CVE-2024-9398 - firefox: thunderbird: External protocol handlers could be enumerated via popups

Back Back to CVE browser

MEDIUM

firefox: thunderbird: External protocol handlers could be enumerated via popups

Published Oct 1, 2024

5.3

MEDIUM

CVSS 3.1

EPSS 0.57%

Description

By checking the result of calls to `window.open` with specifically set protocol handlers, an attacker could determine if the application which implements that protocol handler is installed. This vulnerability affects Firefox < 131, Firefox ESR < 128.3, Thunderbird < 128.3, and Thunderbird < 131.

Affected products

Vendor Mozilla Product Firefox Default
unknown
Affected
- ≥ unspecified, < 131
Vendor Mozilla Product Firefox ESR Default
unknown
Affected
- ≥ unspecified, < 128.3
Vendor Mozilla Product Thunderbird Default
unknown
Affected
- ≥ unspecified, < 128.3
- ≥ unspecified, < 131

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
Mozilla	Firefox	unknown	Affected ≥ unspecified, < 131
Mozilla	Firefox ESR	unknown	Affected ≥ unspecified, < 128.3
Mozilla	Thunderbird	unknown	Affected ≥ unspecified, < 128.3 ≥ unspecified, < 131

Red Hat Enterprise Linux 7 Extended Lifecycle Support

firefox-0:128.3.0-1.el7_9

Fixed · RHSA-2024:7702
Red Hat Enterprise Linux 8

firefox-0:128.3.0-1.el8_10

Fixed · RHSA-2024:7700
Red Hat Enterprise Linux 8

thunderbird-0:128.3.0-1.el8_10

Fixed · RHSA-2024:7699
Red Hat Enterprise Linux 8.2 Advanced Update Support

firefox-0:128.3.0-1.el8_2

Fixed · RHSA-2024:7646
Red Hat Enterprise Linux 8.2 Advanced Update Support

thunderbird-0:128.3.0-1.el8_2

Fixed · RHSA-2024:7856
Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support

firefox-0:128.3.0-1.el8_4

Fixed · RHSA-2024:7703
Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support

thunderbird-0:128.3.0-1.el8_4

Fixed · RHSA-2024:7854
Red Hat Enterprise Linux 8.4 Telecommunications Update Service

firefox-0:128.3.0-1.el8_4

Fixed · RHSA-2024:7703
Red Hat Enterprise Linux 8.4 Telecommunications Update Service

thunderbird-0:128.3.0-1.el8_4

Fixed · RHSA-2024:7854
Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions

firefox-0:128.3.0-1.el8_4

Fixed · RHSA-2024:7703
Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions

thunderbird-0:128.3.0-1.el8_4

Fixed · RHSA-2024:7854
Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support

firefox-0:128.3.0-1.el8_6

Fixed · RHSA-2024:7704
Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support

thunderbird-0:128.3.0-1.el8_6

Fixed · RHSA-2024:8169
Red Hat Enterprise Linux 8.6 Telecommunications Update Service

firefox-0:128.3.0-1.el8_6

Fixed · RHSA-2024:7704
Red Hat Enterprise Linux 8.6 Telecommunications Update Service

