csaf_redhat - rhsa-2024

rhsa-2024_6838

Vulnerability from csaf_redhat

Published

2024-09-19 11:31

Modified

2024-11-24 18:45

Summary

Red Hat Security Advisory: firefox update

Notes

Topic

An update for firefox is now available for Red Hat Enterprise Linux 7 Extended Lifecycle Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Details

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the Red Hat Enterprise Linux 7-ELS Release Notes linked from the References section.

This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for firefox is now available for Red Hat Enterprise Linux 7 Extended Lifecycle Support.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Red Hat Enterprise Linux 7-ELS Release Notes linked from the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2024:6838",
        "url": "https://access.redhat.com/errata/RHSA-2024:6838"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/7-ELS/html/7-ELS_release_notes/index",
        "url": "https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/7-ELS/html/7-ELS_release_notes/index"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_6838.json"
      }
    ],
    "title": "Red Hat Security Advisory: firefox  update",
    "tracking": {
      "current_release_date": "2024-11-24T18:45:14+00:00",
      "generator": {
        "date": "2024-11-24T18:45:14+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.2.1"
        }
      },
      "id": "RHSA-2024:6838",
      "initial_release_date": "2024-09-19T11:31:15+00:00",
      "revision_history": [
        {
          "date": "2024-09-19T11:31:15+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2024-09-19T11:31:15+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-11-24T18:45:14+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux Server (v. 7 ELS)",
                "product": {
                  "name": "Red Hat Enterprise Linux Server (v. 7 ELS)",
                  "product_id": "7Server-ELS",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:rhel_els:7"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "firefox-0:128.2.0-1.el7_9.src",
                "product": {
                  "name": "firefox-0:128.2.0-1.el7_9.src",
                  "product_id": "firefox-0:128.2.0-1.el7_9.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/firefox@128.2.0-1.el7_9?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "firefox-0:128.2.0-1.el7_9.x86_64",
                "product": {
                  "name": "firefox-0:128.2.0-1.el7_9.x86_64",
                  "product_id": "firefox-0:128.2.0-1.el7_9.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/firefox@128.2.0-1.el7_9?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "firefox-debuginfo-0:128.2.0-1.el7_9.x86_64",
                "product": {
                  "name": "firefox-debuginfo-0:128.2.0-1.el7_9.x86_64",
                  "product_id": "firefox-debuginfo-0:128.2.0-1.el7_9.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/firefox-debuginfo@128.2.0-1.el7_9?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "firefox-0:128.2.0-1.el7_9.s390x",
                "product": {
                  "name": "firefox-0:128.2.0-1.el7_9.s390x",
                  "product_id": "firefox-0:128.2.0-1.el7_9.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/firefox@128.2.0-1.el7_9?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "firefox-debuginfo-0:128.2.0-1.el7_9.s390x",
                "product": {
                  "name": "firefox-debuginfo-0:128.2.0-1.el7_9.s390x",
                  "product_id": "firefox-debuginfo-0:128.2.0-1.el7_9.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/firefox-debuginfo@128.2.0-1.el7_9?arch=s390x"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "firefox-0:128.2.0-1.el7_9.s390x as a component of Red Hat Enterprise Linux Server (v. 7 ELS)",
          "product_id": "7Server-ELS:firefox-0:128.2.0-1.el7_9.s390x"
        },
        "product_reference": "firefox-0:128.2.0-1.el7_9.s390x",
        "relates_to_product_reference": "7Server-ELS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "firefox-0:128.2.0-1.el7_9.src as a component of Red Hat Enterprise Linux Server (v. 7 ELS)",
          "product_id": "7Server-ELS:firefox-0:128.2.0-1.el7_9.src"
        },
        "product_reference": "firefox-0:128.2.0-1.el7_9.src",
        "relates_to_product_reference": "7Server-ELS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "firefox-0:128.2.0-1.el7_9.x86_64 as a component of Red Hat Enterprise Linux Server (v. 7 ELS)",
          "product_id": "7Server-ELS:firefox-0:128.2.0-1.el7_9.x86_64"
        },
        "product_reference": "firefox-0:128.2.0-1.el7_9.x86_64",
        "relates_to_product_reference": "7Server-ELS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "firefox-debuginfo-0:128.2.0-1.el7_9.s390x as a component of Red Hat Enterprise Linux Server (v. 7 ELS)",
          "product_id": "7Server-ELS:firefox-debuginfo-0:128.2.0-1.el7_9.s390x"
        },
        "product_reference": "firefox-debuginfo-0:128.2.0-1.el7_9.s390x",
        "relates_to_product_reference": "7Server-ELS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "firefox-debuginfo-0:128.2.0-1.el7_9.x86_64 as a component of Red Hat Enterprise Linux Server (v. 7 ELS)",
          "product_id": "7Server-ELS:firefox-debuginfo-0:128.2.0-1.el7_9.x86_64"
        },
        "product_reference": "firefox-debuginfo-0:128.2.0-1.el7_9.x86_64",
        "relates_to_product_reference": "7Server-ELS"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2024-7652",
      "cwe": {
        "id": "CWE-843",
        "name": "Access of Resource Using Incompatible Type (\u0027Type Confusion\u0027)"
      },
      "discovery_date": "2024-09-06T19:20:06.807597+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2310490"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes this flaw as follows: An error in the ECMA-262 specification relating to Async Generators could have resulted in a type confusion, potentially leading to memory corruption and an exploitable crash.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "mozilla: Type Confusion in Async Generators in Javascript Engine",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Server-ELS:firefox-0:128.2.0-1.el7_9.s390x",
          "7Server-ELS:firefox-0:128.2.0-1.el7_9.src",
          "7Server-ELS:firefox-0:128.2.0-1.el7_9.x86_64",
          "7Server-ELS:firefox-debuginfo-0:128.2.0-1.el7_9.s390x",
          "7Server-ELS:firefox-debuginfo-0:128.2.0-1.el7_9.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-7652"
        },
        {
          "category": "external",
          "summary": "RHBZ#2310490",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2310490"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-7652",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-7652"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-7652",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7652"
        },
        {
          "category": "external",
          "summary": "https://bugzilla.mozilla.org/show_bug.cgi?id=1901411",
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1901411"
        },
        {
          "category": "external",
          "summary": "https://github.com/tc39/ecma262/security/advisories/GHSA-g38c-wh3c-5h9r",
          "url": "https://github.com/tc39/ecma262/security/advisories/GHSA-g38c-wh3c-5h9r"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2024-29/",
          "url": "https://www.mozilla.org/security/advisories/mfsa2024-29/"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2024-30/",
          "url": "https://www.mozilla.org/security/advisories/mfsa2024-30/"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2024-31/",
          "url": "https://www.mozilla.org/security/advisories/mfsa2024-31/"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2024-32/",
          "url": "https://www.mozilla.org/security/advisories/mfsa2024-32/"
        }
      ],
      "release_date": "2024-09-06T19:15:12.710000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-09-19T11:31:15+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "7Server-ELS:firefox-0:128.2.0-1.el7_9.s390x",
