CVE-2024-5696: High severity Mozilla Thunderbird vulnerability
By manipulating the text in an <input> tag, an attacker could have caused corrupt memory leading to a potentially exploitable crash. This vulnerability affects Firefox < 127, Firefox ESR < 115.12, and Thunderbird < 115.12.
Other sources
By manipulating the text in an <input> tag, an attacker could have caused corrupt memory leading to a potentially exploitable crash.
External Reference: https://www.mozilla.org/en-US/security/advisories/mfsa2024-26/#CVE-2024-5696
— Red Hat
By manipulating the text in an <input> tag, an attacker could have caused corrupt memory leading to a potentially exploitable crash.
— Mozilla
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/firefoxto a version that resolves this vulnerability.Fixed in 131.0.3-1 - Upgrade
Upgrade
debian/firefox-esrto a version that resolves this vulnerability.Fixed in 115.14.0esr-1~deb11u1Fixed in 128.3.1esr-1~deb11u1Fixed in 115.14.0esr-1~deb12u1Fixed in 128.3.1esr-1~deb12u1Fixed in 128.3.1esr-2 - Upgrade
Upgrade
debian/thunderbirdto a version that resolves this vulnerability.Fixed in 1:115.12.0-1~deb11u1Fixed in 1:115.16.0esr-1~deb11u1Fixed in 1:115.12.0-1~deb12u1Fixed in 1:115.16.0esr-1~deb12u1Fixed in 1:128.2.0esr-1Fixed in 1:128.3.0esr-1 - Upgrade
Upgrade
Thunderbirdto a version that resolves this vulnerability.Fixed in 115.12 - Upgrade
Upgrade
Firefoxto a version that resolves this vulnerability.Fixed in 127 - Upgrade
Upgrade
Firefox ESRto a version that resolves this vulnerability.Fixed in 115.12 - Upgrade
Upgrade
redhat/firefoxto a version that resolves this vulnerability.Fixed in 115.12 - Upgrade
Upgrade
redhat/thunderbirdto a version that resolves this vulnerability.Fixed in 115.12
Event History
Parent advisories
This vulnerability appears in the following advisories.
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2024-5696?
CVE-2024-5696 has a severity rating that indicates a high potential for exploitation due to memory corruption issues.
How do I fix CVE-2024-5696?
To fix CVE-2024-5696, update your Mozilla Firefox ESR, Thunderbird, or related packages to the recommended versions listed in the advisory.
Which versions are affected by CVE-2024-5696?
CVE-2024-5696 affects Mozilla Firefox ESR versions up to 115.12, Thunderbird versions up to 115.12, and various package versions specified in the advisory.
What products are impacted by CVE-2024-5696?
CVE-2024-5696 impacts Mozilla Firefox, Mozilla Thunderbird, and their respective packages on several platforms.
What kind of attack vector is associated with CVE-2024-5696?
CVE-2024-5696 can be exploited through malicious manipulation of text within an <input> tag, potentially causing application crashes.