Summary
Mozilla heeft kwetsbaarheden verholpen in Firefox en Thunderbird.
Details
Interpretaties
Een kwaadwillende kan de kwetsbaarheden misbruiken om aanvallen uit te voeren die kunnen leiden tot de volgende categorieën schade:
* Cross-Site-Scripting (XSS)
* Denial-of-Service (DoS)
* Toegang tot gevoelige gegevens
Oplossingen
Mozilla heeft updates uitgebracht om de kwetsbaarheden te verhelpen in Firefox en Thunderbird 132, Thunderbird 128.4, Firefox ESR 115.17 en 128.4. Voor meer informatie, zie bijgevoegde referenties.
Vulnerabilities 11
-
Critical 9.8
Memory safety bugs present in Firefox 131, Firefox ESR 128.3, and Thunderbird 128.3. Some of these bugs showed evidence…
-
Critical 9.8
Potential race conditions in IndexedDB could have caused memory corruption, leading to a potentially exploitable crash.…
-
High 7.5
Truncation of a long URL could have allowed origin spoofing in a permission prompt. This vulnerability affects Firefox …
-
High 7.5
Video frames could have been leaked between origins in some situations. This vulnerability affects Firefox < 132, Firef…
-
High 7.5
Repeated writes to history interface attributes could have been used to cause a Denial of Service condition in the brow…
-
High 7.5
A clipboard "paste" button could persist across tabs which allowed a spoofing attack. This vulnerability affects Firefo…
-
High 7.5
By sending a specially crafted push message, a remote server could have hung the parent process, causing the browser to…
-
Medium 6.5
A permission leak could have occurred from a trusted site to an untrusted site via `embed` or `object` elements. This v…
-
Medium 6.5
An attacker could have caused a use-after-free when accessibility was enabled, leading to a potentially exploitable cra…
-
Medium 6.1
In multipart/x-mixed-replace responses, `Content-Disposition: attachment` in the response header was not respected and …
-
Medium 5.4
The origin of an external protocol handler prompt could have been obscured using a data: URL within an `iframe`. This v…
Revision history
-
#0
Initiele versie
References
-
Reference - hkcert
https://www.mozilla.org/en-US/security/advisories/mfsa2024-59/
-
Reference - hkcert
https://www.mozilla.org/en-US/security/advisories/mfsa2024-58/
-
Reference - hkcert
https://www.mozilla.org/en-US/security/advisories/mfsa2024-57/
-
Reference - hkcert
https://www.mozilla.org/en-US/security/advisories/mfsa2024-56/
-
Reference - hkcert
https://www.mozilla.org/en-US/security/advisories/mfsa2024-55/