            "7Server-ELS:firefox-0:128.2.0-1.el7_9.src",
            "7Server-ELS:firefox-0:128.2.0-1.el7_9.x86_64",
            "7Server-ELS:firefox-debuginfo-0:128.2.0-1.el7_9.s390x",
            "7Server-ELS:firefox-debuginfo-0:128.2.0-1.el7_9.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2024:6838"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "7Server-ELS:firefox-0:128.2.0-1.el7_9.s390x",
            "7Server-ELS:firefox-0:128.2.0-1.el7_9.src",
            "7Server-ELS:firefox-0:128.2.0-1.el7_9.x86_64",
            "7Server-ELS:firefox-debuginfo-0:128.2.0-1.el7_9.s390x",
            "7Server-ELS:firefox-debuginfo-0:128.2.0-1.el7_9.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H",
            "version": "3.1"
          },
          "products": [
            "7Server-ELS:firefox-0:128.2.0-1.el7_9.s390x",
            "7Server-ELS:firefox-0:128.2.0-1.el7_9.src",
            "7Server-ELS:firefox-0:128.2.0-1.el7_9.x86_64",
            "7Server-ELS:firefox-debuginfo-0:128.2.0-1.el7_9.s390x",
            "7Server-ELS:firefox-debuginfo-0:128.2.0-1.el7_9.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "mozilla: Type Confusion in Async Generators in Javascript Engine"
    },
    {
      "cve": "CVE-2024-8381",
      "cwe": {
        "id": "CWE-704",
        "name": "Incorrect Type Conversion or Cast"
      },
      "discovery_date": "2024-09-03T13:20:09.820143+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2309427"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "The Mozilla Foundation\u0027s Security Advisory: A potentially exploitable type confusion could be triggered when looking up a property name on an object being used as the with environment.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "mozilla: Type confusion when looking up a property name in a \u0026quot;with\u0026quot; block",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Server-ELS:firefox-0:128.2.0-1.el7_9.s390x",
          "7Server-ELS:firefox-0:128.2.0-1.el7_9.src",
          "7Server-ELS:firefox-0:128.2.0-1.el7_9.x86_64",
          "7Server-ELS:firefox-debuginfo-0:128.2.0-1.el7_9.s390x",
          "7Server-ELS:firefox-debuginfo-0:128.2.0-1.el7_9.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-8381"
        },
        {
          "category": "external",
          "summary": "RHBZ#2309427",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2309427"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-8381",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-8381"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-8381",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-8381"
        },
        {
          "category": "external",
          "summary": "https://bugzilla.mozilla.org/show_bug.cgi?id=1912715",
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1912715"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2024-39/",
          "url": "https://www.mozilla.org/security/advisories/mfsa2024-39/"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2024-40/",
          "url": "https://www.mozilla.org/security/advisories/mfsa2024-40/"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2024-41/",
          "url": "https://www.mozilla.org/security/advisories/mfsa2024-41/"
        }
      ],
      "release_date": "2024-09-03T13:15:05.553000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-09-19T11:31:15+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "7Server-ELS:firefox-0:128.2.0-1.el7_9.s390x",
            "7Server-ELS:firefox-0:128.2.0-1.el7_9.src",
            "7Server-ELS:firefox-0:128.2.0-1.el7_9.x86_64",
            "7Server-ELS:firefox-debuginfo-0:128.2.0-1.el7_9.s390x",
            "7Server-ELS:firefox-debuginfo-0:128.2.0-1.el7_9.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2024:6838"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "7Server-ELS:firefox-0:128.2.0-1.el7_9.s390x",
            "7Server-ELS:firefox-0:128.2.0-1.el7_9.src",
            "7Server-ELS:firefox-0:128.2.0-1.el7_9.x86_64",
            "7Server-ELS:firefox-debuginfo-0:128.2.0-1.el7_9.s390x",
            "7Server-ELS:firefox-debuginfo-0:128.2.0-1.el7_9.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "mozilla: Type confusion when looking up a property name in a \u0026quot;with\u0026quot; block"
    },
    {
      "cve": "CVE-2024-8382",
      "cwe": {
        "id": "CWE-497",
        "name": "Exposure of Sensitive System Information to an Unauthorized Control Sphere"
      },
      "discovery_date": "2024-09-03T13:20:12.041906+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2309428"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "The Mozilla Foundation\u0027s Security Advisory: Internal browser event interfaces were exposed to web content when privileged EventHandler listener callbacks ran for those events. Web content that tried to use those interfaces would not be able to use them with elevated privileges, but their presence would indicate certain browser features had been used, such as when a user opened the Dev Tools console.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "mozilla: Internal event interfaces were exposed to web content when browser EventHandler listener callbacks ran",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Server-ELS:firefox-0:128.2.0-1.el7_9.s390x",
          "7Server-ELS:firefox-0:128.2.0-1.el7_9.src",
          "7Server-ELS:firefox-0:128.2.0-1.el7_9.x86_64",
          "7Server-ELS:firefox-debuginfo-0:128.2.0-1.el7_9.s390x",
          "7Server-ELS:firefox-debuginfo-0:128.2.0-1.el7_9.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-8382"
        },
        {
          "category": "external",
          "summary": "RHBZ#2309428",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2309428"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-8382",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-8382"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-8382",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-8382"
        },
        {
          "category": "external",
          "summary": "https://bugzilla.mozilla.org/show_bug.cgi?id=1906744",
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1906744"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2024-39/",
          "url": "https://www.mozilla.org/security/advisories/mfsa2024-39/"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2024-40/",
          "url": "https://www.mozilla.org/security/advisories/mfsa2024-40/"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2024-41/",
          "url": "https://www.mozilla.org/security/advisories/mfsa2024-41/"
        }
      ],
      "release_date": "2024-09-03T13:15:05.630000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-09-19T11:31:15+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "7Server-ELS:firefox-0:128.2.0-1.el7_9.s390x",
            "7Server-ELS:firefox-0:128.2.0-1.el7_9.src",
            "7Server-ELS:firefox-0:128.2.0-1.el7_9.x86_64",
            "7Server-ELS:firefox-debuginfo-0:128.2.0-1.el7_9.s390x",
            "7Server-ELS:firefox-debuginfo-0:128.2.0-1.el7_9.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2024:6838"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "7Server-ELS:firefox-0:128.2.0-1.el7_9.s390x",
            "7Server-ELS:firefox-0:128.2.0-1.el7_9.src",
            "7Server-ELS:firefox-0:128.2.0-1.el7_9.x86_64",
            "7Server-ELS:firefox-debuginfo-0:128.2.0-1.el7_9.s390x",
            "7Server-ELS:firefox-debuginfo-0:128.2.0-1.el7_9.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "7Server-ELS:firefox-0:128.2.0-1.el7_9.s390x",
            "7Server-ELS:firefox-0:128.2.0-1.el7_9.src",
            "7Server-ELS:firefox-0:128.2.0-1.el7_9.x86_64",
            "7Server-ELS:firefox-debuginfo-0:128.2.0-1.el7_9.s390x",
            "7Server-ELS:firefox-debuginfo-0:128.2.0-1.el7_9.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "mozilla: Internal event interfaces were exposed to web content when browser EventHandler listener callbacks ran"
    },
    {
      "cve": "CVE-2024-8383",
      "cwe": {
        "id": "CWE-862",
        "name": "Missing Authorization"
      },
