SUSE SLED15: MozillaThunderbird / MozillaThunderbird-translations-common / etc (SUSE-SU-2024:1437-1)

critical Nessus Plugin ID 193908

Language:

Synopsis

The remote SUSE host is missing one or more security updates.

Description

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:1437-1 advisory.

Update to Mozilla Thunderbird 115.10.1

Security fixes (MFSA 2024-20) (bsc#1222535):

- CVE-2024-3852: GetBoundName in the JIT returned the wrong object (bmo#1883542)
- CVE-2024-3854: Out-of-bounds-read after mis-optimized switch statement (bmo#1884552)
- CVE-2024-3857: Incorrect JITting of arguments led to use-after-free during garbage collection (bmo#1886683)
- CVE-2024-2609: Permission prompt input delay could expire when not in focus (bmo#1866100)
- CVE-2024-3859: Integer-overflow led to out-of-bounds-read in the OpenType sanitizer (bmo#1874489)
- CVE-2024-3861: Potential use-after-free due to AlignedBuffer self-move (bmo#1883158)
- CVE-2024-3863: Download Protections were bypassed by .xrm-ms files on Windows (bmo#1885855)
- CVE-2024-3302: Denial of Service using HTTP/2 CONTINUATION frames (bmo#1881183, https://kb.cert.org/vuls/id/421644)
- CVE-2024-3864: Memory safety bug fixed in Firefox 125, Firefox ESR 115.10, and Thunderbird 115.10 (bmo#1888333)

Other Fixes:
* fixed: Thunderbird processes did not exit cleanly; user intervention was required via task manager (bmo#1891889)
* unresolved: After changing password on an IMAP account, the account could become locked due to too many failed login attempts (bmo#1862111)
* fixed: Creating a tag in General Settings with a number as the tag name did not work (bmo#1881124)
* fixed: Quick Filter button selections did not persist after restart (bmo#1847265)
* fixed: Collapsing and expanding message list headers sometimes caused header to scroll out of view (bmo#1862197)
* fixed: Single message with no children inside a parent thread sometimes displayed incorrectly as a thread with a duplicate of itself as its child (bmo#1427546)
* fixed: 'Get selected messages' menu items did not work (bmo#1867091)
* fixed: 'Download and Sync Messages' dialog was too short when using Russian locale, obscuring OK button (bmo#1881795)
* fixed: After changing password on an IMAP account, the account could become locked due to too many failed login attempts (bmo#1862111)
* fixed: Retrieving multiline POP3 message from server failed if message chunk ended in newline instead of carriage return and newline (bmo#1883760)
* fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did not support encryption configuration (bmo#1876992)
* fixed: Non-empty address book search bar interfered with displaying/editing contacts (bmo#1833031)
* fixed: Deleting attendees from 'Invite Attendees' view removed attendees from view, but not from invite (bmo#1874450)
* fixed: Splitter arrow between task list and task description did not behave as expected (bmo#1889562)
* fixed: Performance improvements and code cleanup (bmo#1878257,bmo#1883550)
* fixed: Security fixes
* unresolved: Thunderbird processes did not exit cleanly; user intervention was required via task manager (bmo#1891889)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected MozillaThunderbird, MozillaThunderbird-translations-common and / or MozillaThunderbird-translations- other packages.

Plugin Details

Severity: Critical

ID: 193908

File Name: suse_SU-2024-1437-1.nasl

Version: 1.7

Type: Local

Agent: unix

Family: SuSE Local Security Checks

Published: 4/26/2024

Updated: 6/25/2026

Supported Sensors: Frictionless Assessment AWS, Frictionless Assessment Azure, Frictionless Assessment Agent, Nessus Agent, Agentless Assessment, Continuous Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.9

Percentile: 97.35

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 7.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2024-3863

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 8.8

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

CPE: cpe:/o:novell:suse_linux:15, p-cpe:/a:novell:suse_linux:mozillathunderbird, p-cpe:/a:novell:suse_linux:mozillathunderbird-translations-common, p-cpe:/a:novell:suse_linux:mozillathunderbird-translations-other

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/SuSE/release, Host/SuSE/rpm-list

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 4/25/2024

Vulnerability Publication Date: 3/19/2024

Reference Information

CVE: CVE-2024-2609, CVE-2024-3302, CVE-2024-3852, CVE-2024-3854, CVE-2024-3857, CVE-2024-3859, CVE-2024-3861, CVE-2024-3863, CVE-2024-3864

IAVA: 2024-A-0257-S

SuSE: SUSE-SU-2024:1437-1

Detections

Analytics