What is the severity of CVE-2024-5693?

How do I fix CVE-2024-5693?

Which software is affected by CVE-2024-5693?

What impact does CVE-2024-5693 have on web security?

Is there a known exploit for CVE-2024-5693?

Company

Resources

Contact