      "discovery_date": "2024-09-03T13:20:14.298352+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2309429"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "The Mozilla Foundation\u0027s Security Advisory: Firefox normally asks for confirmation before asking the operating system to find an application to handle a scheme that the browser does not support. It did not ask before doing so for the Usenet-related schemes news: and snews:. Since most operating systems don\u0027t have a trusted newsreader installed by default, an unscrupulous program that the user downloaded could register itself as a handler. The website that served the application download could then launch that application at will.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "mozilla: Firefox did not ask before openings news: links in an external application",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Server-ELS:firefox-0:128.2.0-1.el7_9.s390x",
          "7Server-ELS:firefox-0:128.2.0-1.el7_9.src",
          "7Server-ELS:firefox-0:128.2.0-1.el7_9.x86_64",
          "7Server-ELS:firefox-debuginfo-0:128.2.0-1.el7_9.s390x",
          "7Server-ELS:firefox-debuginfo-0:128.2.0-1.el7_9.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-8383"
        },
        {
          "category": "external",
          "summary": "RHBZ#2309429",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2309429"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-8383",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-8383"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-8383",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-8383"
        },
        {
          "category": "external",
          "summary": "https://bugzilla.mozilla.org/show_bug.cgi?id=1908496",
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1908496"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2024-39/",
          "url": "https://www.mozilla.org/security/advisories/mfsa2024-39/"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2024-40/",
          "url": "https://www.mozilla.org/security/advisories/mfsa2024-40/"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2024-41/",
          "url": "https://www.mozilla.org/security/advisories/mfsa2024-41/"
        }
      ],
      "release_date": "2024-09-03T13:15:05.687000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-09-19T11:31:15+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "7Server-ELS:firefox-0:128.2.0-1.el7_9.s390x",
            "7Server-ELS:firefox-0:128.2.0-1.el7_9.src",
            "7Server-ELS:firefox-0:128.2.0-1.el7_9.x86_64",
            "7Server-ELS:firefox-debuginfo-0:128.2.0-1.el7_9.s390x",
            "7Server-ELS:firefox-debuginfo-0:128.2.0-1.el7_9.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2024:6838"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "7Server-ELS:firefox-0:128.2.0-1.el7_9.s390x",
            "7Server-ELS:firefox-0:128.2.0-1.el7_9.src",
            "7Server-ELS:firefox-0:128.2.0-1.el7_9.x86_64",
            "7Server-ELS:firefox-debuginfo-0:128.2.0-1.el7_9.s390x",
            "7Server-ELS:firefox-debuginfo-0:128.2.0-1.el7_9.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "mozilla: Firefox did not ask before openings news: links in an external application"
    },
    {
      "cve": "CVE-2024-8384",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "discovery_date": "2024-09-03T13:20:16.882822+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2309430"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "The Mozilla Foundation\u0027s Security Advisory: The JavaScript garbage collector could mis-color cross-compartment objects if OOM conditions were detected at the right point between two passes. This could have led to memory corruption.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "mozilla: Garbage collection could mis-color cross-compartment objects in OOM conditions",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Server-ELS:firefox-0:128.2.0-1.el7_9.s390x",
          "7Server-ELS:firefox-0:128.2.0-1.el7_9.src",
          "7Server-ELS:firefox-0:128.2.0-1.el7_9.x86_64",
          "7Server-ELS:firefox-debuginfo-0:128.2.0-1.el7_9.s390x",
          "7Server-ELS:firefox-debuginfo-0:128.2.0-1.el7_9.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-8384"
        },
        {
          "category": "external",
          "summary": "RHBZ#2309430",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2309430"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-8384",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-8384"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-8384",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-8384"
        },
        {
          "category": "external",
          "summary": "https://bugzilla.mozilla.org/show_bug.cgi?id=1911288",
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1911288"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2024-39/",
          "url": "https://www.mozilla.org/security/advisories/mfsa2024-39/"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2024-40/",
          "url": "https://www.mozilla.org/security/advisories/mfsa2024-40/"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2024-41/",
          "url": "https://www.mozilla.org/security/advisories/mfsa2024-41/"
        }
      ],
      "release_date": "2024-09-03T13:15:05.743000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-09-19T11:31:15+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "7Server-ELS:firefox-0:128.2.0-1.el7_9.s390x",
            "7Server-ELS:firefox-0:128.2.0-1.el7_9.src",
            "7Server-ELS:firefox-0:128.2.0-1.el7_9.x86_64",
            "7Server-ELS:firefox-debuginfo-0:128.2.0-1.el7_9.s390x",
            "7Server-ELS:firefox-debuginfo-0:128.2.0-1.el7_9.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2024:6838"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "7Server-ELS:firefox-0:128.2.0-1.el7_9.s390x",
            "7Server-ELS:firefox-0:128.2.0-1.el7_9.src",
            "7Server-ELS:firefox-0:128.2.0-1.el7_9.x86_64",
            "7Server-ELS:firefox-debuginfo-0:128.2.0-1.el7_9.s390x",
            "7Server-ELS:firefox-debuginfo-0:128.2.0-1.el7_9.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "mozilla: Garbage collection could mis-color cross-compartment objects in OOM conditions"
    },
    {
      "cve": "CVE-2024-8385",
      "cwe": {
        "id": "CWE-843",
        "name": "Access of Resource Using Incompatible Type (\u0027Type Confusion\u0027)"
      },
      "discovery_date": "2024-09-03T13:20:19.187075+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2309431"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "The Mozilla Foundation\u0027s Security Advisory: A difference in the handling of StructFields and ArrayTypes in WASM could be used to trigger an exploitable type confusion vulnerability.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "mozilla: WASM type confusion involving ArrayTypes",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Server-ELS:firefox-0:128.2.0-1.el7_9.s390x",
          "7Server-ELS:firefox-0:128.2.0-1.el7_9.src",
          "7Server-ELS:firefox-0:128.2.0-1.el7_9.x86_64",
          "7Server-ELS:firefox-debuginfo-0:128.2.0-1.el7_9.s390x",
          "7Server-ELS:firefox-debuginfo-0:128.2.0-1.el7_9.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-8385"
        },
        {
          "category": "external",
          "summary": "RHBZ#2309431",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2309431"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-8385",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-8385"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-8385",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-8385"
        },
        {
          "category": "external",
          "summary": "https://bugzilla.mozilla.org/show_bug.cgi?id=1911909",
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1911909"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2024-39/",
          "url": "https://www.mozilla.org/security/advisories/mfsa2024-39/"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2024-40/",
