Summary
Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.
Security Fix(es):
* Firefox: 115.14/128.1 ESR ()
* mozilla: Fullscreen notification dialog can be obscured by document content (CVE-2024-7518)
* mozilla: Out of bounds memory access in graphics shared memory handling (CVE-2024-7519)
* mozilla: Type confusion in WebAssembly (CVE-2024-7520)
* mozilla: Incomplete WebAssembly exception handing (CVE-2024-7521)
* mozilla: Out of bounds read in editor component (CVE-2024-7522)
* mozilla: CSP strict-dynamic bypass using web-compatibility shims (CVE-2024-7524)
* mozilla: Missing permission check when creating a StreamFilter (CVE-2024-7525)
* mozilla: Uninitialized memory used by WebGL (CVE-2024-7526)
* mozilla: Use-after-free in JavaScript garbage collection (CVE-2024-7527)
* mozilla: Use-after-free in IndexedDB (CVE-2024-7528)
* mozilla: Document content could partially obscure security prompts (CVE-2024-7529)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux · 9 | firefox | 115.14.0-2.el9_4.alma.1 |
| AlmaLinux · 9 | firefox-x11 | 115.14.0-2.el9_4.alma.1 |
Vulnerabilities 11
-
Critical 9.8
Incomplete WebAssembly exception handing could have led to a use-after-free. This vulnerability affects Firefox < 129, …
-
Critical 9.8
Incorrect garbage collection interaction in IndexedDB could have led to a use-after-free. This vulnerability affects Fi…
-
Critical 9.1
Editor code failed to check an attribute value. This could have led to an out-of-bounds read. This vulnerability affect…
-
Critical 9.1
It was possible for a web extension with minimal permissions to create a `StreamFilter` which could be used to read and…
-
High 8.8
Insufficient checks when processing graphics shared memory could have led to memory corruption. This could be leveraged…
-
High 8.8
A type confusion bug in WebAssembly could be leveraged by an attacker to potentially achieve code execution. This vulne…
-
High 8.8
Unexpected marking work at the start of sweeping could have led to a use-after-free. This vulnerability affects Firefox…
-
High 8.1
The date picker could partially obscure security prompts. This could be used by a malicious site to trick a user into g…
-
High 7.5
ANGLE failed to initialize parameters which lead to reading from uninitialized memory. This could be leveraged to leak …
-
Medium 6.5
Select options could obscure the fullscreen notification dialog. This could be used by a malicious site to perform a sp…
-
Medium 6.1
Firefox adds web-compatibility shims in place of some tracking scripts blocked by Enhanced Tracking Protection. On a si…
References
-
report
https://access.redhat.com/security/cve/CVE-2024-7518
-
report
https://access.redhat.com/security/cve/CVE-2024-7519
-
report
https://access.redhat.com/security/cve/CVE-2024-7520
-
report
https://access.redhat.com/security/cve/CVE-2024-7521
-
report
https://access.redhat.com/security/cve/CVE-2024-7522
-
report
https://access.redhat.com/security/cve/CVE-2024-7524
-
report
https://access.redhat.com/security/cve/CVE-2024-7525
-
report
https://access.redhat.com/security/cve/CVE-2024-7526
-
report
https://access.redhat.com/security/cve/CVE-2024-7527
-
report
https://access.redhat.com/security/cve/CVE-2024-7528
-
report
https://access.redhat.com/security/cve/CVE-2024-7529
-
report
https://bugzilla.redhat.com/2303135
-
report
https://bugzilla.redhat.com/2303136
-
report
https://bugzilla.redhat.com/2303137
-
report
https://bugzilla.redhat.com/2303138
-
report
https://bugzilla.redhat.com/2303139
-
report
https://bugzilla.redhat.com/2303141
-
report
https://bugzilla.redhat.com/2303142
-
report
https://bugzilla.redhat.com/2303143
-
report
https://bugzilla.redhat.com/2303144
-
report
https://bugzilla.redhat.com/2303145
-
report
https://bugzilla.redhat.com/2303146
-
advisory
https://errata.almalinux.org/9/ALSA-2024-5322.html