This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.
[TLP:CLEAR] Firefox 131.0.2, ESR 128.3.1/115.16.1 fix a critical, actively exploited vulnerability
Mozilla versions 131.0.2, 115.16.1 (ESR) and 128.3.1 (ESR) fix an actively exploited critical vulnerability in Firefox [1]. Among operating systems, the vulnerability has been fixed by Slackware in version 15.0 [2]; Gentoo has some fixed versions available as stable and some as testing [3]; Red Hat has fixes available [4]. Ubuntu released the fixed version 131.0.2+build1-0ubuntu0.20.04.1 for Focal 20.04 LTS. Jammy 22.04 LTS and Noble 24.04 LTS use snap and are therefore not affected [5]. Debian released fixes for Firefox in version 131.0.2-1, and for Firefox (ESR) in the bullseye release in version 128.3.1esr-1~deb11u1 and in bookworm in version 128.3.1esr-1~deb12u1 [6].
An unauthenticated remote attacker can execute code in the content process through a use-after-free vulnerability [1][7][8].
The vulnerability is present in products:
- Firefox; < 131.0.2
- Firefox ESR; < 128.3.1
- Firefox ESR; < 115.16.1
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
More information:
- CVE-2024-9680 at cve.org, NVD
- CWE-416: Use After Free at cwe.mitre.org
The vulnerability was publicly disclosed 9. 10. 2024.
Links
- [1] https://www.mozilla.org/en-US/security/advisories/mfsa2024-51/
- [2] http://www.slackware.com/security/viewer.php?l=slackware-security&y=2024&m=slackware-security.385911
- [3] https://packages.gentoo.org/packages/www-client/firefox
- [4] https://access.redhat.com/security/cve/cve-2024-9680
- [5] https://ubuntu.com/security/CVE-2024-9680
- [6] https://security-tracker.debian.org/tracker/CVE-2024-9680
- [7] https://github.com/advisories/GHSA-hm3j-qgpw-pj98
- [8] https://www.bleepingcomputer.com/news/security/mozilla-fixes-firefox-zero-day-actively-exploited-in-attacks/
By CESNET, z.s.p.o. Michaela Ručková on 17. 10. 2024.