          "url": "https://www.mozilla.org/security/advisories/mfsa2024-40/"
        }
      ],
      "release_date": "2024-09-03T13:15:05.803000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-09-19T11:31:15+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "7Server-ELS:firefox-0:128.2.0-1.el7_9.s390x",
            "7Server-ELS:firefox-0:128.2.0-1.el7_9.src",
            "7Server-ELS:firefox-0:128.2.0-1.el7_9.x86_64",
            "7Server-ELS:firefox-debuginfo-0:128.2.0-1.el7_9.s390x",
            "7Server-ELS:firefox-debuginfo-0:128.2.0-1.el7_9.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2024:6838"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "7Server-ELS:firefox-0:128.2.0-1.el7_9.s390x",
            "7Server-ELS:firefox-0:128.2.0-1.el7_9.src",
            "7Server-ELS:firefox-0:128.2.0-1.el7_9.x86_64",
            "7Server-ELS:firefox-debuginfo-0:128.2.0-1.el7_9.s390x",
            "7Server-ELS:firefox-debuginfo-0:128.2.0-1.el7_9.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "7Server-ELS:firefox-0:128.2.0-1.el7_9.s390x",
            "7Server-ELS:firefox-0:128.2.0-1.el7_9.src",
            "7Server-ELS:firefox-0:128.2.0-1.el7_9.x86_64",
            "7Server-ELS:firefox-debuginfo-0:128.2.0-1.el7_9.s390x",
            "7Server-ELS:firefox-debuginfo-0:128.2.0-1.el7_9.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "mozilla: WASM type confusion involving ArrayTypes"
    },
    {
      "cve": "CVE-2024-8386",
      "cwe": {
        "id": "CWE-358",
        "name": "Improperly Implemented Security Check for Standard"
      },
      "discovery_date": "2024-09-03T13:20:21.369865+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2309432"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "The Mozilla Foundation\u0027s Security Advisory: If a site had been granted permission to open popup windows, it could cause Select elements to appear on top of another site to perform a spoofing attack.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "mozilla: SelectElements could be shown over another site if popups are allowed",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Server-ELS:firefox-0:128.2.0-1.el7_9.s390x",
          "7Server-ELS:firefox-0:128.2.0-1.el7_9.src",
          "7Server-ELS:firefox-0:128.2.0-1.el7_9.x86_64",
          "7Server-ELS:firefox-debuginfo-0:128.2.0-1.el7_9.s390x",
          "7Server-ELS:firefox-debuginfo-0:128.2.0-1.el7_9.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-8386"
        },
        {
          "category": "external",
          "summary": "RHBZ#2309432",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2309432"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-8386",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-8386"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-8386",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-8386"
        },
        {
          "category": "external",
          "summary": "https://bugzilla.mozilla.org/show_bug.cgi?id=1907032",
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1907032"
        },
        {
          "category": "external",
          "summary": "https://bugzilla.mozilla.org/show_bug.cgi?id=1909163",
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1909163"
        },
        {
          "category": "external",
          "summary": "https://bugzilla.mozilla.org/show_bug.cgi?id=1909529",
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1909529"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2024-39/",
          "url": "https://www.mozilla.org/security/advisories/mfsa2024-39/"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2024-40/",
          "url": "https://www.mozilla.org/security/advisories/mfsa2024-40/"
        }
      ],
      "release_date": "2024-09-03T13:15:05.860000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-09-19T11:31:15+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "7Server-ELS:firefox-0:128.2.0-1.el7_9.s390x",
            "7Server-ELS:firefox-0:128.2.0-1.el7_9.src",
            "7Server-ELS:firefox-0:128.2.0-1.el7_9.x86_64",
            "7Server-ELS:firefox-debuginfo-0:128.2.0-1.el7_9.s390x",
            "7Server-ELS:firefox-debuginfo-0:128.2.0-1.el7_9.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2024:6838"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "7Server-ELS:firefox-0:128.2.0-1.el7_9.s390x",
            "7Server-ELS:firefox-0:128.2.0-1.el7_9.src",
            "7Server-ELS:firefox-0:128.2.0-1.el7_9.x86_64",
            "7Server-ELS:firefox-debuginfo-0:128.2.0-1.el7_9.s390x",
            "7Server-ELS:firefox-debuginfo-0:128.2.0-1.el7_9.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "mozilla: SelectElements could be shown over another site if popups are allowed"
    },
    {
      "cve": "CVE-2024-8387",
      "cwe": {
        "id": "CWE-120",
        "name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
      },
      "discovery_date": "2024-09-03T13:20:24.757137+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2309433"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "The Mozilla Foundation\u0027s Security Advisory: Memory safety bugs are present in Firefox 129, Firefox ESR 128.1, and Thunderbird 128.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort, some of these could have been exploited to run arbitrary code.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "mozilla: Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2, and Thunderbird 128.2",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Server-ELS:firefox-0:128.2.0-1.el7_9.s390x",
          "7Server-ELS:firefox-0:128.2.0-1.el7_9.src",
          "7Server-ELS:firefox-0:128.2.0-1.el7_9.x86_64",
          "7Server-ELS:firefox-debuginfo-0:128.2.0-1.el7_9.s390x",
          "7Server-ELS:firefox-debuginfo-0:128.2.0-1.el7_9.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-8387"
        },
        {
          "category": "external",
          "summary": "RHBZ#2309433",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2309433"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-8387",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-8387"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-8387",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-8387"
        },
        {
          "category": "external",
          "summary": "https://bugzilla.mozilla.org/buglist.cgi?bug_id=1857607%2C1911858%2C1914009",
          "url": "https://bugzilla.mozilla.org/buglist.cgi?bug_id=1857607%2C1911858%2C1914009"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2024-39/",
          "url": "https://www.mozilla.org/security/advisories/mfsa2024-39/"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2024-40/",
          "url": "https://www.mozilla.org/security/advisories/mfsa2024-40/"
        }
      ],
      "release_date": "2024-09-03T13:15:05.917000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-09-19T11:31:15+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "7Server-ELS:firefox-0:128.2.0-1.el7_9.s390x",
            "7Server-ELS:firefox-0:128.2.0-1.el7_9.src",
            "7Server-ELS:firefox-0:128.2.0-1.el7_9.x86_64",
            "7Server-ELS:firefox-debuginfo-0:128.2.0-1.el7_9.s390x",
            "7Server-ELS:firefox-debuginfo-0:128.2.0-1.el7_9.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2024:6838"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "7Server-ELS:firefox-0:128.2.0-1.el7_9.s390x",
            "7Server-ELS:firefox-0:128.2.0-1.el7_9.src",
            "7Server-ELS:firefox-0:128.2.0-1.el7_9.x86_64",
            "7Server-ELS:firefox-debuginfo-0:128.2.0-1.el7_9.s390x",
            "7Server-ELS:firefox-debuginfo-0:128.2.0-1.el7_9.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "7Server-ELS:firefox-0:128.2.0-1.el7_9.s390x",
            "7Server-ELS:firefox-0:128.2.0-1.el7_9.src",
            "7Server-ELS:firefox-0:128.2.0-1.el7_9.x86_64",
            "7Server-ELS:firefox-debuginfo-0:128.2.0-1.el7_9.s390x",
            "7Server-ELS:firefox-debuginfo-0:128.2.0-1.el7_9.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "mozilla: Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2, and Thunderbird 128.2"
    }
  ]
}

