Vulnerability-Lookup

alsa-2024:7700

Vulnerability from osv_almalinux

Published

2024-10-07 00:00

Modified

2024-10-09 08:57

Summary

Important: firefox security update

Details

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.

Security Fix(es):

firefox: 115.16/128.3 ESR ()
firefox: thunderbird: Specially crafted WebTransport requests could lead to denial of service (CVE-2024-9399)
firefox: thunderbird: Memory safety bugs fixed in Firefox 131 and Thunderbird 131 (CVE-2024-9403)
firefox: thunderbird: Potential directory upload bypass via clickjacking (CVE-2024-9397)
firefox: thunderbird: Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16, Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3 (CVE-2024-9401)
firefox: thunderbird: Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3 (CVE-2024-9402)
firefox: thunderbird: External protocol handlers could be enumerated via popups (CVE-2024-9398)
firefox: thunderbird: Potential memory corruption during JIT compilation (CVE-2024-9400)
firefox: thunderbird: Potential memory corruption may occur when cloning certain objects (CVE-2024-9396)
firefox: thunderbird: Cross-origin access to PDF contents through multipart responses (CVE-2024-9393)
firefox: thunderbird: Cross-origin access to JSON contents through multipart responses (CVE-2024-9394)
firefox: thunderbird: Compromised content process can bypass site isolation (CVE-2024-9392)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

References

URL

Type

	https://access.redhat.com/errata/RHSA-2024:7700	ADVISORY
	https://access.redhat.com/security/cve/CVE-2024-8900	REPORT
	https://access.redhat.com/security/cve/CVE-2024-9392	REPORT
	https://access.redhat.com/security/cve/CVE-2024-9393	REPORT
	https://access.redhat.com/security/cve/CVE-2024-9394	REPORT
	https://access.redhat.com/security/cve/CVE-2024-9396	REPORT
	https://access.redhat.com/security/cve/CVE-2024-9397	REPORT
	https://access.redhat.com/security/cve/CVE-2024-9398	REPORT
	https://access.redhat.com/security/cve/CVE-2024-9399	REPORT
	https://access.redhat.com/security/cve/CVE-2024-9400	REPORT
	https://access.redhat.com/security/cve/CVE-2024-9401	REPORT
	https://access.redhat.com/security/cve/CVE-2024-9402	REPORT
	https://bugzilla.redhat.com/2312914	REPORT
	https://bugzilla.redhat.com/2315945	REPORT
	https://bugzilla.redhat.com/2315949	REPORT
	https://bugzilla.redhat.com/2315950	REPORT
	https://bugzilla.redhat.com/2315951	REPORT
	https://bugzilla.redhat.com/2315952	REPORT
	https://bugzilla.redhat.com/2315953	REPORT
	https://bugzilla.redhat.com/2315954	REPORT
	https://bugzilla.redhat.com/2315956	REPORT
	https://bugzilla.redhat.com/2315957	REPORT
	https://bugzilla.redhat.com/2315959	REPORT
	https://errata.almalinux.org/8/ALSA-2024-7700.html	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "AlmaLinux:8",
        "name": "firefox"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "128.3.0-1.el8_10.alma.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.\n\nSecurity Fix(es):\n\n* firefox: 115.16/128.3 ESR ()\n* firefox: thunderbird: Specially crafted WebTransport requests could lead to denial of service (CVE-2024-9399)\n* firefox: thunderbird: Memory safety bugs fixed in Firefox 131 and Thunderbird 131 (CVE-2024-9403)\n* firefox: thunderbird: Potential directory upload bypass via clickjacking (CVE-2024-9397)\n* firefox: thunderbird: Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16, Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3 (CVE-2024-9401)\n* firefox: thunderbird: Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3 (CVE-2024-9402)\n* firefox: thunderbird: External protocol handlers could be enumerated via popups (CVE-2024-9398)\n* firefox: thunderbird: Potential memory corruption during JIT compilation (CVE-2024-9400)\n* firefox: thunderbird: Potential memory corruption may occur when cloning certain objects (CVE-2024-9396)\n* firefox: thunderbird: Cross-origin access to PDF contents through multipart responses (CVE-2024-9393)\n* firefox: thunderbird: Cross-origin access to JSON contents through multipart responses (CVE-2024-9394)\n* firefox: thunderbird: Compromised content process can bypass site isolation (CVE-2024-9392)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
  "id": "ALSA-2024:7700",
  "modified": "2024-10-09T08:57:20Z",
  "published": "2024-10-07T00:00:00Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://access.redhat.com/errata/RHSA-2024:7700"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2024-8900"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2024-9392"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2024-9393"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2024-9394"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2024-9396"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2024-9397"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2024-9398"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2024-9399"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2024-9400"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2024-9401"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2024-9402"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2312914"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2315945"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2315949"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2315950"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2315951"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2315952"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2315953"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2315954"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2315956"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2315957"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2315959"
    },
    {
      "type": "ADVISORY",
      "url": "https://errata.almalinux.org/8/ALSA-2024-7700.html"
    }
  ],
  "related": [
    "CVE-2024-9399",
    "CVE-2024-9403",
    "CVE-2024-9397",
    "CVE-2024-9401",
    "CVE-2024-9402",
    "CVE-2024-9398",
    "CVE-2024-9400",
    "CVE-2024-9396",
    "CVE-2024-9393",
    "CVE-2024-9394",
    "CVE-2024-9392"
  ],
  "summary": "Important: firefox security update"
}

CVE-2024-9403 (GCVE-0-2024-9403)

Vulnerability from cvelistv5 – Published: 2024-10-01 15:13 – Updated: 2025-03-19 18:05

Summary

Memory safety bugs present in Firefox 130. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 131 and Thunderbird < 131.

Severity

7.3 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

CWE

Memory safety bugs fixed in Firefox 131 and Thunderbird 131

Assigner

mozilla

References

3 references

URL	Tags
https://bugzilla.mozilla.org/show_bug.cgi?id=1917807
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…

Impacted products

2 products

Vendor	Product	Version
Mozilla	Firefox	Affected: unspecified , < 131 (custom)
Mozilla	Thunderbird	Affected: unspecified , < 131 (custom)

Credits

The Mozilla Fuzzing Team

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:mozilla:firefox:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "firefox",
            "vendor": "mozilla",
            "versions": [
              {
                "lessThan": "131",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:mozilla:thunderbird:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "thunderbird",
            "vendor": "mozilla",
            "versions": [
              {
                "lessThan": "131",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "LOW",
              "baseScore": 7.3,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "LOW",
              "integrityImpact": "LOW",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-9403",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-01T18:34:25.739028Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-119",
                "description": "CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-03-19T18:05:46.429Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThan": "131",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThan": "131",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "The Mozilla Fuzzing Team"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Memory safety bugs present in Firefox 130. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox \u003c 131 and Thunderbird \u003c 131."
            }
          ],
          "value": "Memory safety bugs present in Firefox 130. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox \u003c 131 and Thunderbird \u003c 131."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Memory safety bugs fixed in Firefox 131 and Thunderbird 131",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-10-01T15:13:22.837Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "name": "Memory safety bugs fixed in Firefox 131 and Thunderbird 131",
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1917807"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2024-46/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2024-50/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2024-9403",
    "datePublished": "2024-10-01T15:13:22.837Z",
    "dateReserved": "2024-10-01T06:10:26.867Z",
    "dateUpdated": "2025-03-19T18:05:46.429Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

alsa-2024:7700

Vulnerability from osv_almalinux

CVE-2024-9403 (GCVE-0-2024-9403)

Tags

Sightings

Nomenclature