This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.

[TLP:CLEAR] Firefox 115.9.1 ESR and 124.0.1 fix critical vulnerabilities

we report on web browser vulnerabilities only exceptionally, but Firefox fixes a critical vulnerability allowing remote code execution in ESR version 115.9.1 [1] as well as in the current version 124.0.1, which also fixes another critical vulnerability [2].

Firefox - CVE-2024-29943 (OOB read/write)
CVSS 4.8 (Medium)

An unauthenticated attacker can bypass the bounds check on access and thereby read or modify a JavaScript object [3]. Recommendations: Update to Firefox 124.0.1

The vulnerability is present in product:

  • Firefox;=124.0.0

CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

More information:

The vulnerability was publicly disclosed 22. 3. 2024.

Firefox - CVE-2024-29944 (RCE)
CVSS 8.1 (High)

An unauthenticated attacker can inject an event handler into a privileged object and thereby achieve remote code execution [4]. Impact: Malicious code execution Recommendations: Update to Firefox ESR 115.9.1 or Firefox 124.0.1

The vulnerability is present in product:

  • Firefox;<115.9.1;>116.0.0,<124.0.1

CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:L

More information:

The vulnerability was publicly disclosed 22. 3. 2024.

CESNET, z.s.p.o. on 25. 3. 2024.

CESNET, z.s.p.o. Logo