cve-2024-8385

Vulnerability from cvelistv5

Published

2024-09-03 12:32

Modified

2024-09-06 18:31

Severity ?

9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Summary

A difference in the handling of StructFields and ArrayTypes in WASM could be used to trigger an exploitable type confusion vulnerability. This vulnerability affects Firefox < 130, Firefox ESR < 128.2, and Thunderbird < 128.2.

References

▼	URL	Tags
	https://bugzilla.mozilla.org/show_bug.cgi?id=1911909
	https://www.mozilla.org/security/advisories/mfsa2024-39/
	https://www.mozilla.org/security/advisories/mfsa2024-40/
	https://www.mozilla.org/security/advisories/mfsa2024-43/

Impacted products

▼	Vendor	Product
	Mozilla	Firefox
	Mozilla	Firefox ESR
	Mozilla	Thunderbird

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "firefox",
            "vendor": "mozilla",
            "versions": [
              {
                "lessThan": "130",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "firefox_esr",
            "vendor": "mozilla",
            "versions": [
              {
                "lessThan": "128.2",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.8,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-8385",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-03T15:46:49.316374Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-843",
                "description": "CWE-843 Access of Resource Using Incompatible Type (\u0027Type Confusion\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-03T15:47:53.001Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThan": "130",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Firefox ESR",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThan": "128.2",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThan": "128.2",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Seunghyun Lee"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "A difference in the handling of StructFields and ArrayTypes in WASM could be used to trigger an exploitable type confusion vulnerability. This vulnerability affects Firefox \u003c 130, Firefox ESR \u003c 128.2, and Thunderbird \u003c 128.2."
            }
          ],
          "value": "A difference in the handling of StructFields and ArrayTypes in WASM could be used to trigger an exploitable type confusion vulnerability. This vulnerability affects Firefox \u003c 130, Firefox ESR \u003c 128.2, and Thunderbird \u003c 128.2."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "WASM type confusion involving ArrayTypes",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-09-06T18:31:04.224Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1911909"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2024-39/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2024-40/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2024-43/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2024-8385",
    "datePublished": "2024-09-03T12:32:18.964Z",
    "dateReserved": "2024-09-03T06:39:12.097Z",
    "dateUpdated": "2024-09-06T18:31:04.224Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

cve-2024-7652

Vulnerability from cvelistv5

Published

2024-09-06 18:18

Modified

2024-09-12 15:48

Severity ?

7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Summary

An error in the ECMA-262 specification relating to Async Generators could have resulted in a type confusion, potentially leading to memory corruption and an exploitable crash. This vulnerability affects Firefox < 128, Firefox ESR < 115.13, Thunderbird < 115.13, and Thunderbird < 128.

