CVE-2024-7526: High severity Mozilla Thunderbird vulnerability
ANGLE failed to initialize parameters which lead to reading from uninitialized memory. This could be leveraged to leak sensitive data from memory.
Other sources
ANGLE failed to initialize parameters which led to reading from uninitialized memory. This could be leveraged to leak sensitive data from memory.
— Mozilla
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Thunderbirdto a version that resolves this vulnerability.Fixed in 128.1 - Upgrade
Upgrade
Thunderbirdto a version that resolves this vulnerability.Fixed in 115.14 - Upgrade
Upgrade
Firefox ESRto a version that resolves this vulnerability.Fixed in 115.14 - Upgrade
Upgrade
Firefox ESRto a version that resolves this vulnerability.Fixed in 128.1 - Upgrade
Upgrade
debian/firefox-esrto a version that resolves this vulnerability.Fixed in 115.14.0esr-1~deb12u1 - Upgrade
Upgrade
debian/firefox-esrto a version that resolves this vulnerability.Fixed in 115.14.0esr-1 - Upgrade
Upgrade
debian/thunderbirdto a version that resolves this vulnerability.Fixed in 1:115.14.0-1~deb12u1 - Upgrade
Upgrade
debian/thunderbirdto a version that resolves this vulnerability.Fixed in 1:128.1.0esr-1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 129 - Upgrade
Upgrade
debian/firefoxto a version that resolves this vulnerability.Fixed in 159.0.1-1 - Upgrade
Upgrade
debian/firefox-esrto a version that resolves this vulnerability.Fixed in 140.12.0esr-1~deb12u1Fixed in 153.6.0esr-1~deb12u2Fixed in 140.15.0esr-1~deb13u1Fixed in 153.6.0esr-1~deb13u1Fixed in 153.5.1esr-1Fixed in 153.6.0esr-1 - Upgrade
Upgrade
debian/thunderbirdto a version that resolves this vulnerability.Fixed in 1:140.12.0esr-1~deb12u1Fixed in 1:153.6.0esr-1~deb12u2Fixed in 1:140.12.0esr-1~deb13u1Fixed in 1:153.6.0esr-1~deb13u1Fixed in 1:153.5.0esr-1Fixed in 1:153.6.0esr-1
Event History
Parent advisories
This vulnerability appears in the following advisories.
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2024-7526?
CVE-2024-7526 is classified as a medium severity vulnerability due to its potential to leak sensitive data.
How does CVE-2024-7526 affect my software?
CVE-2024-7526 affects specific versions of Mozilla Firefox ESR and Thunderbird, potentially leading to sensitive data leaks from uninitialized memory.
How do I fix CVE-2024-7526?
To remediate CVE-2024-7526, upgrade to the latest versions of Firefox ESR or Thunderbird, specifically above versions 128.1 or 115.14.
What versions are vulnerable to CVE-2024-7526?
The vulnerable versions for CVE-2024-7526 include Firefox ESR and Thunderbird up to version 128.1 and 115.14 respectively.
Can CVE-2024-7526 be exploited remotely?
Yes, CVE-2024-7526 can potentially be exploited remotely, allowing attackers to access sensitive information.