Summary
Mozilla heeft kwetsbaarheden verholpen in Firefox en Thunderbird.
Details
Interpretaties
Een kwaadwillende kan de kwetsbaarheden misbruiken om in de context van het slachtoffer beveiligingsmaatregelen te omzeilen en mogelijk willekeurige code uit te voeren of toegang te krijgen tot gevoelige gegevens in de context van de browser.
Voor succesvol misbruik moet de kwaadwillende het slachtoffer misleiden een malafide link te openen.
Oplossingen
Mozilla heeft updates uitgebracht om de kwetsbaarheden te verhelpen in Firefox 115.14, 128.1 & 129 en Thunderbird 115.14 & 128.1. Zie bijgevoegde referenties voor meer informatie.
Vulnerabilities 14
-
Critical 9.8
Incomplete WebAssembly exception handing could have led to a use-after-free. This vulnerability affects Firefox < 129, …
-
Critical 9.8
Incorrect garbage collection interaction in IndexedDB could have led to a use-after-free. This vulnerability affects Fi…
-
Critical 9.8
Incorrect garbage collection interaction could have led to a use-after-free. This vulnerability affects Firefox < 129.
-
Critical 9.1
Editor code failed to check an attribute value. This could have led to an out-of-bounds read. This vulnerability affect…
-
Critical 9.1
It was possible for a web extension with minimal permissions to create a `StreamFilter` which could be used to read and…
-
High 8.8
Insufficient checks when processing graphics shared memory could have led to memory corruption. This could be leveraged…
-
High 8.8
A type confusion bug in WebAssembly could be leveraged by an attacker to potentially achieve code execution. This vulne…
-
High 8.8
Unexpected marking work at the start of sweeping could have led to a use-after-free. This vulnerability affects Firefox…
-
High 8.1
The date picker could partially obscure security prompts. This could be used by a malicious site to trick a user into g…
-
High 7.5
ANGLE failed to initialize parameters which lead to reading from uninitialized memory. This could be leveraged to leak …
-
Medium 6.5
Select options could obscure the fullscreen notification dialog. This could be used by a malicious site to perform a sp…
-
Medium 6.3
A select option could partially obscure security prompts. This could be used by a malicious site to trick a user into g…
-
Medium 6.3
Calling `PK11_Encrypt()` in NSS using CKM_CHACHA20 and the same buffer for input and output can result in plaintext on …
-
Medium 6.1
Firefox adds web-compatibility shims in place of some tracking scripts blocked by Enhanced Tracking Protection. On a si…
Revision history
-
#0
Initiele versie
References
-
Source - mozilla
https://www.mozilla.org/security/advisories/mfsa2024-33/
-
Source - mozilla
https://www.mozilla.org/security/advisories/mfsa2024-34/
-
Source - mozilla
https://www.mozilla.org/security/advisories/mfsa2024-35/
-
Source - mozilla
https://www.mozilla.org/security/advisories/mfsa2024-37/
-
Source - mozilla
https://www.mozilla.org/security/advisories/mfsa2024-38/