References

▼	URL	Tags
	https://bugzilla.mozilla.org/show_bug.cgi?id=1901411
	https://github.com/tc39/ecma262/security/advisories/GHSA-g38c-wh3c-5h9r
	https://www.mozilla.org/security/advisories/mfsa2024-29/
	https://www.mozilla.org/security/advisories/mfsa2024-30/
	https://www.mozilla.org/security/advisories/mfsa2024-31/
	https://www.mozilla.org/security/advisories/mfsa2024-32/

Impacted products

▼	Vendor	Product
	Mozilla	Firefox
	Mozilla	Firefox ESR
	Mozilla	Thunderbird
	Mozilla	Thunderbird

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "firefox_esr",
            "vendor": "mozilla",
            "versions": [
              {
                "lessThan": "115.13",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "firefox",
            "vendor": "mozilla",
            "versions": [
              {
                "lessThan": "128",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "thunderbird",
            "vendor": "mozilla",
            "versions": [
              {
                "lessThan": "115.13",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              },
              {
                "lessThan": "128",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-7652",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-06T20:13:40.202031Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-843",
                "description": "CWE-843 Access of Resource Using Incompatible Type (\u0027Type Confusion\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          },
          {
            "descriptions": [
              {
                "cweId": "CWE-476",
                "description": "CWE-476 NULL Pointer Dereference",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-06T20:14:39.756Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThan": "128",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Firefox ESR",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThan": "115.13",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThan": "115.13",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThan": "128",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Nils Bars"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "An error in the ECMA-262 specification relating to Async Generators could have resulted in a type confusion, potentially leading to memory corruption and an exploitable crash. This vulnerability affects Firefox \u003c 128, Firefox ESR \u003c 115.13, Thunderbird \u003c 115.13, and Thunderbird \u003c 128."
            }
          ],
          "value": "An error in the ECMA-262 specification relating to Async Generators could have resulted in a type confusion, potentially leading to memory corruption and an exploitable crash. This vulnerability affects Firefox \u003c 128, Firefox ESR \u003c 115.13, Thunderbird \u003c 115.13, and Thunderbird \u003c 128."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Type Confusion in Async Generators in Javascript Engine",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-09-12T15:48:01.595Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1901411"
        },
        {
          "url": "https://github.com/tc39/ecma262/security/advisories/GHSA-g38c-wh3c-5h9r"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2024-29/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2024-30/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2024-31/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2024-32/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2024-7652",
    "datePublished": "2024-09-06T18:18:28.692Z",
    "dateReserved": "2024-08-09T17:55:56.045Z",
    "dateUpdated": "2024-09-12T15:48:01.595Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

cve-2024-8386

Vulnerability from cvelistv5

Published

2024-09-03 12:32

Modified

2024-11-21 15:06

Severity ?

6.1 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Summary

If a site had been granted the permission to open popup windows, it could cause Select elements to appear on top of another site to perform a spoofing attack. This vulnerability affects Firefox < 130, Firefox ESR < 128.2, and Thunderbird < 128.2.

References

▼	URL	Tags
	https://bugzilla.mozilla.org/show_bug.cgi?id=1907032
	https://bugzilla.mozilla.org/show_bug.cgi?id=1909163
	https://bugzilla.mozilla.org/show_bug.cgi?id=1909529
	https://www.mozilla.org/security/advisories/mfsa2024-39/
	https://www.mozilla.org/security/advisories/mfsa2024-40/
	https://www.mozilla.org/security/advisories/mfsa2024-43/

Impacted products

▼	Vendor	Product
	Mozilla	Firefox
	Mozilla	Firefox ESR
	Mozilla	Thunderbird

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 6.1,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "LOW",
              "privilegesRequired": "NONE",
              "scope": "CHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-8386",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-03T15:44:49.005338Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-290",
                "description": "CWE-290 Authentication Bypass by Spoofing",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-21T15:06:53.584Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThan": "130",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Firefox ESR",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThan": "128.2",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThan": "128.2",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Shaheen Fazim, Hafiizh"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "If a site had been granted the permission to open popup windows, it could cause Select elements to appear on top of another site to perform a spoofing attack. This vulnerability affects Firefox \u003c 130, Firefox ESR \u003c 128.2, and Thunderbird \u003c 128.2."
            }
          ],
          "value": "If a site had been granted the permission to open popup windows, it could cause Select elements to appear on top of another site to perform a spoofing attack. This vulnerability affects Firefox \u003c 130, Firefox ESR \u003c 128.2, and Thunderbird \u003c 128.2."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "SelectElements could be shown over another site if popups are allowed",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-09-06T18:31:06.466Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1907032"
        },
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1909163"
        },
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1909529"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2024-39/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2024-40/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2024-43/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2024-8386",
    "datePublished": "2024-09-03T12:32:19.249Z",
    "dateReserved": "2024-09-03T06:39:14.172Z",
    "dateUpdated": "2024-11-21T15:06:53.584Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

cve-2024-8382

Vulnerability from cvelistv5

Published

2024-09-03 12:32

Modified

2024-10-30 16:48

Severity ?

8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Summary

Internal browser event interfaces were exposed to web content when privileged EventHandler listener callbacks ran for those events. Web content that tried to use those interfaces would not be able to use them with elevated privileges, but their presence would indicate certain browser features had been used, such as when a user opened the Dev Tools console. This vulnerability affects Firefox < 130, Firefox ESR < 128.2, Firefox ESR < 115.15, Thunderbird < 128.2, and Thunderbird < 115.15.

References

▼	URL	Tags
	https://bugzilla.mozilla.org/show_bug.cgi?id=1906744
	https://www.mozilla.org/security/advisories/mfsa2024-39/
	https://www.mozilla.org/security/advisories/mfsa2024-40/
	https://www.mozilla.org/security/advisories/mfsa2024-41/
	https://www.mozilla.org/security/advisories/mfsa2024-43/
	https://www.mozilla.org/security/advisories/mfsa2024-44/

Impacted products

▼	Vendor	Product
	Mozilla	Firefox
	Mozilla	Firefox ESR
	Mozilla	Firefox ESR
	Mozilla	Thunderbird
	Mozilla	Thunderbird

