CVE-2024-8394
published 2024-09-06CVE-2024-8394: When aborting the verification of an OTR chat session, an attacker could have caused a use-after-free bug leading to a potentially exploitable crash. This…
PriorityP429medium6.5CVSS 3.1
AVNACLPRNUIRSUCNINAH
EPSS
0.31%
23.6th percentile
When aborting the verification of an OTR chat session, an attacker could have caused a use-after-free bug leading to a potentially exploitable crash. This vulnerability affects Thunderbird < 128.2.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | thunderbird | < thunderbird 1:128.2.0esr-1 (forky) | thunderbird 1:128.2.0esr-1 (forky) |
| mozilla | firefox | — | — |
| mozilla | thunderbird | < 128.2.0 | 128.2.0 |
| mozilla | thunderbird | >= 0 < 1:128.2.0esr-1 | 1:128.2.0esr-1 |
| mozilla | thunderbird | >= 0 < 1:128.2.0esr-1 | 1:128.2.0esr-1 |
| mozilla | thunderbird | >= unspecified < 128.2 | 128.2 |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
osv6.5MEDIUM
vendor_debian6.5LOW
vendor_redhat6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
thunderbird: Crash when aborting verification of OTR chat
vendor_redhat·2024-09-06·CVSS 6.5
CVE-2024-8394 [MEDIUM] CWE-416 thunderbird: Crash when aborting verification of OTR chat
thunderbird: Crash when aborting verification of OTR chat
When aborting the verification of an OTR chat session, an attacker could have caused a use-after-free bug leading to a potentially exploitable crash. This vulnerability affects Thunderbird < 128.2.
A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes this flaw as follows: When aborting the verification of an OTR chat session, an attacker could have caused a use-after-free bug leading to a potentially exploitable crash.
Statement: Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.
Mitigation: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising eas
Debian
CVE-2024-8394: thunderbird - When aborting the verification of an OTR chat session, an attacker could have ca...
vendor_debian·2024·CVSS 6.5
CVE-2024-8394 [MEDIUM] CVE-2024-8394: thunderbird - When aborting the verification of an OTR chat session, an attacker could have ca...
When aborting the verification of an OTR chat session, an attacker could have caused a use-after-free bug leading to a potentially exploitable crash. This vulnerability affects Thunderbird < 128.2.
Scope: local
bookworm: resolved
bullseye: resolved
forky: resolved (fixed in 1:128.2.0esr-1)
sid: resolved (fixed in 1:128.2.0esr-1)
trixie: resolved (fixed in 1:128.2.0esr-1)
Mozilla
Mozilla Foundation Security Advisory 2024-43: CVE-2024-8394
vendor_mozilla·CVSS 6.5
CVE-2024-8394 [MEDIUM] Mozilla Foundation Security Advisory 2024-43: CVE-2024-8394
Mozilla Foundation Security Advisory 2024-43
CVE: CVE-2024-8394
Product: Thunderbird
Impact: high
Fixed in: Thunderbird 128.2
OSV
CVE-2024-8394: When aborting the verification of an OTR chat session, an attacker could have caused a use-after-free bug leading to a potentially exploitable crash
osv·2024-09-06·CVSS 6.5
CVE-2024-8394 [MEDIUM] CVE-2024-8394: When aborting the verification of an OTR chat session, an attacker could have caused a use-after-free bug leading to a potentially exploitable crash
When aborting the verification of an OTR chat session, an attacker could have caused a use-after-free bug leading to a potentially exploitable crash. This vulnerability affects Thunderbird < 128.2.
GHSA
GHSA-688v-74jq-v222: When aborting the verification of an OTR chat session, an attacker could have caused a use-after-free bug leading to a potentially exploitable crash
ghsa_unreviewed·2024-09-06
CVE-2024-8394 [MEDIUM] CWE-416 GHSA-688v-74jq-v222: When aborting the verification of an OTR chat session, an attacker could have caused a use-after-free bug leading to a potentially exploitable crash
When aborting the verification of an OTR chat session, an attacker could have caused a use-after-free bug leading to a potentially exploitable crash. This vulnerability affects Thunderbird < 128.2.
No detection rules found.
No public exploits indexed.
2024-09-06
Published