CVE-2024-8394 — Use After Free in Mozilla Thunderbird

Vendor	Product	Version range	Fixed in
debian	thunderbird	< thunderbird 1:128.2.0esr-1 (forky)	thunderbird 1:128.2.0esr-1 (forky)
mozilla	firefox	—	—
mozilla	thunderbird	< 128.2.0	128.2.0
mozilla	thunderbird	>= 0 < 1:128.2.0esr-1	1:128.2.0esr-1
mozilla	thunderbird	>= 0 < 1:128.2.0esr-1	1:128.2.0esr-1
mozilla	thunderbird	>= unspecified < 128.2	128.2

Red Hat

thunderbird: Crash when aborting verification of OTR chat

vendor_redhat·2024-09-06·CVSS 6.5

CVE-2024-8394 [MEDIUM] CWE-416 thunderbird: Crash when aborting verification of OTR chat thunderbird: Crash when aborting verification of OTR chat When aborting the verification of an OTR chat session, an attacker could have caused a use-after-free bug leading to a potentially exploitable crash. This vulnerability affects Thunderbird < 128.2. A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes this flaw as follows: When aborting the verification of an OTR chat session, an attacker could have caused a use-after-free bug leading to a potentially exploitable crash. Statement: Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory. Mitigation: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising eas

Debian

CVE-2024-8394: thunderbird - When aborting the verification of an OTR chat session, an attacker could have ca...

vendor_debian·2024·CVSS 6.5

CVE-2024-8394 [MEDIUM] CVE-2024-8394: thunderbird - When aborting the verification of an OTR chat session, an attacker could have ca... When aborting the verification of an OTR chat session, an attacker could have caused a use-after-free bug leading to a potentially exploitable crash. This vulnerability affects Thunderbird < 128.2. Scope: local bookworm: resolved bullseye: resolved forky: resolved (fixed in 1:128.2.0esr-1) sid: resolved (fixed in 1:128.2.0esr-1) trixie: resolved (fixed in 1:128.2.0esr-1)

Mozilla

Mozilla Foundation Security Advisory 2024-43: CVE-2024-8394

vendor_mozilla·CVSS 6.5

CVE-2024-8394 [MEDIUM] Mozilla Foundation Security Advisory 2024-43: CVE-2024-8394 Mozilla Foundation Security Advisory 2024-43 CVE: CVE-2024-8394 Product: Thunderbird Impact: high Fixed in: Thunderbird 128.2

OSV

CVE-2024-8394: When aborting the verification of an OTR chat session, an attacker could have caused a use-after-free bug leading to a potentially exploitable crash

osv·2024-09-06·CVSS 6.5

CVE-2024-8394 [MEDIUM] CVE-2024-8394: When aborting the verification of an OTR chat session, an attacker could have caused a use-after-free bug leading to a potentially exploitable crash When aborting the verification of an OTR chat session, an attacker could have caused a use-after-free bug leading to a potentially exploitable crash. This vulnerability affects Thunderbird < 128.2.

GHSA

GHSA-688v-74jq-v222: When aborting the verification of an OTR chat session, an attacker could have caused a use-after-free bug leading to a potentially exploitable crash

ghsa_unreviewed·2024-09-06

CVE-2024-8394 [MEDIUM] CWE-416 GHSA-688v-74jq-v222: When aborting the verification of an OTR chat session, an attacker could have caused a use-after-free bug leading to a potentially exploitable crash When aborting the verification of an OTR chat session, an attacker could have caused a use-after-free bug leading to a potentially exploitable crash. This vulnerability affects Thunderbird < 128.2.

CVE-2024-8394: When aborting the verification of an OTR chat session, an attacker could have caused a use-after-free bug leading to a potentially exploitable crash. This…

Affected

CVSS provenance