CVE-2024-9392: Critical severity Mozilla Thunderbird vulnerability

Q: What is the severity of CVE-2024-9392?

CVE-2024-9392 is considered to be a high severity vulnerability due to the potential for arbitrary loading of cross-origin pages.

Q: How do I fix CVE-2024-9392?

To remediate CVE-2024-9392, users should update to Firefox version 131 or later, or to Firefox ESR version 128.3 or later.

Q: Which software versions are affected by CVE-2024-9392?

CVE-2024-9392 affects Firefox versions prior to 131, Firefox ESR versions prior to 128.3, and Thunderbird versions prior to 131.

Q: What could an attacker achieve by exploiting CVE-2024-9392?

An attacker exploiting CVE-2024-9392 could potentially load arbitrary cross-origin pages, compromising user privacy and security.

Q: Is CVE-2024-9392 present in the latest Thunderbird version?

No, the latest versions of Thunderbird that are 131 or above are not vulnerable to CVE-2024-9392.

Published Oct 1, 2024

Updated

A compromised content process could have allowed for the arbitrary loading of cross-origin pages.

Affected Software

18 affected componentsFixes available

Mozilla Thunderbird<131

131

Mozilla Firefox<131

131

Mozilla Firefox ESR<115.16

115.16

Mozilla Firefox ESR<128.3

128.3

Mozilla Firefox<115.6.0

Mozilla Firefox<131.0

Mozilla Thunderbird<128.3.0

Mozilla Thunderbird>=129.0<131.0

debian/firefox-esr<128.3.0esr-1~deb12u1

128.3.0esr-1~deb12u1

debian/firefox-esr<128.3.0esr-1

128.3.0esr-1

debian/firefox-esr<128.3.0esr-1

128.3.0esr-1

debian/thunderbird<1:115.16.0esr-1~deb12u1

1:115.16.0esr-1~deb12u1

debian/thunderbird<1:128.3.0esr-1

1:128.3.0esr-1

debian/thunderbird<1:128.3.0esr-1

1:128.3.0esr-1

Mozilla Thunderbird<128.3

128.3

debian/firefox

159.0.1-1

debian/firefox-esr

140.12.0esr-1~deb12u1153.6.0esr-1~deb12u2140.15.0esr-1~deb13u1153.6.0esr-1~deb13u1153.5.1esr-1153.6.0esr-1

debian/thunderbird

1:140.12.0esr-1~deb12u11:153.6.0esr-1~deb12u21:140.12.0esr-1~deb13u11:153.6.0esr-1~deb13u11:153.5.0esr-11:153.6.0esr-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Thunderbird to a version that resolves this vulnerability.
Fixed in 131
Upgrade
Upgrade Firefox to a version that resolves this vulnerability.
Fixed in 131
Upgrade
Upgrade Firefox ESR to a version that resolves this vulnerability.
Fixed in 115.16
Upgrade
Upgrade Firefox ESR to a version that resolves this vulnerability.
Fixed in 128.3
Upgrade
Upgrade debian/firefox-esr to a version that resolves this vulnerability.
Fixed in 128.3.0esr-1~deb12u1
Upgrade
Upgrade debian/firefox-esr to a version that resolves this vulnerability.
Fixed in 128.3.0esr-1
Upgrade
Upgrade debian/thunderbird to a version that resolves this vulnerability.
Fixed in 1:115.16.0esr-1~deb12u1
Upgrade
Upgrade debian/thunderbird to a version that resolves this vulnerability.
Fixed in 1:128.3.0esr-1
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 128.3
Upgrade
Upgrade debian/firefox to a version that resolves this vulnerability.
Fixed in 159.0.1-1
Upgrade
Upgrade debian/firefox-esr to a version that resolves this vulnerability.
Fixed in 140.12.0esr-1~deb12u1Fixed in 153.6.0esr-1~deb12u2Fixed in 140.15.0esr-1~deb13u1Fixed in 153.6.0esr-1~deb13u1Fixed in 153.5.1esr-1Fixed in 153.6.0esr-1
Upgrade
Upgrade debian/thunderbird to a version that resolves this vulnerability.
Fixed in 1:140.12.0esr-1~deb12u1Fixed in 1:153.6.0esr-1~deb12u2Fixed in 1:140.12.0esr-1~deb13u1Fixed in 1:153.6.0esr-1~deb13u1Fixed in 1:153.5.0esr-1Fixed in 1:153.6.0esr-1

Event History

Oct 1, 2024

CVE Published

via Mozilla·12:00 AM

Data Sourced

via Mozilla·12:00 AM

DescriptionSeverityAffected Software

CVE Published

via MITRE·03:13 PM

Data Sourced

via MITRE·03:13 PM

DescriptionWeakness

Data Sourced

via Red Hat·04:03 PM

DescriptionSeverityAffected Software

Data Sourced

via NVD·04:15 PM

DescriptionSeverityWeaknessAffected Software

Data Sourced

via OSV·04:15 PM

DescriptionSeverityAffected Software

Parent advisories

This vulnerability appears in the following advisories.

Peer vulnerabilities

Found alongside the following vulnerabilities.

Frequently Asked Questions

What is the severity of CVE-2024-9392?

CVE-2024-9392 is considered to be a high severity vulnerability due to the potential for arbitrary loading of cross-origin pages.

How do I fix CVE-2024-9392?

To remediate CVE-2024-9392, users should update to Firefox version 131 or later, or to Firefox ESR version 128.3 or later.

Which software versions are affected by CVE-2024-9392?

CVE-2024-9392 affects Firefox versions prior to 131, Firefox ESR versions prior to 128.3, and Thunderbird versions prior to 131.

What could an attacker achieve by exploiting CVE-2024-9392?

An attacker exploiting CVE-2024-9392 could potentially load arbitrary cross-origin pages, compromising user privacy and security.

Is CVE-2024-9392 present in the latest Thunderbird version?

No, the latest versions of Thunderbird that are 131 or above are not vulnerable to CVE-2024-9392.

CVE-2024-9392: Critical severity Mozilla Thunderbird vulnerability

Affected Software

Remediation

Event History

Parent advisories

Peer vulnerabilities

Frequently Asked Questions

What is the severity of CVE-2024-9392?

How do I fix CVE-2024-9392?

Which software versions are affected by CVE-2024-9392?

What could an attacker achieve by exploiting CVE-2024-9392?

Is CVE-2024-9392 present in the latest Thunderbird version?

Company

Resources

Contact