Red Hat Security Advisory: firefox security update

Fixed packages 4

Vulnerabilities 11

• Critical 9.8
  CVE-2024-9680 Exploited · Ransomware Public exploit EPSS 23%

  An attacker was able to achieve code execution in the content process by exploiting a use-after-free in Animation timel…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine Wolfi
  Oct 9, 2024

  KEV Oct 15, 2024
• Critical 9.8
  CVE-2024-10467

  Memory safety bugs present in Firefox 131, Firefox ESR 128.3, and Thunderbird 128.3. Some of these bugs showed evidence…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Wolfi
  Oct 29, 2024
• High 7.5
  CVE-2024-10462

  Truncation of a long URL could have allowed origin spoofing in a permission prompt. This vulnerability affects Firefox …

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Wolfi
  Oct 29, 2024
• High 7.5
  CVE-2024-10463

  Video frames could have been leaked between origins in some situations. This vulnerability affects Firefox < 132, Firef…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine Wolfi
  Oct 29, 2024
• High 7.5
  CVE-2024-10464

  Repeated writes to history interface attributes could have been used to cause a Denial of Service condition in the brow…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Wolfi
  Oct 29, 2024
• High 7.5
  CVE-2024-10465

  A clipboard "paste" button could persist across tabs which allowed a spoofing attack. This vulnerability affects Firefo…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Wolfi
  Oct 29, 2024
• High 7.5
  CVE-2024-10466

  By sending a specially crafted push message, a remote server could have hung the parent process, causing the browser to…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Wolfi
  Oct 29, 2024
• Medium 6.5
  CVE-2024-10458

  A permission leak could have occurred from a trusted site to an untrusted site via `embed` or `object` elements. This v…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine Wolfi
  Oct 29, 2024
• Medium 6.5
  CVE-2024-10459

  An attacker could have caused a use-after-free when accessibility was enabled, leading to a potentially exploitable cra…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine Wolfi
  Oct 29, 2024
• Medium 6.1
  CVE-2024-10461

  In multipart/x-mixed-replace responses, `Content-Disposition: attachment` in the response header was not respected and …

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Wolfi
  Oct 29, 2024
• Medium 5.4
  CVE-2024-10460

  The origin of an external protocol handler prompt could have been obscured using a data: URL within an `iframe`. This v…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Wolfi
  Oct 29, 2024

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2317442
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2322424
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2322425
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2322428
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2322429
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2322433
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2322434
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2322438
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2322439
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2322440
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2322444
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_9554.json
• report
  https://access.redhat.com/security/cve/CVE-2024-9680
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-9680
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-9680
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2024-51/
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2024-52/
• article
  https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• report
  https://access.redhat.com/security/cve/CVE-2024-10458
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-10458
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-10458
• article
  https://bugzilla.mozilla.org/show_bug.cgi?id=1921733
• article
  https://www.mozilla.org/security/advisories/mfsa2024-55/
• article
  https://www.mozilla.org/security/advisories/mfsa2024-56/
• article
  https://www.mozilla.org/security/advisories/mfsa2024-57/
• article
  https://www.mozilla.org/security/advisories/mfsa2024-58/
• article
  https://www.mozilla.org/security/advisories/mfsa2024-59/
• report
  https://access.redhat.com/security/cve/CVE-2024-10459
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-10459
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-10459
• article
  https://bugzilla.mozilla.org/show_bug.cgi?id=1919087
• report
  https://access.redhat.com/security/cve/CVE-2024-10460
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-10460
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-10460
• article
  https://bugzilla.mozilla.org/show_bug.cgi?id=1912537
• report
  https://access.redhat.com/security/cve/CVE-2024-10461
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-10461
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-10461