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "firefox",
            "vendor": "mozilla",
            "versions": [
              {
                "lessThan": "130",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "firefox_esr",
            "vendor": "mozilla",
            "versions": [
              {
                "lessThan": "128.2",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              },
              {
                "lessThan": "115.15",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "thunderbird",
            "vendor": "mozilla",
            "versions": [
              {
                "lessThan": "128.2",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              },
              {
                "lessThan": "115.15",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 8.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-8382",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-30T16:38:10.647160Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-273",
                "description": "CWE-273 Improper Check for Dropped Privileges",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-30T16:48:49.040Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThan": "130",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Firefox ESR",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThan": "128.2",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Firefox ESR",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThan": "115.15",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThan": "128.2",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThan": "115.15",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Gregory Pappas"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Internal browser event interfaces were exposed to web content when privileged EventHandler listener callbacks ran for those events. Web content that tried to use those interfaces would not be able to use them with elevated privileges, but their presence would indicate certain browser features had been used, such as when a user opened the Dev Tools console. This vulnerability affects Firefox \u003c 130, Firefox ESR \u003c 128.2, Firefox ESR \u003c 115.15, Thunderbird \u003c 128.2, and Thunderbird \u003c 115.15."
            }
          ],
          "value": "Internal browser event interfaces were exposed to web content when privileged EventHandler listener callbacks ran for those events. Web content that tried to use those interfaces would not be able to use them with elevated privileges, but their presence would indicate certain browser features had been used, such as when a user opened the Dev Tools console. This vulnerability affects Firefox \u003c 130, Firefox ESR \u003c 128.2, Firefox ESR \u003c 115.15, Thunderbird \u003c 128.2, and Thunderbird \u003c 115.15."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Internal event interfaces were exposed to web content when browser EventHandler listener callbacks ran",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-09-06T18:31:00.792Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1906744"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2024-39/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2024-40/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2024-41/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2024-43/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2024-44/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2024-8382",
    "datePublished": "2024-09-03T12:32:18.066Z",
    "dateReserved": "2024-09-03T06:39:05.212Z",
    "dateUpdated": "2024-10-30T16:48:49.040Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

cve-2024-8383

Vulnerability from cvelistv5

Published

2024-09-03 12:32

Modified

2024-10-30 16:50

Severity ?

7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Summary

Firefox normally asks for confirmation before asking the operating system to find an application to handle a scheme that the browser does not support. It did not ask before doing so for the Usenet-related schemes news: and snews:. Since most operating systems don't have a trusted newsreader installed by default, an unscrupulous program that the user downloaded could register itself as a handler. The website that served the application download could then launch that application at will. This vulnerability affects Firefox < 130, Firefox ESR < 128.2, and Firefox ESR < 115.15.

References

▼	URL	Tags
	https://bugzilla.mozilla.org/show_bug.cgi?id=1908496
	https://www.mozilla.org/security/advisories/mfsa2024-39/
	https://www.mozilla.org/security/advisories/mfsa2024-40/
	https://www.mozilla.org/security/advisories/mfsa2024-41/

Impacted products

▼	Vendor	Product
	Mozilla	Firefox
	Mozilla	Firefox ESR
	Mozilla	Firefox ESR

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "firefox",
            "vendor": "mozilla",
            "versions": [
              {
                "lessThan": "130",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "firefox_esr",
            "vendor": "mozilla",
            "versions": [
              {
                "lessThan": "128.2",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              },
              {
                "lessThan": "115.15",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-8383",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-30T16:16:58.757351Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-1188",
                "description": "CWE-1188 Initialization of a Resource with an Insecure Default",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-30T16:50:27.066Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThan": "130",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Firefox ESR",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThan": "128.2",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Firefox ESR",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThan": "115.15",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "D7"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Firefox normally asks for confirmation before asking the operating system to find an application to handle a scheme that the browser does not support. It did not ask before doing so for the Usenet-related schemes news: and snews:. Since most operating systems don\u0027t have a trusted newsreader installed by default, an unscrupulous program that the user downloaded could register itself as a handler. The website that served the application download could then launch that application at will. This vulnerability affects Firefox \u003c 130, Firefox ESR \u003c 128.2, and Firefox ESR \u003c 115.15."
            }
          ],
          "value": "Firefox normally asks for confirmation before asking the operating system to find an application to handle a scheme that the browser does not support. It did not ask before doing so for the Usenet-related schemes news: and snews:. Since most operating systems don\u0027t have a trusted newsreader installed by default, an unscrupulous program that the user downloaded could register itself as a handler. The website that served the application download could then launch that application at will. This vulnerability affects Firefox \u003c 130, Firefox ESR \u003c 128.2, and Firefox ESR \u003c 115.15."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Firefox did not ask before openings news: links in an external application",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-09-06T18:31:01.884Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1908496"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2024-39/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2024-40/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2024-41/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2024-8383",
    "datePublished": "2024-09-03T12:32:18.363Z",
    "dateReserved": "2024-09-03T06:39:07.566Z",
    "dateUpdated": "2024-10-30T16:50:27.066Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

cve-2024-8384

Vulnerability from cvelistv5

Published

2024-09-03 12:32

Modified

2024-09-06 18:31

Severity ?

9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Summary

The JavaScript garbage collector could mis-color cross-compartment objects if OOM conditions were detected at the right point between two passes. This could have led to memory corruption. This vulnerability affects Firefox < 130, Firefox ESR < 128.2, Firefox ESR < 115.15, Thunderbird < 128.2, and Thunderbird < 115.15.

References

▼	URL	Tags
	https://bugzilla.mozilla.org/show_bug.cgi?id=1911288
	https://www.mozilla.org/security/advisories/mfsa2024-39/
	https://www.mozilla.org/security/advisories/mfsa2024-40/
	https://www.mozilla.org/security/advisories/mfsa2024-41/
	https://www.mozilla.org/security/advisories/mfsa2024-43/
	https://www.mozilla.org/security/advisories/mfsa2024-44/

Impacted products

▼	Vendor	Product
	Mozilla	Firefox
	Mozilla	Firefox ESR
	Mozilla	Firefox ESR
	Mozilla	Thunderbird
	Mozilla	Thunderbird

