CVE-2024-8382: High severity thunderbird vulnerability
Internal browser event interfaces were exposed to web content when privileged EventHandler listener callbacks ran for those events. Web content that tried to use those interfaces would not be able to use them with elevated privileges, but their presence would indicate certain browser features had been used, such as when a user opened the Dev Tools console.
Other sources
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Event History
Parent advisories
This vulnerability appears in the following advisories.
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2024-8382?
CVE-2024-8382 is considered a moderate severity vulnerability that exposes internal browser event interfaces.
How do I fix CVE-2024-8382?
To resolve CVE-2024-8382, update Mozilla Firefox or Thunderbird to the latest version beyond 130 for Firefox and 128.2 for Firefox ESR.
What versions of Mozilla products are affected by CVE-2024-8382?
CVE-2024-8382 affects Mozilla Firefox versions up to 130 and Firefox ESR versions up to 128.2.
What is the nature of the vulnerability described in CVE-2024-8382?
CVE-2024-8382 involves the exposure of internal browser event interfaces to web content, potentially indicating certain features.
Are there any alternatives to fix CVE-2024-8382?
Updating to the specified versions is the primary method to mitigate CVE-2024-8382, with no direct alternatives recommended.