[USN-7066-1] Thunderbird vulnerability
[USN-7065-1] Firefox vulnerability
[USN-7066-1] Thunderbird vulnerability
==========================================================================
Ubuntu Security Notice USN-7066-1
October 14, 2024
thunderbird vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
Summary:
Thunderbird could be made to crash or run programs if it opened a specially
crafted file.
Software Description:
- thunderbird: Mozilla Open Source mail and newsgroup client
Details:
Damien Schaeffer discovered that Thunderbird did not properly manage
certain memory operations when processing content in the Animation
timelines. An attacker could potentially exploit this issue to achieve
arbitrary code execution.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 22.04 LTS
thunderbird 1:115.16.0+build2-0ubuntu0.22.04.1
Ubuntu 20.04 LTS
thunderbird 1:115.16.0+build2-0ubuntu0.20.04.1
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-7066-1
CVE-2024-9680
Package Information:
https://launchpad.net/ubuntu/+source/thunderbird/1:115.16.0+build2-0ubuntu0.22.04.1
https://launchpad.net/ubuntu/+source/thunderbird/1:115.16.0+build2-0ubuntu0.20.04.1
[USN-7065-1] Firefox vulnerability
==========================================================================
Ubuntu Security Notice USN-7065-1
October 14, 2024
firefox vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 20.04 LTS
Summary:
Firefox could be made to run programs as your login if it opened a
malicious website.
Software Description:
- firefox: Mozilla Open Source web browser
Details:
Damien Schaeffer discovered that Firefox did not properly manage memory in
the content process when handling Animation timelines, leading to a use
after free vulnerability. An attacker could possibly use this issue to
achieve remote code execution.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 20.04 LTS
firefox 131.0.2+build1-0ubuntu0.20.04.1
After a standard system update you need to restart Firefox to make all the
necessary changes.
References:
https://ubuntu.com/security/notices/USN-7065-1
CVE-2024-9680
Package Information:
https://launchpad.net/ubuntu/+source/firefox/131.0.2+build1-0ubuntu0.20.04.1