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "firefox",
            "vendor": "mozilla",
            "versions": [
              {
                "lessThan": "130",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "firefox_esr",
            "vendor": "mozilla",
            "versions": [
              {
                "lessThan": "128.2",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              },
              {
                "lessThan": "115.15",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.8,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-8384",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-03T15:49:08.611457Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-03T15:50:38.505Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThan": "130",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Firefox ESR",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThan": "128.2",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Firefox ESR",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThan": "115.15",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThan": "128.2",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThan": "115.15",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "the Mozilla Fuzzing Team"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "The JavaScript garbage collector could mis-color cross-compartment objects if OOM conditions were detected at the right point between two passes. This could have led to memory corruption. This vulnerability affects Firefox \u003c 130, Firefox ESR \u003c 128.2, Firefox ESR \u003c 115.15, Thunderbird \u003c 128.2, and Thunderbird \u003c 115.15."
            }
          ],
          "value": "The JavaScript garbage collector could mis-color cross-compartment objects if OOM conditions were detected at the right point between two passes. This could have led to memory corruption. This vulnerability affects Firefox \u003c 130, Firefox ESR \u003c 128.2, Firefox ESR \u003c 115.15, Thunderbird \u003c 128.2, and Thunderbird \u003c 115.15."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Garbage collection could mis-color cross-compartment objects in OOM conditions",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-09-06T18:31:03.084Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1911288"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2024-39/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2024-40/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2024-41/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2024-43/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2024-44/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2024-8384",
    "datePublished": "2024-09-03T12:32:18.656Z",
    "dateReserved": "2024-09-03T06:39:10.177Z",
    "dateUpdated": "2024-09-06T18:31:03.084Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

cve-2024-8381

Vulnerability from cvelistv5

Published

2024-09-03 12:32

Modified

2024-09-06 18:30

Severity ?

9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Summary

A potentially exploitable type confusion could be triggered when looking up a property name on an object being used as the `with` environment. This vulnerability affects Firefox < 130, Firefox ESR < 128.2, Firefox ESR < 115.15, Thunderbird < 128.2, and Thunderbird < 115.15.

References

▼	URL	Tags
	https://bugzilla.mozilla.org/show_bug.cgi?id=1912715
	https://www.mozilla.org/security/advisories/mfsa2024-39/
	https://www.mozilla.org/security/advisories/mfsa2024-40/
	https://www.mozilla.org/security/advisories/mfsa2024-41/
	https://www.mozilla.org/security/advisories/mfsa2024-43/
	https://www.mozilla.org/security/advisories/mfsa2024-44/

Impacted products

▼	Vendor	Product
	Mozilla	Firefox
	Mozilla	Firefox ESR
	Mozilla	Firefox ESR
	Mozilla	Thunderbird
	Mozilla	Thunderbird

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "firefox",
            "vendor": "mozilla",
            "versions": [
              {
                "lessThan": "130",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "firefox_esr",
            "vendor": "mozilla",
            "versions": [
              {
                "lessThan": "128.2",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              },
              {
                "lessThan": "115.15",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.8,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-8381",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-03T15:55:45.647342Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-843",
                "description": "CWE-843 Access of Resource Using Incompatible Type (\u0027Type Confusion\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-03T15:57:38.939Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThan": "130",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Firefox ESR",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThan": "128.2",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Firefox ESR",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThan": "115.15",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThan": "128.2",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThan": "115.15",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Nils Bars"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "A potentially exploitable type confusion could be triggered when looking up a property name on an object being used as the \u003ccode\u003ewith\u003c/code\u003e environment. This vulnerability affects Firefox \u003c 130, Firefox ESR \u003c 128.2, Firefox ESR \u003c 115.15, Thunderbird \u003c 128.2, and Thunderbird \u003c 115.15."
            }
          ],
          "value": "A potentially exploitable type confusion could be triggered when looking up a property name on an object being used as the `with` environment. This vulnerability affects Firefox \u003c 130, Firefox ESR \u003c 128.2, Firefox ESR \u003c 115.15, Thunderbird \u003c 128.2, and Thunderbird \u003c 115.15."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Type confusion when looking up a property name in a \"with\" block",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-09-06T18:30:59.560Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1912715"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2024-39/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2024-40/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2024-41/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2024-43/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2024-44/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2024-8381",
    "datePublished": "2024-09-03T12:32:17.682Z",
    "dateReserved": "2024-09-03T06:39:02.971Z",
    "dateUpdated": "2024-09-06T18:30:59.560Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

cve-2024-8387

Vulnerability from cvelistv5

Published

2024-09-03 12:32

Modified

2024-09-06 18:31

Severity ?

9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Summary

Memory safety bugs present in Firefox 129, Firefox ESR 128.1, and Thunderbird 128.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 130, Firefox ESR < 128.2, and Thunderbird < 128.2.

References

▼	URL	Tags
	https://bugzilla.mozilla.org/buglist.cgi?bug_id=1857607%2C1911858%2C1914009
	https://www.mozilla.org/security/advisories/mfsa2024-39/
	https://www.mozilla.org/security/advisories/mfsa2024-40/
	https://www.mozilla.org/security/advisories/mfsa2024-43/

Impacted products

▼	Vendor	Product
	Mozilla	Firefox
	Mozilla	Firefox ESR
	Mozilla	Thunderbird

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "firefox",
            "vendor": "mozilla",
            "versions": [
              {
                "lessThan": "130",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "firefox_esr",
            "vendor": "mozilla",
            "versions": [
              {
                "lessThan": "128.2",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.8,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-8387",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-03T15:41:12.477826Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-119",
                "description": "CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-03T15:43:16.565Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThan": "130",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Firefox ESR",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThan": "128.2",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThan": "128.2",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Yury Delendik, the Mozilla Fuzzing Team"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Memory safety bugs present in Firefox 129, Firefox ESR 128.1, and Thunderbird 128.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox \u003c 130, Firefox ESR \u003c 128.2, and Thunderbird \u003c 128.2."
            }
          ],
          "value": "Memory safety bugs present in Firefox 129, Firefox ESR 128.1, and Thunderbird 128.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox \u003c 130, Firefox ESR \u003c 128.2, and Thunderbird \u003c 128.2."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2, and Thunderbird 128.2",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-09-06T18:31:07.603Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "name": "Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2, and Thunderbird 128.2",
          "url": "https://bugzilla.mozilla.org/buglist.cgi?bug_id=1857607%2C1911858%2C1914009"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2024-39/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2024-40/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2024-43/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2024-8387",
    "datePublished": "2024-09-03T12:32:19.490Z",
    "dateReserved": "2024-09-03T06:39:16.291Z",
    "dateUpdated": "2024-09-06T18:31:07.603Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

Vulnerability from csaf_redhat

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Tags

Sightings

Nomenclature