This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.
[TLP:CLEAR] Mozilla Firefox fixes 9 vulnerabilities
Mozilla fixes 9 vulnerabilities in Firefox in versions 130, 128.2 (ESR) and 115.15 (ESR) [1][2][3]. Among operating systems, the vulnerabilities were fixed by Debian (some releases) [4] and Slackware [5]; Gentoo has some fixed versions available as stable and some as testing [6]; and Ubuntu released the fixed version 130.0+build2-0ubuntu0.20.04.1 for the focal release, while the remaining releases are not affected by the vulnerabilities [7]. Only the most severe vulnerabilities are listed below. A detailed list of vulnerable versions for each vulnerability can be found on the VA2AM site. Individual Debian releases and fixed versions: bullseye (security) - 115.15.0esr-1~deb11u1 bookworm (security) - 115.15.0esr-1~deb12u1 sid, trixie - 115.15.0esr-1 sid - 130.0-2
An unauthenticated remote attacker can access memory without authorization, which may lead to data corruption, unauthorized reading of information, a DoS attack and potentially code execution [8][1][2][3].
The vulnerability is present in product:
- Firefox; >=115, <115.5; >=128, <128.2; >=129, <130;
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
More information:
- CVE-2024-8381 at cve.org, NVD
- CWE-843: Access of Resource Using Incompatible Type ('Type Confusion') at cwe.mitre.org
The vulnerability was publicly disclosed 3. 9. 2024.
An unauthenticated remote attacker can access memory without authorization, which may lead to data corruption, unauthorized reading of information, a DoS attack and potentially code execution [9][1][2][3].
The vulnerability is present in product:
- Firefox; >=128, <128.2; >=129, <130;
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
More information:
- CVE-2024-8385 at cve.org, NVD
- CWE-843: Access of Resource Using Incompatible Type ('Type Confusion') at cwe.mitre.org
The vulnerability was publicly disclosed 3. 9. 2024.
An unauthenticated remote attacker can corrupt data in memory and potentially cause unauthorized code execution [10][1][2][3].
The vulnerability is present in product:
- Firefox; >=128, <128.2 ; >=129, <130;
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
More information:
- CVE-2024-8387 at cve.org, NVD
- CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer at cwe.mitre.org
The vulnerability was publicly disclosed 3. 9. 2024.
An unauthenticated remote attacker can corrupt data in memory and potentially cause unauthorized code execution [11][1][2][3].
The vulnerability is present in product:
- Firefox; >=129, <130;
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
More information:
- CVE-2024-8389 at cve.org, NVD
- CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer at cwe.mitre.org
The vulnerability was publicly disclosed 3. 9. 2024.
Links
- [1] https://www.mozilla.org/en-US/security/advisories/mfsa2024-41/
- [2] https://www.mozilla.org/en-US/security/advisories/mfsa2024-40/
- [3] https://www.mozilla.org/en-US/security/advisories/mfsa2024-39/
- [4] https://security-tracker.debian.org/tracker/source-package/firefox
- [5] http://www.slackware.com/security/viewer.php?l=slackware-security&y=2024&m=slackware-security.377367
- [6] https://packages.gentoo.org/packages/www-client/firefox
- [7] https://ubuntu.com/security/CVE-2024-8381
- [8] https://nvd.nist.gov/vuln/detail/CVE-2024-8381
- [9] https://nvd.nist.gov/vuln/detail/CVE-2024-8385
- [10] https://nvd.nist.gov/vuln/detail/CVE-2024-8387
- [11] https://nvd.nist.gov/vuln/detail/CVE-2024-8389
By CESNET, z.s.p.o. Martin Krajči on 10. 9. 2024.