This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.
[TLP:CLEAR] Mozilla Firefox and Thunderbird fix 11 vulnerabilities
Mozilla fixes 11 vulnerabilities in Thunderbird, Firefox and Firefox ESR [1][2][3][4][5]. The most severe vulnerabilities are listed below. Individual products and their fixed versions: Firefox - 132 [1] Firefox ESR - 128.4, 115.17 [2][3] Thunderbird - 128.4, 132 [4][5]
An unauthenticated remote attacker can obtain permissions they should not have access to. To exploit the vulnerability, elements from the attacker's web page must be embedded in a legitimate page that has been granted at least some permissions [1][2][3][4][5][6].
The vulnerability is present in products:
- Firefox; < 132;
- Firefox ESR; <115.17; >= 128, < 128.4;
- Thunderbird; < 128.4;
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
More information:
- CVE-2024-10458 at cve.org, NVD
- CWE-281: Improper Preservation of Permissions at cwe.mitre.org
The vulnerability was publicly disclosed 29. 10. 2024.
An unauthenticated remote attacker can cause a DoS attack by accessing unallocated memory. The vulnerability is exploitable only if the victim uses the "Accessibility" functionality [1][2][3][4][5][7].
The vulnerability is present in products:
- Firefox; < 132;
- Firefox ESR; <115.17; >= 128, < 128.4;
- Thunderbird; < 128.4;
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
More information:
- CVE-2024-10459 at cve.org, NVD
- CWE-416: Use After Free at cwe.mitre.org
The vulnerability was publicly disclosed 29. 10. 2024.
An unauthenticated remote attacker can write to unallocated memory, which can potentially lead to code execution [1][2][3][4][5][8].
The vulnerability is present in products:
- Firefox; < 132;
- Firefox ESR; <115.17; >= 128, < 128.4;
- Thunderbird; < 128.4;
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
More information:
- CVE-2024-10467 at cve.org, NVD
- CWE-787: Out-of-bounds Write at cwe.mitre.org
- CWE-125: Out-of-bounds Read at cwe.mitre.org
The vulnerability was publicly disclosed 29. 10. 2024.
Links
- [1] https://www.mozilla.org/en-US/security/advisories/mfsa2024-55/
- [2] https://www.mozilla.org/en-US/security/advisories/mfsa2024-56/
- [3] https://www.mozilla.org/en-US/security/advisories/mfsa2024-57/
- [4] https://www.mozilla.org/en-US/security/advisories/mfsa2024-58/
- [5] https://www.mozilla.org/en-US/security/advisories/mfsa2024-59/
- [6] https://nvd.nist.gov/vuln/detail/CVE-2024-10458
- [7] https://nvd.nist.gov/vuln/detail/CVE-2024-10459
- [8] https://nvd.nist.gov/vuln/detail/CVE-2024-10467
By CESNET, z.s.p.o. Martin Krajči on 13. 11. 2024.