Headline
Ubuntu Security Notice USN-7066-1
Ubuntu Security Notice 7066-1 - Damien Schaeffer discovered that Thunderbird did not properly manage certain memory operations when processing content in the Animation timelines. An attacker could potentially exploit this issue to achieve arbitrary code execution.
==========================================================================
Ubuntu Security Notice USN-7066-1
October 14, 2024
thunderbird vulnerability
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
Summary:
Thunderbird could be made to crash or run programs if it opened a specially
crafted file.
Software Description:
- thunderbird: Mozilla Open Source mail and newsgroup client
Details:
Damien Schaeffer discovered that Thunderbird did not properly manage
certain memory operations when processing content in the Animation
timelines. An attacker could potentially exploit this issue to achieve
arbitrary code execution.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 22.04 LTS
thunderbird 1:115.16.0+build2-0ubuntu0.22.04.1
Ubuntu 20.04 LTS
thunderbird 1:115.16.0+build2-0ubuntu0.20.04.1
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-7066-1
CVE-2024-9680
Package Information:
https://launchpad.net/ubuntu/+source/thunderbird/1:115.16.0+build2-0ubuntu0.22.04.1
https://launchpad.net/ubuntu/+source/thunderbird/1:115.16.0+build2-0ubuntu0.20.04.1
Related news
Debian Linux Security Advisory 5789-1 - Multiple security issues were discovered in Thunderbird, which could result in the execution of arbitrary code.
Ubuntu Security Notice 7065-1 - Damien Schaeffer discovered that Firefox did not properly manage memory in the content process when handling Animation timelines, leading to a use after free vulnerability. An attacker could possibly use this issue to achieve remote code execution.
Debian Linux Security Advisory 5788-1 - Damien Schaeffer discovered a use-after-free in the Mozilla Firefox web browser, which could result in the execution of arbitrary code.
Red Hat Security Advisory 2024-7977-03 - An update for firefox is now available for Red Hat Enterprise Linux 8. Issues addressed include a use-after-free vulnerability.
The bug is already being exploited in the wild, but Firefox has provided patches for those who may be vulnerable.
Red Hat Security Advisory 2024-7958-03 - An update for firefox is now available for Red Hat Enterprise Linux 9. Issues addressed include a use-after-free vulnerability.
Mozilla has revealed that a critical security flaw impacting Firefox and Firefox Extended Support Release (ESR) has come under active exploitation in the wild. The vulnerability, tracked as CVE-2024-9680, has been described as a use-after-free bug in the Animation timeline component. "An attacker was able to achieve code execution in the content process by exploiting a use-after-free in