QID 357083

Date Published: 2024-02-09

QID 357083: Amazon Linux Security Advisory for thunderbird : ALAS2-2024-2440

an out of bounds write in angle could have allowed an attacker to corrupt memory leading to a potentially exploitable crash.
This vulnerability affects firefox < 122, firefox esr < 115.7, and thunderbird < 115.7. (
( CVE-2024-0741) it was possible for certain browser prompts and dialogs to be activated or dismissed unintentionally by the user due to an incorrect timestamp used to prevent input after page load.
( CVE-2024-0742) a linux user opening the print preview dialog could have caused the browser to crash.
( CVE-2024-0746) when a parent page loaded a child in an iframe with `unsafe-inline`, the parent content security policy could have overridden the child content security policy.
( CVE-2024-0747) a phishing site could have repurposed an `about:` dialog to show phishing content with an incorrect origin in the address bar.
( CVE-2024-0749) a bug in popup notifications delay calculation could have made it possible for an attacker to trick a user into granting permissions.
( CVE-2024-0750) a malicious devtools extension could have been used to escalate privileges.
( CVE-2024-0751) in specific hsts configurations an attacker could have bypassed hsts on a subdomain.
( CVE-2024-0753) memory safety bugs present in firefox 121, firefox esr 115.6, and thunderbird 115.6.

Successful exploitation of this vulnerability could lead to a securitybreach or could affect integrity, availability, and confidentiality.

  • CVSS V3 rated as Critical - 8.8 severity.
  • CVSS V2 rated as Medium - 5.4 severity.
  • Solution
    Please refer to Amazon advisory: ALAS2-2024-2440 for affected packages and patching details, or update with your package manager.
    Vendor References
    Software Advisories
    Advisory ID Software Component Link
    ALAS2-2024-2440 amazon linux 2 URL Logo alas.aws.amazon.com/AL2/ALAS-2024-2440.html