[USN-7066-1] Thunderbird vulnerability

[Nishit Majithia]

==========================================================================
Ubuntu Security Notice USN-7066-1
October 14, 2024

thunderbird vulnerability
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS

Summary:

Thunderbird could be made to crash or run programs if it opened a specially
crafted file.

Software Description:
- thunderbird: Mozilla Open Source mail and newsgroup client

Details:

Damien Schaeffer discovered that Thunderbird did not properly manage
certain memory operations when processing content in the Animation
timelines. An attacker could potentially exploit this issue to achieve
arbitrary code execution.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 22.04 LTS
  thunderbird                     1:115.16.0+build2-0ubuntu0.22.04.1

Ubuntu 20.04 LTS
  thunderbird                     1:115.16.0+build2-0ubuntu0.20.04.1

In general, a standard system update will make all the necessary changes.

References:
  https://ubuntu.com/security/notices/USN-7066-1
  CVE-2024-9680

Package Information:
  https://launchpad.net/ubuntu/+source/thunderbird/1:115.16.0+build2-0ubuntu0.22.04.1
  https://launchpad.net/ubuntu/+source/thunderbird/1:115.16.0+build2-0ubuntu0.20.04.1
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 659 bytes
Desc: not available
URL: <https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20241014/196ce50d/attachment.sig>