thunderbird-0:128.3.0-1.el8_6

Fixed · RHSA-2024:8169
Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions

firefox-0:128.3.0-1.el8_6

Fixed · RHSA-2024:7704
Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions

thunderbird-0:128.3.0-1.el8_6

Fixed · RHSA-2024:8169
Red Hat Enterprise Linux 8.8 Extended Update Support

firefox-0:128.3.0-1.el8_8

Fixed · RHSA-2024:7842
Red Hat Enterprise Linux 8.8 Extended Update Support

thunderbird-0:128.3.1-1.el8_8

Fixed · RHSA-2024:8166
Red Hat Enterprise Linux 9

thunderbird-0:128.3.0-1.el9_4

Fixed · RHSA-2024:7552
Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions

firefox-0:128.3.0-1.el9_0

Fixed · RHSA-2024:7621
Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions

thunderbird-0:128.3.0-1.el9_0

Fixed · RHSA-2024:7855
Red Hat Enterprise Linux 9.2 Extended Update Support

firefox-0:128.3.0-1.el9_2

Fixed · RHSA-2024:7622
Red Hat Enterprise Linux 9.2 Extended Update Support

thunderbird-0:128.3.0-1.el9_2

Fixed · RHSA-2024:7853
Red Hat Enterprise Linux 10

firefox

Affected
Red Hat Enterprise Linux 10

thunderbird

Affected
Red Hat Enterprise Linux 6

firefox

Out of support scope
Red Hat Enterprise Linux 6

thunderbird

Out of support scope
Red Hat Enterprise Linux 7

thunderbird

Out of support scope
Red Hat Enterprise Linux 9

firefox

Affected
Red Hat Enterprise Linux 9

firefox-flatpak-container

Affected
Red Hat Enterprise Linux 9

thunderbird-flatpak-container

Affected

Product	Package	State	Advisory
Red Hat Enterprise Linux 7 Extended Lifecycle Support	firefox-0:128.3.0-1.el7_9	Fixed	RHSA-2024:7702
Red Hat Enterprise Linux 8	firefox-0:128.3.0-1.el8_10	Fixed	RHSA-2024:7700
Red Hat Enterprise Linux 8	thunderbird-0:128.3.0-1.el8_10	Fixed	RHSA-2024:7699
Red Hat Enterprise Linux 8.2 Advanced Update Support	firefox-0:128.3.0-1.el8_2	Fixed	RHSA-2024:7646
Red Hat Enterprise Linux 8.2 Advanced Update Support	thunderbird-0:128.3.0-1.el8_2	Fixed	RHSA-2024:7856
Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support	firefox-0:128.3.0-1.el8_4	Fixed	RHSA-2024:7703
Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support	thunderbird-0:128.3.0-1.el8_4	Fixed	RHSA-2024:7854
Red Hat Enterprise Linux 8.4 Telecommunications Update Service	firefox-0:128.3.0-1.el8_4	Fixed	RHSA-2024:7703
Red Hat Enterprise Linux 8.4 Telecommunications Update Service	thunderbird-0:128.3.0-1.el8_4	Fixed	RHSA-2024:7854
Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions	firefox-0:128.3.0-1.el8_4	Fixed	RHSA-2024:7703
Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions	thunderbird-0:128.3.0-1.el8_4	Fixed	RHSA-2024:7854
Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support	firefox-0:128.3.0-1.el8_6	Fixed	RHSA-2024:7704
Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support	thunderbird-0:128.3.0-1.el8_6	Fixed	RHSA-2024:8169
Red Hat Enterprise Linux 8.6 Telecommunications Update Service	firefox-0:128.3.0-1.el8_6	Fixed	RHSA-2024:7704
Red Hat Enterprise Linux 8.6 Telecommunications Update Service	thunderbird-0:128.3.0-1.el8_6	Fixed	RHSA-2024:8169
Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions	firefox-0:128.3.0-1.el8_6	Fixed	RHSA-2024:7704
Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions	thunderbird-0:128.3.0-1.el8_6	Fixed	RHSA-2024:8169
Red Hat Enterprise Linux 8.8 Extended Update Support	firefox-0:128.3.0-1.el8_8	Fixed	RHSA-2024:7842
Red Hat Enterprise Linux 8.8 Extended Update Support	thunderbird-0:128.3.1-1.el8_8	Fixed	RHSA-2024:8166
Red Hat Enterprise Linux 9	thunderbird-0:128.3.0-1.el9_4	Fixed	RHSA-2024:7552
Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions	firefox-0:128.3.0-1.el9_0	Fixed	RHSA-2024:7621
Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions	thunderbird-0:128.3.0-1.el9_0	Fixed	RHSA-2024:7855
Red Hat Enterprise Linux 9.2 Extended Update Support	firefox-0:128.3.0-1.el9_2	Fixed	RHSA-2024:7622
Red Hat Enterprise Linux 9.2 Extended Update Support	thunderbird-0:128.3.0-1.el9_2	Fixed	RHSA-2024:7853
Red Hat Enterprise Linux 10	firefox	Affected	n/a
Red Hat Enterprise Linux 10	thunderbird	Affected	n/a
Red Hat Enterprise Linux 6	firefox	Out of support scope	n/a
Red Hat Enterprise Linux 6	thunderbird	Out of support scope	n/a
Red Hat Enterprise Linux 7	thunderbird	Out of support scope	n/a
Red Hat Enterprise Linux 9	firefox	Affected	n/a
Red Hat Enterprise Linux 9	firefox-flatpak-container	Affected	n/a
Red Hat Enterprise Linux 9	thunderbird-flatpak-container	Affected	n/a

Remediation

Red Hat statement

Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.

Weaknesses (1)

CWE-203

References (10)

https://access.redhat.com/security/cve/CVE-2024-9398
Vendor Advisory
https://bugzilla.mozilla.org/show_bug.cgi?id=1881037
Issue TrackingPermissions Required
https://bugzilla.redhat.com/show_bug.cgi?id=2315952
Issue Tracking
https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-49913
Advisory
https://nvd.nist.gov/vuln/detail/CVE-2024-9398
https://www.cve.org/CVERecord?id=CVE-2024-9398
https://www.mozilla.org/security/advisories/mfsa2024-46/
Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2024-47/
Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2024-49/
Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2024-50/
Vendor Advisory

Link	Providers	Tags
https://access.redhat.com/security/cve/CVE-2024-9398		Vendor Advisory
https://bugzilla.mozilla.org/show_bug.cgi?id=1881037		Issue TrackingPermissions Required
https://bugzilla.redhat.com/show_bug.cgi?id=2315952		Issue Tracking
https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-49913		Advisory
https://nvd.nist.gov/vuln/detail/CVE-2024-9398
https://www.cve.org/CVERecord?id=CVE-2024-9398
https://www.mozilla.org/security/advisories/mfsa2024-46/		Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2024-47/		Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2024-49/		Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2024-50/		Vendor Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner mozilla

Published Oct 1, 2024

Updated Mar 18, 2025

Reserved Oct 1, 2024

Link CVE-2024-9398

CISA Vulnrichment

Updated Mar 18, 2025

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2024-9398

Red Hat

Severity Low

Public date Oct 1, 2024

Bugzilla 2315952

Link CVE-2024-9398

ENISA EUVD

Assigner mozilla

Published Oct 1, 2024

Updated Mar 18, 2025

Link EUVD-2024-49913

GitHub

No data