CVE-2024-8382: High severity Mozilla Thunderbird vulnerability
Internal browser event interfaces were exposed to web content when privileged EventHandler listener callbacks ran for those events. Web content that tried to use those interfaces would not be able to use them with elevated privileges, but their presence would indicate certain browser features had been used, such as when a user opened the Dev Tools console.
Other sources
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Thunderbirdto a version that resolves this vulnerability.Fixed in 115.15 - Upgrade
Upgrade
Firefoxto a version that resolves this vulnerability.Fixed in 130 - Upgrade
Upgrade
Firefox ESRto a version that resolves this vulnerability.Fixed in 115.15 - Upgrade
Upgrade
Firefox ESRto a version that resolves this vulnerability.Fixed in 128.2 - Upgrade
Upgrade
debian/firefox-esrto a version that resolves this vulnerability.Fixed in 115.15.0esr-1~deb12u1 - Upgrade
Upgrade
debian/firefox-esrto a version that resolves this vulnerability.Fixed in 115.15.0esr-1 - Upgrade
Upgrade
debian/thunderbirdto a version that resolves this vulnerability.Fixed in 1:115.15.0-1~deb12u1 - Upgrade
Upgrade
debian/thunderbirdto a version that resolves this vulnerability.Fixed in 1:128.2.0esr-1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 128.2 - Upgrade
Upgrade
debian/firefoxto a version that resolves this vulnerability.Fixed in 159.0.1-1 - Upgrade
Upgrade
debian/firefox-esrto a version that resolves this vulnerability.Fixed in 140.12.0esr-1~deb12u1Fixed in 153.6.0esr-1~deb12u2Fixed in 140.15.0esr-1~deb13u1Fixed in 153.6.0esr-1~deb13u1Fixed in 153.5.1esr-1Fixed in 153.6.0esr-1 - Upgrade
Upgrade
debian/thunderbirdto a version that resolves this vulnerability.Fixed in 1:140.12.0esr-1~deb12u1Fixed in 1:153.6.0esr-1~deb12u2Fixed in 1:140.12.0esr-1~deb13u1Fixed in 1:153.6.0esr-1~deb13u1Fixed in 1:153.5.0esr-1Fixed in 1:153.6.0esr-1
Event History
Parent advisories
This vulnerability appears in the following advisories.
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2024-8382?
CVE-2024-8382 is considered a moderate severity vulnerability that exposes internal browser event interfaces.
How do I fix CVE-2024-8382?
To resolve CVE-2024-8382, update Mozilla Firefox or Thunderbird to the latest version beyond 130 for Firefox and 128.2 for Firefox ESR.
What versions of Mozilla products are affected by CVE-2024-8382?
CVE-2024-8382 affects Mozilla Firefox versions up to 130 and Firefox ESR versions up to 128.2.
What is the nature of the vulnerability described in CVE-2024-8382?
CVE-2024-8382 involves the exposure of internal browser event interfaces to web content, potentially indicating certain features.
Are there any alternatives to fix CVE-2024-8382?
Updating to the specified versions is the primary method to mitigate CVE-2024-8382, with no direct alternatives recommended.